一句话：提出 LLVM MIR 级可组合混淆框架 Polaris，在保持语义下显著增强反编译抵抗且开销可接受。
现有高层软件混淆（源码级或 LLVM IR 级）常留下可识别痕迹，易被现代反编译器利用；二进制级方法虽有效，却往往带来较高性能开销或依赖加壳，且仍呈现可自动分析的结构模式。本文提出 Polaris，一个基于 LLVM 的 Machine IR（MIR）级混淆框架。MIR 位于指令选择之后、最终代码生成之前，允许在不破坏编译器正确性保证的前提下进行目标感知的细粒度变换。Polaris 组合使用函数边界扰动、控制流重构和数据流噪声注入等可组合变换，破坏主流逆向工程工具的假设，显著增加分析难度，同时保持程序语义与功能。作者在 100 个真实程序、共 4,024 个函数上，用三种主流反编译器进行评估。结果表明，Polaris 显著降低函数恢复与伪代码质量，增加碎片化与分析超时，且仅带来实际可接受的运行时开销。实现已开源。
Obfuscation techniques are widely used to hinder program analysis and reverse engineering in order to protect software security and intellectual property. High-level software obfuscation techniques (e.g., source-code- or LLVM IR–based) often leave recognizable artifacts that modern decompilers can effectively exploit, thereby limiting their long-term effectiveness. In contrast, binary-level approaches, although effective, typically incur substantial performance overheads or rely on packing, while still exhibiting structural patterns that remain amenable to automated analysis. LLVM Machine IR (MIR), which represents programs after instruction selection in the LLVM backend, enables target-aware and fine-grained transformations before final code emission without violating compiler correctness guarantees. In this work, we present Polaris, an LLVM-backed MIR-level obfuscation framework that applies a set of composable MIR transformations, including function-boundary perturbation, control-flow restructuring, and data-flow noise injection, to invalidate assumptions made by mainstream reverse-engineering tools and substantially increase their analysis effort, while preserving program semantics and functionality. We demonstrate Polaris on 100 real-world programs comprising 4,024 functions and evaluate its impact using three mainstream decompilers. The results show that Polaris significantly degrades function recovery and pseudocode quality, increases fragmentation and analysis timeouts, and incurs only practical runtime overheads. We publicly release the complete implementation of Polaris at https://github.com/za233/Polaris-Obfuscator, and provide an accompanying demonstration video at https://youtu.be/eALCDiEqJJw.
@inproceedings{paperbot11736,
title = {Polaris: MIR-Level Obfuscation in LLVM for Efficient and Robust Decompiler Resistance},
author = {Ang Zhou and Jiongchi Yu and Yiran Zhang and Ziming Zhao and Zhaoxuan Li and Tingting Li},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3774748.3787619}
}