C++ enables us to provide seamless data obfuscation

PROTEKKT has released a C++ SDK called POL (PROTEKKT Obfuscated Library) that provides seamless data obfuscation to harden applications against reverse engineering, supporting C++17 and automatically upgrading for C++20/23/26. The library offers low-level C APIs for runtime value obfuscation, advanced integer obfuscation with operations on encrypted data, runtime data obfuscation, and static data obfuscation using marker bytes, with higher-level C++ types encapsulating these functions.

Introduction In our previous article Hardening Against AI Reverse Engineering: Making Computers Struggle hardening-against-ai-reverse-engineering.html , we focused on what most code virtualization products disregarded over the years: Why data obfuscation is just as important as code obfuscation to us and why we want to provide a wider range of possibilities than what code obfuscators usually offer basic string encryption utilities . Now we'd like to take you through our SDK, its features and usage examples. We are still finalizing the product so at the time of release certain functionalities may be named or performed differently, but what we are presenting here is pretty much what it will look like. In this post we'll go through our C++ implementation named POL PROTEKKT Obfuscated Library , but we plan on expanding our SDK to other popular programming languages as well. We are aware that many projects take longer to upgrade their toolset and C++ standard used, so the library is written to support C++17. If C++20 or C++23 are used, the SDK will automatically switch to a more efficient implementation or enable functionality that is not possible to implement without newer standards. When it becomes widely available, C++26 support in major compilers will allow us to implement even easier interfaces and new features. Low-Level API At its core, everything is based on a low-level C API. The obfuscation process automatically replaces all instances and references to these functions with randomly generated encryption/decryption stubs implementing the logic behind them. This allows us to implement higher-level concepts in most programming languages that allow interaction with C libraries. The API can be split into a few groups: 1. Runtime Value Obfuscation Basic integer obfuscation for runtime values. Suitable for places where performance matters. // runtime value obfuscation uint8 t protekkt rvo set8 uint8 t ; uint16 t protekkt rvo set16 uint16 t ; uint32 t protekkt rvo set32 uint32 t ; uint64 t protekkt rvo set64 uint64 t ; uint8 t protekkt rvo get8 uint8 t ; uint16 t protekkt rvo get16 uint16 t ; uint32 t protekkt rvo get32 uint32 t ; uint64 t protekkt rvo get64 uint64 t ; 2. Advanced Integer Obfuscation Complex integer obfuscation, supports standard operations without ever decoding complete values in plaintext form. // number obfuscation void protekkt num init u8 void base ; void protekkt num init u16 void base ; // ... void protekkt num add void dst, void const src ; void protekkt num sub void dst, void const src ; void protekkt num mul void dst, void const src ; void protekkt num xor void dst, void const src ; void protekkt num and void dst, void const src ; // ... 3. Runtime Data Obfuscation Used for obfuscating runtime data. // runtime data obfuscation void protekkt rdo init void base ; void protekkt rdo decode void const base, size t offset, void dst, size t size ; void protekkt rdo encode void base, size t offset, void const src, size t size ; 4. Static Data Obfuscation Used for encrypting compile-time constants and any compile-time initialized data. Data is inserted between marker bytes to allow the obfuscator to locate data that needs to be obfuscated/encrypted. // static data obfuscation void protekkt sdo decode void const base, size t offset, void dst, size t size ; // static data obfuscation markers define PTKT SDO BEG MARKER { 'P', 'T', 'K', 'T', 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 'B', 'E', 'G', 0x00 } define PTKT SDO END MARKER { 'P', 'T', 'K', 'T', 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00, 'E', 'N', 'D', 0x00 } // runtime data obfuscation prefix size define PTKT RDO MARKER SIZE 16 Core C++ Types Types encapsulating the low-level C API, providing an intuitive way for initialization, reads and modification of obfuscated data. They are intended to be used directly, but are also the building blocks of more complex data structures. Constructors, destructors and methods provided by these types are "force inline" to ensure unique obfuscations for different variables/objects instead of having a single point in the compiled binary that allows interception of all obfuscated values. 