Configuration
Options
Every key of the options object, grouped by what it protects.
All options live in the options object of the configuration file. Boolean options are off unless you, or the profile, turn them on. The transformer behind each option is described in the transformers reference.
Profile
| Option | Values | Effect |
|---|---|---|
profile | Ghost, Low, Medium, High, Extreme | Baseline for every option you do not set. Explicit keys always win. |
Renaming
| Option | Values | Effect |
|---|---|---|
rename | Off, Alphabet, Invisible, IlIlIlIlIl | Renames classes, fields and methods in the chosen style. |
renameRandom | boolean | Random name bodies instead of sequential ones. |
renameDictionary | string | Custom alphabet for generated names. Empty uses the built-in ones. |
renamePackage | string | Moves renamed classes, and the classes HashGuard generates, into this package. |
renameClassPrefix | string | Prefix added to generated class names. |
renameClassSuffix | string | Suffix added to generated class names. |
renameMemberPrefix | string | Prefix added to every renamed field and method, for example m_ gives m_q8mF2. Independent from renameClassPrefix. |
aggressiveOverload | boolean | Reuses names across methods whose descriptors allow it. |
Control flow
| Option | Values | Effect |
|---|---|---|
controlFlowObfuscation | Off, Light, Heavy | Opaque predicates: cheap arithmetic (Light) or LDIV-based (Heavy). |
controlFlowFlattening | boolean | Turns method control flow into a switch-dispatched state machine. |
flattenLoops | boolean | Also flattens loop bodies. Costs more on hot loops. |
cffStateMasking | boolean | XOR-masks the state value of flattened methods at every dispatch. |
controlFlowShuffling | boolean | Physically reorders basic blocks after control-flow analysis. |
gotoObfuscation | boolean | Replaces GOTO with opaque conditional jumps. |
Constants and strings
| Option | Values | Effect |
|---|---|---|
constantObfuscation | Off, Light, Flow | Masks numeric constants with arithmetic chains (Light) or predicate branching (Flow). |
constantFlowDensity | number between 0 and 1 | Share of constants wrapped in flow-based masking. 0 or less masks every constant. The example config uses 0.25. |
polymorphMin, polymorphMax | integers | Bounds of the arithmetic chains used to mask numbers. 0 keeps the built-in bounds. |
salt | boolean | Adds a per-class salt used by numeric constant masking. |
numberSpeck | boolean | Encrypts numeric constants with a per-class SPECK decryptor. |
integerTable | boolean | Moves small integer constants into per-class tables. |
staticFieldInit | boolean | Moves static ConstantValue fields into the static initialiser. |
comparisonObfuscation | boolean | Replaces String.equals calls with hash and proxy logic. |
stringEncryptMode | Fast, Balanced, Extreme | Encrypts string pools and sets the strength of the runtime decryptor. Uses privateLookupIn on Java 9 and later and an invokedynamic fallback that Java 8 accepts. |
cryptoKeyBits | integer | AES key size used by string encryption. The example config uses 128. |
contextualStringKey | boolean | Derives the string encryption IVs from the owning class as well. |
multiAlgoStrings | boolean | Varies AES modes across classes to break signatures. |
polyString | boolean | Lightweight per-class XOR string decryptor. |
jntPolyString | boolean | Per-call-site keyed XOR string decryptor. |
polyStringSkipInterningUnsafe | boolean | Skips the polymorphic string passes where string interning looks unsafe. |
Indirection
| Option | Values | Effect |
|---|---|---|
referenceObfuscation | boolean | Replaces direct calls and field references with invokedynamic indirection. |
methodHandleIndirection | boolean | Routes private static calls through cached MethodHandle fields. |
parameterPacking | boolean | Packs the parameters of private methods into carrier arrays. |
invokeDispatcher | boolean | Routes owned calls through a per-class switch dispatcher. |
methodSalt | boolean | Adds a dead int parameter to private method descriptors. |
