Kagura

LLVM-based code obfuscation and anti-tamper toolkit for mobile, desktop, and WebAssembly targets.

Built on the New Pass Manager (LLVM 17+). Loaded as a pass plugin via -fpass-plugin — no LLVM source tree modification required.

Supported platforms: iOS · Android · macOS · Windows (MSVC/Clang-CL) · Linux · WebAssembly

On Windows, -fpass-plugin is unavailable (the MSVC-targeted LLVM ships with LLVM_ENABLE_PLUGINS=OFF). The passes link statically into kagura-opt and run over IR instead — see Build from Source.

What it protects against

Threat	Countermeasure
Static string extraction (strings, IDA imports)	XOR / AES string encryption (kagura-str, kagura-str-aes)
Decompiler-readable control flow	CFG flattening + bogus control flow (kagura-fla, kagura-bcf)
Memory editor / GameGuardian value freeze	Per-store/load XOR (kagura-mvo, kagura-pe) + Protected<T> runtime
Frida / Substrate dynamic instrumentation	Runtime hook & breakpoint detection (kagura-anti-debug)
Binary patching (NOP-ing checks)	Startup function checksums (kagura-tamper)
Import table analysis	External calls via runtime-resolved thunks (kagura-ci)
Jailbreak / root detection bypass	Mach-O / ELF integrity, Magisk / Zygisk / LSPosed detection

Documentation

📚 Full documentation: qusamulab.github.io/kagura

Topic	Link
Install & first build	Quick Start
Every pass (flags, effects, overhead)	Passes
JSON policy DSL & strength profiles	Configuration
Xcode / Gradle / Unity / Unreal / Bazel / CMake / CocoaPods / SPM	Integration
Protected<T> for HP / currency / etc.	Game Protection
Differential, reproducible, angr / Ghidra / Frida	Testing & Evaluation
AI client policy authoring & build inspection	kagura-mcp

Quick taste

Use the kagura compiler driver with a matching upstream LLVM 17–22 toolchain and Python 3.9+. Default builds include the driver and kagura-opt. See the compiler driver guide.

export LLVM_PREFIX=/path/to/llvm
build/bin/kagura --config-check kagura.json
build/bin/kagura -kagura-config=kagura.json -O1 your_file.c -o your_file

{ "profile": "BALANCED",
  "passes": { "str": true, "fla": true, "bcf": true, "mvo": true },
  "tuning": { "bcf_prob": 40, "seed": 12345 } }

Citation

If you use Kagura in your research or build on it, please cite the paper:

@software{kagura,
  author    = {yotti},
  title     = {Kagura: LLVM-based Code Obfuscation and Anti-Tamper Toolkit},
  year      = {2025},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.20361447},
  url       = {https://doi.org/10.5281/zenodo.20361447}
}

Community

• 💬 Discussions — questions, ideas, share your use case
• 🐞 Issues — bugs and feature requests (templates provided)
• 📚 Documentation — passes, configuration, integration, testing

Development

See the contributor guide, remaining work, changelog, and agent development instructions.

License

MIT — see LICENSE.