VM_Garble - obfuscation go binaries with virtualization

[Gladiyator]

Introducing (VM)Garble v1.0 — Go binary protection with stack-based virtualization

We are releasing Garble v1.0, a build-time obfuscation toolchain for Go that goes beyond renaming symbols and hiding strings.

Most Go binaries still ship with clear structure: readable names, obvious control flow, and native machine code that decompiles cleanly. Garble addresses that at compile time. In addition to established options such as literal encryption, path stripping, and aggressive “tiny” builds, v1.0 centers on an experimental stack-based virtualization (VM) layer for functions you explicitly mark as sensitive.

How the VM works

Selected functions are lowered from SSA to a fixed-width stack bytecode and executed by an embedded dispatcher. Callers keep the original signatures; only the implementation changes. What appears in the binary is not the original native body of that function, but an opaque instruction stream plus a small interpreter. Unsupported constructs are left native—never half-transformed—so enabling the feature cannot silently alter program semantics.

Hardening against static reverse engineering

On top of virtualization, v1.0 includes a dedicated anti-RE layer for VM code: polymorphic opcodes, position-dependent encoding, multi-layer dispatch-table protection, integrity checks, handler duplication and ordering noise, opaque predicates, control-flow flattening with decoy targets, instruction splitting, decoy native bridges, and optional nested virtualization. Anti-debugging is intentionally out of scope; the goal is to raise the cost of static recovery of the virtualized logic, not to fight debuggers.

Design constraints we care about

Opt-in via environment flag and per-function directives

GC-safe word model (no pointers on the operand stack)

Deterministic builds with a fixed seed

Equivalence testing between the reference interpreter and the emitted runtime

Virtualization has a real performance cost. It is meant for sensitive paths—not for every function in the program.

Typical release build

GARBLE_EXPERIMENTAL_VIRTUALIZE=1 \
garble -literals -tiny -seed=random \
build -trimpath -ldflags="-s -w" -o app.exe ./...

If you ship Go on Windows, Linux, or macOS and need stronger protection than name mangling alone, we would value feedback from practitioners who reverse binaries for a living as much as from teams who ship them.

Happy to answer technical questions on the supported subset, flattening, or how the VM composes with source-level control-flow obfuscation.

https://github.com/NIKJOO/VM_Garble