git clone https://github.com/HikariObfuscator/Hikari.git cd Hikari mkdir build && cd build cmake -G "Visual Studio 17 2022" -A x64 -DLLVM_ENABLE_PROJECTS="clang;lld" -DCMAKE_BUILD_TYPE=Release ../LLVM cmake --build . --config Release --target hikari_pe_x64 Plugin will be at Release/lib/hikari_pe_x64.dll . | Error | Fix | |-------|-----| | Failed to load plugin | Use full absolute path to .dll | | Unrecognized flag -sub | Plugin didn’t load – check -enable-pass-plugin | | LNK2001 unresolved external | Add /DEFAULTLIB:libcmt (static CRT) | | Access violation after obf | Disable -split + -fla together | Use hikari_pe_x64 responsibly – only on your own binaries or with explicit permission.
// Opaque predicate example (constant folding resistant) volatile int x = 0; if (x == 0 && (GetTickCount() & 1) == 0) // real code else // dead code
C:\Hikari\ bin\ clang-cl.exe lld-link.exe lib\ hikari_pe_x64.dll <-- plugin Add to environment PATH : C:\Hikari\bin Use the plugin flag : hikari_pe_x64
Download prebuilt hikari_pe_x64.dll from: github.com/HikariObfuscator/Hikari/releases (look for Hikari-LLVM15.0-windows-x64.zip ) Extract the zip to C:\Hikari\ :
lld-link.exe /SUBSYSTEM:CONSOLE /ENTRY:main /MACHINE:X64 /OUT:obfuscated.exe payload.obj Do apply obfuscation at link stage – only per TU (translation unit). 6. Advanced: Selective Obfuscation with __attribute__ Annotate functions to control passes: git clone https://github
1. What is hikari_pe_x64? hikari_pe_x64 is a LLVM obfuscator plugin (based on Hikari/Obfuscator-LLVM) specifically compiled to work with MSVC/clang-cl on Windows targeting x64 PE executables . It transforms IR code to resist static/dynamic analysis. ⚠️ Not to be confused with “hikari” (anime character). This is a security research tool. 2. Prerequisites | Component | Requirement | |-----------|-------------| | Windows | 10/11 (x64) | | LLVM/Clang | 15.x or 16.x (clang-cl) | | Build tools | Visual Studio 2022 (with “C++ CMake tools”) | | Python | 3.8+ (for scripts) |
Also available: "bcf" , "split" , "indibran" , "fla_loop" , "sub_loop" , "split_num=3" Combine with manual tricks: What is hikari_pe_x64
clang-cl.exe /O2 /GS- /c payload.c -mllvm -enable-pass-plugin=C:\Hikari\lib\hikari_pe_x64.dll -mllvm -sub -mllvm -bcf -mllvm -fla -mllvm -split Use lld-link.exe (or MSVC link.exe):