Ryūjin: Research-Grade Bin2Bin Protector and Obfuscator for Binary Tamper-Proofing
Ryūjin is a research-grade protector and obfuscator built to explore Bin2Bin transformation techniques. It is suitable for security researchers, reverse engineers, anti-cheat and anti-tamper developers, and others studying binary protection. Ryūjin focuses on transforming binaries while preserving original program semantics.
Features
- Junk code insertion and code mutation (randomized while preserving original logic)
- IAT call access obfuscation (with obfuscated handler access)
- Random section naming (default:
Ryujin) - Mathematical operator virtualization (Ryūjin MiniVM)
- Mathematical operator virtualization with Hyper-V isolation (MiniVM + Hyper-V)
- Encrypted code sections (TeaDelKew algorithm)
- Anti-debug (user-mode and kernel-mode)
- TrollReversers (can induce BSOD during reversing attempts)
- Anti-dump protections
- Anti-disassembly and anti-decompiler techniques
- Memory integrity protection (CRC32-based)
- Custom pass support (includes MBA-linear Obfuscation Pass and community passes)
- And more, see the wiki for a complete list
Demos and Presentations
Ryūjin is intended primarily as a study and research tool. Below are small demos showing a main function before and after a Ryūjin pass:
Modes of use
Ryūjin supports both CLI and GUI:
- CLI: Full functionality and advanced options for expert/research users.
- GUI: Simplified interface for quick runs (requires
wxWidgets).
CLI demo:
GUI demo:
Input requirements: a PE executable (EXE) for x64 and its PDB file containing symbols. The PDB is required to enable several transformation passes that rely on symbol information.
Custom Pass Support
Ryūjin supports custom passes through a simple callback model. A custom pass receives a RyujinProcedure instance and can modify basic blocks, scopes, or other procedure-level structures.
Example callback signature:
void RyujinCustomPassDemo(RyujinProcedure* proc);
See the class definition here:
RyujinProcedure.hh.
Example usage is included here:
RyujinCustomPasses.hh.
No additional configuration changes are required. RyujinObfuscatorConfig already exposes the settings needed to register and run custom passes.
Install & Use
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
