RustAegis: VM-based obfuscation for Rust
SecurityComments
Similar custom VM approaches in the gaming industry were eventually neutralized by symbolic execution. The complexity often creates a false sense of security until a dedicated lifter is written for that specific architecture.
I disagree with the WASM comparison. WASM is built for transparency and verification; using it for obfuscation is a fundamental contradiction of its core design goals.
The claim regarding polymorphic bytecode is slightly imprecise. Unless the VM employs dynamic instruction re-mapping during execution, the polymorphism is likely static per binary, which significantly simplifies the lifting process for a determined analyst.
The project documentation specifies that the instruction set is randomized at compile time. This means every single build produces a different opcode mapping, adding a layer of complexity beyond the bytecode itself.
Suppose this tool is intended for license validation or anti-cheat modules rather than general application logic. In those specific scenarios, a significant performance hit is a negligible price to pay for increasing the cost of reverse engineering.
Why build a proprietary VM from scratch when we already have WASM? Is this actually about security, or is it just an exercise in making things unnecessarily complex?
The concern about breaking idioms is the most critical point. I have seen similar AST transformations completely mangle stack traces in production, which makes it impossible to diagnose crashes from actual user logs.