scrt/avcleaner
FreeC/C++ source obfuscator for antivirus bypass
FreeFree tier
About scrt/avcleaner
avcleaner is a C/C++ source code obfuscator designed to help bypass antivirus detection. It leverages Clang/LLVM to transform source code, making it harder for signature-based and heuristic-based antivirus engines to detect malicious patterns. The tool includes detailed blog posts that explain design decisions and the intricacies of working with the LLVM API. It provides a Docker image for easy setup, CMake-based build, and example scripts for common environments. It is licensed under GPL-3.0 and has received contributions from the community.
Key Features
Uses LLVM/Clang to obfuscate C/C++ source code
Docker container for easy setup and reproducible builds
CMake-based build system
Example scripts for macOS and Linux environments
Detailed blog posts explaining design and implementation
Supports projects requiring Windows SDK includes via script
Pros & Cons
Pros
- Open source with GPL-3.0 license
- Free to use and modify
- Well-documented with blog posts and examples
- Uses industry-standard LLVM infrastructure
- Active community with contributed bug fixes
Cons
- Requires knowledge of LLVM and build configuration
- May need manual specification of include paths for complex projects
- Not a drop-in solution; requires understanding of obfuscation techniques
Best For
Antivirus evasion researchMalware development and analysisRed team operationsTesting AV detection engines
FAQ
How do I build avcleaner?
You can build using CMake: create a build directory, run cmake .., then make -j 2. A Dockerfile is also provided for containerized builds.
How do I run avcleaner on a simple program?
For simple programs, use: avcleaner.bin test/strings_simplest.c --strings=true --. Note that you must provide all the include paths required by your project.
What should I do if I encounter a 'non-global-value-max-name-size' error?
This error indicates an inconsistency in registered CommandLine options. Use CMakeLists_archlinux.txt instead of CMakeLists.txt to resolve it.