fieldProxy | boolean | Replaces private field accesses with synthetic proxy methods. |
fieldDescriptorMutation | boolean | Declares private fields as Object and casts at every access. |
Structure
| Option | Values | Effect |
|---|---|---|
ghostMembers | boolean | Injects synthetic phantom fields and methods to defeat structural fingerprinting. |
ghostMembersIntense | boolean | Uses the heavier ghost member profile. |
annotationConfuser | boolean | Injects phantom annotations with invalid descriptors. |
blockBreak | boolean | Adds labels and edges that fragment the control-flow graph seen by decompilers. |
trapEdge | boolean | Adds fake try/catch edges around GOTO flow. |
access | boolean | Marks classes and fields synthetic to confuse decompilers. Fields annotated @SerializedName are skipped so Gson keeps working. |
crasher | boolean | Injects constructs that crash common decompilers. |
Metadata and ordering
| Option | Values | Effect |
|---|---|---|
lineNumbers | Keep, Delete, Randomize | Handling of the LineNumberTable. |
localVariables | Keep, Delete, Obfuscate | Handling of local variable tables. |
methodParameters | PreserveNames, RemoveAttribute, ObfuscateNames | Handling of the runtime MethodParameters attribute. |
removeSourceFile | boolean | Removes the SourceFile attribute from every class. |
removeInnerClasses | boolean | Removes the InnerClasses metadata. |
shuffle | boolean | Randomises the declaration order of fields and methods. |
shuffleOptions | object | Fine-grained shuffle switches, see below. |
shuffleOptions holds one boolean per list that can be shuffled. Every key defaults to true, except methodParameters, which defaults to false because reflection may read parameter names.
| Key | Shuffles |
|---|---|
classes | The order in which classes are written. |
fields, methods | Field and method declarations. |
innerClasses | InnerClasses entries. |
interfaces | The order of implemented interfaces. |
classAttributes, fieldAttributes, methodAttributes | Non-standard attributes. |
classAnnotations, fieldAnnotations, methodAnnotations | Annotations. |
classTypeAnnotations, fieldTypeAnnotations, methodTypeAnnotations | Type annotations. |
methodExceptions | Declared exceptions. |
localVariables, localVariableAnnotations | Local variable metadata and its annotations. |
methodParameters | MethodParameters metadata. |
Runtime protection
| Option | Values | Effect |
|---|---|---|
antiTamper | boolean | Detects Java agents, debuggers and suspicious JVM arguments at runtime, and halts the JVM. |
integrityCheck | boolean | Runtime CRC self-checks of selected class bytes. |
sensitiveVm | boolean | Virtualises the methods listed in sensitiveVmMethods. |
sensitiveVmMethods | array of strings | Original method descriptors selected for virtualisation. |
Budget
| Option | Values | Effect |
|---|---|---|
maxOutputRatio | number | Global instruction budget. 2.0 allows at most twice the instruction count of the input. Heavy transformers such as control-flow flattening stop once the budget is spent. 0 or absent means no budget. |
Output and diagnostics
| Option | Values | Effect |
|---|---|---|
mappingOutput | path | Writes an old-to-new name mapping as JSON, see Stack traces. |
verbose | boolean | Prints per-transformer timings and debug counters. |
Watermark
watermarkOptions embeds a mark of your choice through explicit channels. Empty texts embed nothing. With renaming on, the dummy class gets a generated name instead of leaking its text as a class name.
| Key | Values | Effect |
|---|---|---|
dummyClass, dummyClassText | boolean, string | Adds a synthetic class carrying the text. |
textInsideClass, textInsideClassText | boolean, string | Embeds the text inside an existing class. |
ldcPop, ldcPopText | boolean, string | Inserts the text as dead LDC/POP constants. |
zipComment, zipCommentText | boolean, string | Writes the text into the jar’s ZIP comment. |
Encryption
| Option | Values | Effect |
|---|---|---|
magicCrypter | boolean | Encrypts every class. Part of the hardened runtime and requires its JVM. |