automating annoying tasks, sharing tips, and embracing less frustration Astro 2025-04-22T00:00:00+00:00 https://svnscha.de/tags/antispy-sdk/atom.xml 2025-04-22T00:00:00+00:00 2025-04-22T00:00:00+00:00 Sven Scharmentke https://svnscha.de/posts/antispy-sdk-release/

Because shipping an antispy SDK in 2025 still makes sense.

<p>I work on system insights and observability with the <a href="https://uberagent.com">uberAgent</a> team at Citrix. Outside work, <a href="https://www.windegger.wtf/">Rene Windegger</a> and I maintain the antispy SDK. We have worked on it for six years, and version 2025.1.0 is now available.</p> <p>What began as a weekend experiment to confuse disassemblers has grown into an SDK for developers who want to make binary analysis more difficult.</p> <h2 id="whats-new">What's New?</h2> <h3 id="-comprehensive-documentation">📚 Comprehensive Documentation</h3> <p>We've documented everything-every macro, every intricate detail of the virtual machine, and even the obscure compile-time tricks. Explore it all at <a href="https://antispy.xyz/docs">antispy.xyz/docs</a>. Plus, you can test examples live.</p> <h3 id="-compiler-explorer-integration">✨ Compiler Explorer Integration</h3> <p>Meet <a href="https://play.antispy.xyz">play.antispy.xyz</a>, your in-browser playground for experimenting with the SDK. Adjust macros, tweak compile options, and analyze disassembly to your heart's content. Think of it as godbolt, but tailored for the paranoid.</p> <h4 id="example">Example</h4> <p>Explore the demo showcasing <code>libantispy::encrypted_ptr</code>, a feature that compiles into 22 basic blocks of obfuscated code-serious protection in action.</p> <pre class="astro-code dark-plus" style="background-color:#1E1E1E;color:#D4D4D4; overflow-x: auto;" tabindex="0" data-language="cpp"><code><span class="line"><span style="color:#C586C0">#include</span><span style="color:#CE9178"> &lt;antispy/libantispy.h&gt;</span></span> <span class="line"></span> <span class="line"><span style="color:#569CD6">int</span><span style="color:#DCDCAA"> main</span><span style="color:#D4D4D4">() {</span></span> <span class="line"><span style="color:#4EC9B0"> libantispy</span><span style="color:#D4D4D4">::</span><span style="color:#4EC9B0">encrypted_pointer</span><span style="color:#D4D4D4">&lt;</span><span style="color:#569CD6">int</span><span style="color:#D4D4D4">&gt; </span><span style="color:#9CDCFE">ptr</span><span style="color:#D4D4D4">;</span></span> <span class="line"><span style="color:#D4D4D4">}</span></span></code></pre> <p><img src="/casts/2025-04-22-antispy-sdk-release-demo1.png" alt="Demo 1"></p> <ul> <li>Try it yourself: <a href="https://play.antispy.xyz/z/E3dh9aPr93zcfjMoW5oazMfnr9o5KxEqYGabEsY8vb46fzrj1fr1">play.antispy.xyz - libantispy::encrypted_pointer</a></li> </ul> <p>Unlike <code>libantispy::encrypted_pointer</code>, the standard <code>std::shared_ptr</code> behaves quite differently, as demonstrated below:</p> <p>After all, <code>std::shared_ptr</code> isn't designed to be obfuscated, is it?</p> <p><img src="/casts/2025-04-22-antispy-sdk-release-demo2.png" alt="Demo 2"></p> <h3 id="-constexpr-code-generation">🧠 Constexpr Code Generation</h3> <p>The antispy virtual machine now supports full compile-time constexpr functionality. Transform data, encrypt logic, and generate obfuscation layers-all before runtime. Who needs CPU cycles anyway?</p> <h3 id="️-updated-toolchains">⚙️ Updated Toolchains</h3> <p>We've modernized everything so you don't have to:</p> <ul> <li><strong>Android + iOS SDKs:</strong> ✅</li> <li><strong>Outdated compilers:</strong> 🪦</li> <li><strong>Legacy baggage:</strong> 🔥</li> </ul> <p>If you're still using GCC 4.x, well, good luck.</p> <h2 id="why-antispy-sdk">Why antispy SDK?</h2> <p>The antispy SDK is useful for high-assurance binaries, anti-reversing work, or experiments with disassemblers. It includes documentation and a live explorer so you can try the available techniques before adding them to a project.</p> <h3 id="platforms--architectures">Platforms &amp; Architectures</h3> <p>The antispy SDK supports the following major compilers and CPU architectures when C++20 is available:</p> <ul> <li><strong>Windows:</strong> x86, x64, ARM64</li> <li><strong>Linux:</strong> x86, x64, ARM64</li> <li><strong>macOS:</strong> ARM and Intel</li> <li><strong>iOS:</strong> Including tvOS, watchOS, visionOS</li> <li><strong>Android:</strong> x86, x86_64, armeabi-v7a, armv8a</li> <li><strong>Bare Metal SOCs:</strong> Fully supported</li> </ul> <p>This gives you the same API across the supported platforms.</p> <p><strong>TL;DR:</strong> If C++ metaprogramming excites you and you believe binaries should fight back, this SDK is your perfect match.</p> <p>Got feedback, feature requests? Let us know-we're probably not sleeping anyway.</p>