🛡️ NextGen Obfuscator v2.0: The Nanomite Era

Welcome to the next generation of LLVM-based protection. Version 2.0 introduces Nanomite-based Runtime Protection, moving obfuscation from static code blocks into the operating system's exception handling layer.

Warning: This suite is designed for advanced binary protection. Use only under Windows environments for legitimate security research.

---

🔥 Key Features

• Nanomite Virtual Dispatcher: Replaces standard branch instructions with INT3 (Software Breakpoint) traps. Execution is routed through an encrypted exception handler.
• MBA Obfuscation: Transforms arithmetic into complex Mixed-Boolean Arithmetic identities that defy decompiler simplification (e.g., IDA's hex-rays).
• Control Flow Flattening (v2.0): Uses opaque predicates based on hardware entropy (RDTSC) to flatten function logic into a central dispatcher.
• Mind Games: Automatically injects fake dependencies (Direct3D, OpenGL) and call graph noise to camouflage your binary as a graphics library.
• Selective Protection: Use the OBFUSCATE macro to precisely target sensitive functions.

---

🚀 Quick Start for Beginners

1. Prerequisites

• Windows 10/11
• Visual Studio 2022 (with C++ Desktop development)
• LLVM 16.0.6 (Windows MSVC build): Install it to C:\Cllvm-16.

2. Prepare your Source Code

To protect a function, simply mark it with the OBFUSCATE macro and install the Nanomite engine in your main().

#include "include/NanomiteProtector.h"

// Marks this function for the obfuscator plugin
OBFUSCATE int MySecretLogic(int a) {
    return (a * 1337) ^ 0xDEAD;
}

int main() {
    // 🛡️ MUST be called at the very beginning to catch INT3 traps
    Nanomite::Install(); 
    
    printf("Result: %d\n", MySecretLogic(42));
    return 0;
}

3. Build & Protect

Run these commands in your project folder:

# Configure CMake with Clang-CL (included in your LLVM folder)
cmake -B build -S . -DCMAKE_CXX_COMPILER="C:\Cllvm-16\path-to\clang-cl.exe"

# Build the project
cmake --build build --config Release

Your protected binary will be in build/Release/test_protected.exe.

---

🛠️ Architecture: How it works

1. Plugin Stage: The LLVM pass identifies marked functions and inserts INT3 instructions instead of jmp/call.
2. Runtime Stage: When test_protected.exe runs, the Nanomite::Install() sets up a Vectored Exception Handler (VEH).
3. Execution Stage: Every time an INT3 is hit, the OS pauses execution. Our handler intercepts this, decrypts the next instruction's address, and resumes execution seamlessly.
   • Result: Static analysis tools like IDA Pro see a "dead" binary full of breakpoints, but it runs perfectly fine.

---

⚖️ License

This project is for educational purposes only. Unauthorized use on software you do not own is strictly prohibited.