aegis_vm 0.2.52

Advanced Rust code virtualization and obfuscation framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

//! # RustAegis VM
//!
//! Custom Virtual Machine for code virtualization and protection.
//!
//! This VM converts critical Rust code to custom bytecode that is interpreted
//! at runtime, making static analysis and patching extremely difficult.
//!
//! ## Features
//!
//! - **Hybrid Architecture**: Stack + Register based for flexibility
//! - **60+ Opcodes**: Complete instruction set for complex logic
//! - **Anti-Analysis**: Opaque predicates, timing checks, integrity verification
//! - **Cross-Platform**: Works on iOS and Android
//! - **OLLVM Compatible**: Uses fastrand instead of rand crate
//!
//! ## Example
//!
//! ```rust
//! use aegis_vm::{execute, build_config::opcodes::{stack, arithmetic, exec}};
//!
//! // Simple bytecode: 40 + 2 = 42
//! let bytecode = [
//!     stack::PUSH_IMM8, 40,
//!     stack::PUSH_IMM8, 2,
//!     arithmetic::ADD,
//!     exec::HALT,
//! ];
//!
//! let result = execute(&bytecode, &[]).unwrap();
//! assert_eq!(result, 42);
//! ```

#![cfg_attr(not(feature = "std"), no_std)]

// CRITICAL: Whitebox feature is required for encrypted bytecode execution
// The proc-macro encrypts bytecode using WBC-derived keys at compile time.
// Without this feature, the runtime cannot derive the same keys to decrypt.
#[cfg(not(any(feature = "whitebox", feature = "whitebox_lite")))]
compile_error!(
    "Aegis VM: 'whitebox' or 'whitebox_lite' feature is required for encrypted bytecode execution! \
     Add `features = [\"whitebox\"]` to your aegis_vm dependency in Cargo.toml."
);

#[cfg(not(feature = "std"))]
extern crate alloc;

// Re-export the proc-macros for easier usage
pub use aegis_vm_macro::vm_protect;
pub use aegis_vm_macro::obfuscate_strings;
pub use aegis_vm_macro::aegis_str;

pub mod error;
pub mod opcodes;
pub mod state;
pub mod handlers;
pub mod engine;
pub mod bytecode;
pub mod crypto;
pub mod native;
pub mod integrity;
pub mod smc;
pub mod string_obfuscation;

// White-box cryptography module (required for encrypted bytecode)
// The proc-macro uses WBC for key derivation, runtime must match.
#[cfg(any(feature = "whitebox", feature = "whitebox_lite"))]
pub mod whitebox;

// Async VM module (experimental)
// Provides async/await based execution for state machine obfuscation
#[cfg(feature = "async_vm")]
pub mod async_vm;

// Re-exports for macro-generated code (works in user's no_std crates)
pub use spin::Once as SpinOnce;
#[cfg(feature = "std")]
pub use std::vec::Vec as StdVec;
#[cfg(not(feature = "std"))]
pub use alloc::vec::Vec as StdVec;

// Re-exports
pub use error::{VmError, VmResult};
pub use state::VmState;
pub use engine::{execute, execute_with_state, execute_with_natives, execute_with_native_table, run, run_with_natives, run_with_native_table};
pub use bytecode::{BytecodeHeader, BytecodePackage, ProtectionLevel, BuildInfo};
pub use crypto::CryptoContext;
pub use native::{NativeRegistry, NativeRegistryBuilder, NativeFunction, standard_ids};
pub use integrity::{IntegrityTable, IntegrityError, compute_hash, verify_hash};
pub use smc::{SmcConfig, execute_smc, execute_smc_with_natives, encrypt_bytecode, decrypt_bytecode};

/// Build-time generated configuration
pub mod build_config {
    include!(concat!(env!("OUT_DIR"), "/build_config.rs"));
}

/// VM version
pub const VERSION: &str = env!("CARGO_PKG_VERSION");

/// FNV-1a hash for bytecode integrity (randomized constants per build)
///
/// Used for HASH_CHECK opcode and general integrity verification
pub fn fnv1a_hash(data: &[u8]) -> u64 {
    let mut hash = build_config::FNV_BASIS_64;
    for &byte in data {
        hash ^= byte as u64;
        hash = hash.wrapping_mul(build_config::FNV_PRIME_64);
    }
    hash
}

/// FNV-1a 32-bit hash (for smaller checksums, randomized constants per build)
pub fn fnv1a_hash32(data: &[u8]) -> u32 {
    let mut hash = build_config::FNV_BASIS_32;
    for &byte in data {
        hash ^= byte as u32;
        hash = hash.wrapping_mul(build_config::FNV_PRIME_32);
    }
    hash
}