On this page
I work on system insights and observability with the uberAgent team at Citrix. Outside work, Rene Windegger and I maintain the antispy SDK. We have worked on it for six years, and version 2025.1.0 is now available.
What began as a weekend experiment to confuse disassemblers has grown into an SDK for developers who want to make binary analysis more difficult.
What's New?
ð Comprehensive Documentation
We've documented everything-every macro, every intricate detail of the virtual machine, and even the obscure compile-time tricks. Explore it all at antispy.xyz/docs. Plus, you can test examples live.
âĻ Compiler Explorer Integration
Meet play.antispy.xyz, your in-browser playground for experimenting with the SDK. Adjust macros, tweak compile options, and analyze disassembly to your heart's content. Think of it as godbolt, but tailored for the paranoid.
Example
Explore the demo showcasing libantispy::encrypted_ptr, a feature that compiles into 22 basic blocks of obfuscated code-serious protection in action.
#include <antispy/libantispy.h>
int main() {
libantispy::encrypted_pointer<int> ptr;
}
- Try it yourself: play.antispy.xyz - libantispy::encrypted_pointer
Unlike libantispy::encrypted_pointer, the standard std::shared_ptr behaves quite differently, as demonstrated below:
After all, std::shared_ptr isn't designed to be obfuscated, is it?
ð§ Constexpr Code Generation
The antispy virtual machine now supports full compile-time constexpr functionality. Transform data, encrypt logic, and generate obfuscation layers-all before runtime. Who needs CPU cycles anyway?
âïļ Updated Toolchains
We've modernized everything so you don't have to:
- Android + iOS SDKs: â
- Outdated compilers: ðŠĶ
- Legacy baggage: ðĨ
If you're still using GCC 4.x, well, good luck.
Why antispy SDK?
The antispy SDK is useful for high-assurance binaries, anti-reversing work, or experiments with disassemblers. It includes documentation and a live explorer so you can try the available techniques before adding them to a project.
Platforms & Architectures
The antispy SDK supports the following major compilers and CPU architectures when C++20 is available:
- Windows: x86, x64, ARM64
- Linux: x86, x64, ARM64
- macOS: ARM and Intel
- iOS: Including tvOS, watchOS, visionOS
- Android: x86, x86_64, armeabi-v7a, armv8a
- Bare Metal SOCs: Fully supported
This gives you the same API across the supported platforms.
TL;DR: If C++ metaprogramming excites you and you believe binaries should fight back, this SDK is your perfect match.
Got feedback, feature requests? Let us know-we're probably not sleeping anyway.