# Obfuscators — tested scope, not universal capability

Scope: retained Windows x64 experiments, not general tool claims. No new experiments were run for this pack. PASS means the named retained checks passed; it is not universal correctness.

| Family | Transformation stage | Main tested techniques | SUB/arithmetic behavior | BCF/opaque behavior | FLA behavior | Optimization survival | Reproducibility/seed behavior | Function-level targeting | Final executable validity | Major limitation | Best teaching artifact | Evidence sources |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| OLLVM-16 | LLVM IR | SUB; BCF; FLA | O0: all 24 sites transformed in IR; backend recovers XOR/SUB; O1+ recovers all 24 native operations | Clones plus opaque gates; 22/22 O0 gates proved and patched | Stock unflattener: 25/25 semantic successor pairs; working O0 PE | SUB weakens; small optimized BCF residue; FLA remains strong | SUB same-command IR repeat identical with AES seed; do not generalize to all switches | Annotation-only pilot inactive; retained matrix uses global switches | Selected original PEs PASS; BCF/FLA rewritten PEs PASS | Global scope confounds whole-PE size; Mergen silently mislifted this SUB input | 03_ollvm_bcf and 05_ollvm_fla | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\showcase_matrix_v1.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md; E:\Workspace\seeing_through_obfuscation\docs\tigress_validation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md |
| Hikari | LLVM IR | SUB; BCF; FLA; split | O0 coverage: XOR 2/8, ADD 4/8, SUB 6/8 | Backend folds injected O0 gates; O1+ target matches clean | O0 stock rewrite works; 28/28 successor pairs | SUB/BCF target effects disappear by O1; FLA persists | SUB seeded IR repeat identical; BCF direct object/assembly repeat identical | Annotation-only SUB pilot inactive in tested compiler; retained matrix uses global -enable-subobf/-enable-bcfobf/-enable-cffobf/-enable-splitobf (each via -mllvm) | Selected originals and O0 FLA rewrite PASS | Exact BCF O0 text has legacy mixed-pointer syntax; Clang 15 cannot reparse it | Indexed Hikari O0 FLA rewrite; no duplicate PE in this pack | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\showcase_matrix_v1.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md; E:\Workspace\seeing_through_obfuscation\docs\tigress_validation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md |
| Polaris | LLVM IR plus separate X86 MIR/backend | SUB; BCF; FLA; linear MBA; indirect calls/branches; global encryption; backend-obfu | MBA: 24/24 expanded; distinct tree per repeated site; 115 to 678 instructions | 16/16 O0 gates proved and patched; O1+ target matches clean | O0 stock rewrite is WRONG; O1+ simplifies but retains dispatcher | SUB weakens; BCF disappears; FLA survives in smaller form | SUB/BCF/FLA/indirection/gvenc smoke repeats identical; MBA and MIR differ despite rng-seed | IR pipeline + annotations; gvenc module-wide; backend marker separate | Selected originals and BCF rewrite PASS; stock FLA rewrite FAIL | Seed is not a full reconstruction key; legitimate switch defeats stock unflattener | 02_polaris_mba and 06_polaris_fla_incorrect | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\showcase_matrix_v1.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md; E:\Workspace\seeing_through_obfuscation\docs\tigress_validation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md |
| Tigress | C source-to-source, then native compiler | EncodeArithmetic; AddOpaque; Flatten | 24/24 sites expanded; substantial /Ox arithmetic remains | 3/3 opaque predicates proved only with captured initialized state; generic unconstrained globals 0/3 | Verified O0 jump table: 38 blocks; stock discovers only 6; no rewrite | Same generated C across levels; compiler changes dispatch and arithmetic | Seed exposed but whole generated files differ; salts/order not pinned; archive exact C | Explicit --Functions; AddOpaque initialization in main also required | Validated environment-matched originals PASS | Environment-specific C; jump-table discovery and runtime-state assumptions matter | 07_tigress_arithmetic and 08_tigress_flatten_discovery | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\showcase_matrix_v1.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md; E:\Workspace\seeing_through_obfuscation\docs\tigress_validation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md |
| BinProtect | Linked PE / machine instructions | Linear arithmetic; MBA; opaque predicates; CFF | O0 target 0/24; O2 24/24; machine expansions persist | Fermat-style predicates not universally opaque under machine wraparound | Direct compare/state chain; no indirect jump required | Post-link transformations; no subsequent compiler simplification tested | No exposed seed; retained outputs non-deterministic | Global discovered functions/blocks including CRT | 0/8 outputs semantically valid: crash or hang; STATIC ONLY | Invalid full PEs prevent end-to-end execution claims; virtualization not tested | Original indexed MBA O2 only; no invalid BinProtect PE copied | E:\Workspace\seeing_through_obfuscation\docs\obfuscator_comparison_summary.md; E:\Workspace\seeing_through_obfuscation\docs\showcase_matrix_v1.md; E:\Workspace\seeing_through_obfuscation\docs\polaris_validation.md; E:\Workspace\seeing_through_obfuscation\docs\tigress_validation.md; E:\Workspace\seeing_through_obfuscation\docs\unflattening_course_examples.md; E:\Workspace\seeing_through_obfuscation\docs\opaque_predicate_rewrite.md; E:\Workspace\seeing_through_obfuscation\docs\mergen_validation.md |

CSV and JSON contain the identical fields and rows. Original full evidence paths are recorded in the final column.