1. Runtime Value Obfuscation A wrapper for integral/enum/boolean types and pointers. Provides overloaded operators to act as a drop-in replacement for any of them assignment, retrieval, comparisons, arithmetic and bitwise operations, etc . RVO provides data encryption/decryption where performance matters more. // protekkt/pol/rvo.hpp template <typename T class rvo { / implementation / }; Instead of: std::uint32 t value; std::uint32 t bits; std::uint32 t res = value << bits; An obfuscated variant would be: pol::rvo<std::uint32 t value; pol::rvo<std::uint32 t bits; pol::rvo<std::uint32 t res = value << bits; Or with pointers: php pol::rvo<my class x; if x x- method ; 2. Advanced Integer Obfuscation Similar to RVO a simpler and faster obfuscation for integral types , NUM is a significantly more obfuscated variant, a full implementation of integers. It supports all arithmetic and bitwise operations with both plaintext integral values and other instances of NUM, without ever decrypting the hidden values. The exception is the get method which is used when the developer explicitly wants to decrypt the value. // protekkt/pol/num.hpp template <typename T class num { / implementation / }; Usage example: // initialize from runtime values pol::num<std::uint64 t score 1000 ; pol::num<std::uint64 t bonus 250 ; // perform addition without exposing x, y or the result x += y; // perform multiplication without exposing score, multiplier or the result pol::num<std::uint64 t multiplier 2 ; pol::num<std::uint64 t result = score multiplier; // operator++ automatically encrypts a literal '1' into a temporary pol::num // and performs obfuscated addition ++result; // '4' is automatically encrypted into a temporary pol::num // and obfuscated bitwise shift is performed result <<= 4; // pol::num decrypts stored values only if the user explicitly calls get // all operations are performed using obfuscated implementations on internal representation auto plaintext = result.get ; 3. Runtime Data Obfuscation A class providing encryption/obfuscation of runtime data. The location of encrypted data is configurable through a template parameter depending on whether you want data to be part of the object itself or to be allocated on the heap. // protekkt/pol/rdo.hpp // storage policy tags struct inline t {}; struct dynamic t {}; // reference types allowing access to specific members within // complex obfuscated types e.g. structs, arrays or arrays of structs template <typename U class const rdo ref { / implementation / }; template <typename U class rdo ref { / implementation / }; // obfuscated wrapper allowing inline and heap-allocated storage // supports single elements, struct instances and arrays // configurable, internal data can be stored as RVO or NUM template <typename T, typename Storage = inline t class rdo { / implementation / }; Usage example: struct InnerConfig { int id; float threshold; }; struct OuterConfig { int type; InnerConfig inner; }; // initialize the RDO container pol::rdo<OuterConfig config { 1, { 42, 3.14f } } ; // retrieving full config in unobfuscated form auto full config = config.read ; // retrieving threshold without decrypting full object float threshold = config.ref &OuterConfig::inner, &InnerConfig::threshold ; // modifying threshold without decrypting/encrypting the full object config.ref &OuterConfig::inner, &InnerConfig::threshold = 9.99f; Or, if you have functions that normally take a reference to a specific member: void adjust threshold pol::rdo ref<float threshold ref { // reading implicitly decrypts just this float float current val = threshold ref; // writing implicitly encrypts the new value directly into the RDO buffer if current val < 10.0f threshold ref = 10.0f; // the reference also supports standard operators threshold ref += 2.5f; } void example { // initialize the RDO container pol::rdo<OuterConfig config { 1, { 42, 3.14f } } ; // pass the generated reference to the function adjust threshold config.ref &OuterConfig::inner, &InnerConfig::threshold ; } 4. Static Data Obfuscation A class providing access to values known at compile-time. Supports automatic obfuscation of fundamental types as well as compile-time instances of more complex user-defined types e.g. structs . // protekkt/pol/sdo.hpp // reference type allowing reads of specific members within // complex obfuscated types e.g. structs, arrays or arrays of structs template <typename U class sdo ref { / implementation / }; template <auto V class sdo { public: using T = decltype V ; static assert std::is trivially copyable v<T || is sdo array v<T , "T must be trivially copyable for