Writing My Own Java Obfuscator: GarlicKing
GarlicKing is a hand-written Java obfuscator. Pure Java, Maven for dependency management, working down at the bytecode level: read in the compiled classes, rewrite the bytecode, write it back out, keep everything running exactly as before, and just wreck the readability of whatever you decompile out of it. The name comes from eating raw garlic and having your gut spin in confusion; I wanted anyone decompiling it to get that same sensation.
There are piles of off-the-shelf obfuscators, but with obfuscation, if you never build one by hand you only ever know how to use it, not how it works. My day-to-day reverse engineering is prying apart dex/class files, turning someone else’s obfuscated bytecode back into human language; flipping over to the puzzle-setter’s side is what makes it clear exactly what was done to an ordinary class to turn it into such a headache.
The real time sink isn’t the rewriting, it’s making it still run afterward. Bytecode isn’t source code: touch one spot and the stack frames, local variable table, and jump offsets all have to line up with it, and get it slightly wrong and the JVM throws a VerifyError right in your face. So all the effort goes into verification: rewrite one version, run one version, decompile it back to see whether it’s really mangled, and confirm along the way that nothing broke. Taking enough things apart is what tells you where it hurts most, and writing this kind of tool comes more naturally for it.
It’s just a small tool. The one star is my own, the repo is archived now, and it was never meant to go up against commercial obfuscators; it’s a set of notes left over from messing with bytecode at the end of 2024. But it was worth it to me: after building it, going back to reverse other people’s stuff, I look at their tricks with different eyes, because I’ve buried those same traps myself.