Marble - an advanced Go code obfuscator and executable post-processor

---

Features

• AST-Based Source Obfuscation:
  • Multilingual / Unicode Symbol Renaming: Identifier names (variables, functions, types, etc.) are replaced with random Unicode symbols from over 20 language character pools (Greek, Cyrillic, Runic, Devanagari, Hangul, Georgian, etc.).
  • Dynamic State Machine String Encryptor: Strings are broken down into character slices and decrypted at runtime via dynamically generated state machines with XOR masking and junk execution paths.
  • Opaque Integer Arithmetic: Integer literals are converted into complex mathematical identity expressions (bitwise shifts, XOR/AND/OR masks, modulo math).
• Custom PE Parser & Post-Processing (pe package):
  • Custom parsing and low-level binary manipulation of Portable Executable (PE) binaries without external dynamic libraries.
  • Section header inspection, renaming
  • Import / Export table parsing and icon/resource directory extraction.
• **Binary Packing & Anti-Analysis:
  • Integrated binary stripping (-ldflags="-s -w", -trimpath) and section removal (e.g. .comment, .note, .gosymtab).
  • UPX ultra-brute compression support.
  • UPX Signature Neutralization: Automated searching and randomized byte patching of UPX header signatures (e.g., $Id: UPX, UPX!) to break upx -d decompression and signature-based detection.
  • Section Renaming: Renames executable UPX/PE sections to custom naming schemes.

---

TODO

• Cross-Platform Support
• Anti-Debugging utilities for binary
• More modifications & Maybe Anti-Signature utilities

Usage

marble -dir <path-to-source> -output <output-executable-name>

• -dir: Directory containing the target Go source package (Default: .)
• -output: Filename of the final compiled executable (Default: obfuscated.exe)

Disclaimer

This tool is created for educational, research, and authorized security testing purposes only. Usage of Marble for modifying software without proper authorization is strictly prohibited.