SDO" ; // embed compile-time data inside markers, the data will be processed by the obfuscator // during obfuscation the process alongside relevant access methods struct layout type { std::uint8 t beg m PTKT RDO MARKER SIZE ; T data m; std::uint8 t end m PTKT RDO MARKER SIZE ; }; private: static inline PTKT CONSTINIT layout type data m = { PTKT SDO BEG MARKER, V, PTKT SDO END MARKER }; public: / implementation / }; Usage example: // constant hidden in compiled binary // retrieved into a temporary only upon request auto x = pol::sdo<0x12345678 {}.get ; struct InnerConfig { int id; float threshold; }; struct OuterConfig { int type; InnerConfig inner; }; constexpr OuterConfig default config g = { 1, { 42, 3.14f } }; void f { pol::sdo<default config g config; // read just the threshold float without decrypting the entire object float threshold = config.ref &OuterConfig::inner, &InnerConfig::threshold ; // decrypts the entire OuterConfig object into a plaintext struct auto full config = config.get ; } C++ Containers The components we went through RVO, NUM, RDO and SDO provide us with all functionality required to implement standard container types that allow developers to store data in encrypted/obfuscated form both as part of compile-time data embedded in the binary as well as runtime data. This does not refer only to the actual data being stored by the developer, but also internal book-keeping that containers naturally have to do. The primary focus is on ensuring that data is never decrypted into plaintext form except in cases where it is absolutely needed usually only temporarily or explicitly requested by the developer. At the time of writing this article, POL implements obfuscated variants of the following standard containers: array, atomic, list, map, optional, pair, set, string, tuple, unordered map, unordered set, vector, unique ptr and shared ptr . The following examples demonstrate functionality and usage of certain containers. Most principles apply to all of them. void string example { // runtime initialization from a C-string // the string is immediately encrypted into the RDO heap buffer pol::string my str "Hello" ; if PTKT HAS CXX20 // C++20 compile-time initialization: pol::string secure str = pol::make string<"Secret" ; else // C++17 compile-time initialization pol::string secure str = PTKT SDO STRING C17 "Secret" ; endif // append standard C-strings directly to the encrypted buffer my str.append ", World" ; my str += " "; // modify a specific character securely using the rdo ref<char proxy // this encrypts the 'h' directly into the first index without decrypting the rest my str 0 = 'h'; // operator== provides comparison against plaintext strings // or other instances of pol::string if my str == "hello, World " std::print "The strings match.\n" ; // read a specific character via the implicit decryption of the proxy char fifth char = my str 4 ; std::print "The 5th character is: {}\n", fifth char ; // get the full string as a standard std::string // this decodes the entire string into plaintext in memory auto plaintext = my str.get ; std::print "Exported plaintext: {}\n", plaintext ; } include "protekkt/pol/unordered map.hpp" struct InnerStats { int health; float stamina; }; struct PlayerData { int level; InnerStats stats; }; void unordered map example { pol::unordered map<int, PlayerData players; // insert using key and value directly players.insert 1, { 10, { 100, 50.0f } } ; // insert using pol::make pair players.insert pol::make pair 2, PlayerData{ 15, { 150, 75.0f } } ; // read via operator implicitly decodes the full struct PlayerData player one = players 1 ; // read via find and iterators auto it = players.find 2 ; if it = players.end { // iterators return a proxy reference pair, so we use it .second // which yields an rdo ref<PlayerData that implicitly decodes on assignment PlayerData player two = it .second; } // operator returns an rdo ref<PlayerData -- we can use .ref // to securely target specific nested members in the obfuscated objects // subtract 20 from player 1's health directly in the map players 1 .ref &PlayerData::stats, &InnerStats::health -= 20; // assign a completely new value to player 1's stamina players 1 .ref &PlayerData::stats, &InnerStats::stamina = 100.0f; // level up player 1 modifying a top-level member players 1 .ref &PlayerData::level += 1; // range-based for loops are supported // 'kv' gets deduced to pol::unordered map ref pair<int, PlayerData for auto kv : players { int index = kv.first; int health = kv.second.ref &PlayerData::stats, &InnerStats::health ; std::print "Player Index: {} | Health: {}\n", index, health ; } // erase a specific key players.erase 2 ; }