Unreadable to the tools built to read it.
Upload the compiled .exe or .dll. Hot functions run as virtual machine bytecode, code sections stay encrypted, and the protected file reads as noise to decompilers, debuggers and memory dumpers.
- Runs as bytecode. Your functions become virtual machine instructions only Atlas can run.
- Encrypted until it runs. Code sections stay encrypted on disk and in the static view.
- Decompilers stall. IDA and Ghidra analysis is bombed and Hex-Rays pseudocode fails.
- Patching breaks it. Integrity feeds the key, so one changed byte decodes to noise.
- Debuggers and injectors repelled. x64dbg, WinDbg, Frida and Cheat Engine meet a process that fights back.
- Different every build. Protect the same function twice and no two captured bytes match.
Built against IDA Pro, Ghidra, x64dbg, WinDbg, Frida, Cheat Engine, ScyllaHide, Scylla, pe-sieve, ProcDump, Process Hacker, Triton, Angr and more.
bytes differ. It is the same source function at the same offset, protected twice. A signature written against one build matches nothing in the next.
- 65
- options in the dashboard
- 5
- defense suites
- x64 + x86
- .exe and .dll files
Defense suites
Six suites, each aimed at one class of tool. Pick a suite to see the tools it is built against, what it does to them and why it holds.
Opened in a decompiler, it yields nothing usable.
- Built against
- IDA Pro / Hex-Rays
- Ghidra
- Binary Ninja
- radare2
- Tigress
- Triton
- What it stops
IDA Pro / Ghidra initial autoanalysis - the pass that recovers functions and cross-references the instant a binary is loaded.
How it worksThe file is seeded with tens of thousands of look-alike function starts that lead nowhere, so the analyzer’s work queue grows faster than it can clear.
Why it holdsDisabling autoanalysis means analyzing by hand - the work the tool exists to remove. The cost is paid by the analyst, every time.
Evidence
Real captures, not mockups. Four WinDbg sessions of protected builds, verbatim from the debugger.
A real protected build, stopped at its own entry point under WinDbg. The byte at RIP is 4F - an invalid opcode (???). The .text section is AES-128-CTR ciphertext until the instant it executes, so there is no valid instruction stream to disassemble, and the return chain past BaseThreadInitThunk dissolves into non-symbolic noise.
(7904.8330): Access violation - code c0000005 (!!! second chance !!!)
triage_code_encrypt+0x1284
- ???
- The debugger found no valid instruction at that address.
- noise
- A stack frame that resolves to no module and no symbol.
What sets it apart
No check to patch, and nothing static to study. Protectors that branch on a detection can be patched at the branch. These are the properties that do not depend on one.
01Tamper-by-construction
There is no check to patch.
02Nested disjoint-ISA virtualization
Two unrelated machines, no stable handler to lift.
03Environment channel fold
The wrong room derives the wrong key.
04JIT-decrypted handlers, per-call rekey
Nothing static to dump and study offline.
05Never fully plaintext in memory
Even paused, there is nothing clean to read.
06SMT-poisoned semantics
The automation that makes devirt practical times out.
How it works
Upload a binary. Download one that reads as noise.
- 01
Upload
Drop in the compiled .exe or .dll, x64 or x86. No source and no toolchain changes.
- 02
Choose options
Each option runs from Light to Maximum, and every level says what it adds.
- 03
Download
A drop-in protected binary. A build history is kept for the retention window of your plan.
Free and Premium
Every defense is on the free tier. Premium lifts how much you stack and how fast. Free runs the same engine under a 20-point budget per build. Premium removes the budget and raises the limits.
Premium also adds priority human support, direct access to the team and a full export of your build history.
See plansTwo products, one answer
Obfuscator secures the file. Authenticator secures the license inside it. A noise-proof binary around a weak or missing license check still gives up the same way it always did, just slower to find. Authenticator is the licensing layer built to hold once someone gets that far.
What Obfuscator already does
Tamper folded into the decryption key, nested VMs, handlers decrypted only at the instant they run. The full binary-protection engine.
What only Authenticator can do
Hardware-locked keys, signed server replies, bans that hold on sight of the same machine again. The part a decompiler-proof file still needs to be worth protecting.
Ship a binary that fights back.
Free tier, no card. Protect a build, then open it in the tools you trust.
- Free to start, no card
- SDK for C++, JavaScript and Python
- Windows x64