A compiler middleware that modifies Go source code at the Abstract Syntax Tree (AST) level to defeat static analysis and signature-based detection.
Current Capabilities:
- Junk Code Injection: Inserts randomized arithmetic operations (
_ = x + y) into themainfunction to alter byte offsets and file hash. - Literal Obfuscation: Automatically detects string literals, XOR-encrypts them at build time, and replaces them with runtime decryption calls.
- Universal Traversal: Uses
astutil.Cursorto target strings in any context (Variable assignments, Return statements, Function arguments).