Tigress

Tigress is a command-line C obfuscator for researchers, students and teams that build software from C source. Its transformation range and output diversity offer useful control, though fitting it into a build means handling single-file input and weighing performance costs.

Overview

Tigress transforms C source through sequences of command-line transformations and options. One input can produce multiple distinct outputs, a practical advantage for creating varied builds rather than distributing the same transformed program each time. Its documented transformation families span control flow, data, functions, integrity and anti-analysis; supported capabilities also include anti-tamper controls and string encryption.

This is not a drop-in fit for every C project. Tigress takes one C file, so a program split across multiple files must be merged before transformation. Output can run slowly, especially for huge programs, and the impact depends on the transformations and options chosen. Protection decisions should account for protected assets, performance budgets and the capabilities of the adversary being considered.

Key features

• Diversified output: Multiple outputs from the same source can make builds less uniform, which suits software-protection work that values variation.
• Transformation choice: Control-flow, data, function, integrity and anti-analysis transformations let users select among different ways to complicate analysis. String encryption and anti-tamper controls broaden the available protection techniques.
• Targets and cross-compilation: Tigress supports Linux, Darwin, Android and Windows, Intel and ARM, and WebAssembly. Cross-compilation uses its Compiler and Environment options, making target selection explicit in the command-line workflow.
• Research use: The developer encourages researchers to attack Tigress-generated code and compare protection techniques, and presents it as a way for students to study obfuscation and build reverse-engineering challenges.

Pricing

The Research use plan costs nothing for nonprofit organizations. It is a strong fit for academic research and student learning, but does not cover commercial deployment by a for-profit organization.

The Commercial license has custom pricing and is required for use in a for-profit organization. Contact the University of Arizona licensing department to arrange it. Users may try Tigress for any length of time before deployment, but that trial flexibility does not remove the licensing requirement for commercial use.

Tigress is self-hosted and driven through a command-line interface. Its source is not generally open source, though the maker may share it with researchers at universities or research labs on request.

Platforms

Tigress transforms C99 source and supports Linux, Darwin, Android and Windows targets, with Intel and ARM architectures and WebAssembly output. Supported compiler options include GCC, Clang, Emscripten and cl. Its cross-compilation settings make it relevant when the build target differs from the environment used to run the transformation.

Who it's for

Tigress is best suited to nonprofit researchers, students and software-protection practitioners comfortable with command-line workflows and C build processes. The range of transformations and ability to produce varied outputs are especially relevant to studying reverse engineering or evaluating protection strategies. Developers with multi-file codebases should be prepared to merge inputs, and teams with tight runtime budgets should consider whether the generated code's potential slowdown is acceptable.

For-profit teams need to arrange a license before deployment. The developer, Christian Collberg, is a professor in the University of Arizona Department of Computer Science and offers consulting, including for unsupported features or target platforms.

Pros and cons

• Pro — varied transformed builds: The same input can yield multiple outputs, useful when one fixed transformed version is not enough.
• Pro — broad target range: Linux, Darwin, Android, Windows and WebAssembly targets cover varied deployment environments.
• Pro — research-friendly positioning: The developer encourages attacks and comparisons of Tigress-generated code, making it pertinent to obfuscation research and education.
• Con — single-file input: Multi-file programs must be merged first, adding preparation work to the build process.
• Con — performance uncertainty: Generated code can be slow, and huge programs are a known concern; teams need to assess the cost for their selected transformations.
• Con — commercial license required: For-profit deployment requires a separately arranged license, so commercial teams cannot assume the free nonprofit plan applies.

Alternatives

For a broader platform mix and a free individual-developer option, consider ByteHide Shield, whose free plan is described as core obfuscation for individual developers and small projects; its paid plans cover advanced techniques at custom pricing.

If open-source JavaScript obfuscation is the priority, JS-Confuser is a free option described by its maker as open source. JavaScript Obfuscator is another free JavaScript choice, with unlimited standard obfuscation but a 25 MB lifetime VM quota and 4 MB VM file-size limit on its free plan.

Obfuscator.io is an alternative. Allatori is an alternative. DashO is an alternative. Redgate SQL Provision is an alternative. .NET Reactor is an alternative.

Verdict

Choose Tigress if you need configurable C obfuscation, varied outputs and a target range suited to research or software protection. Its nonprofit access and transformation breadth are compelling for academic and experimental work; multi-file preparation, potential slowdown and the required commercial license make it less suitable for teams seeking effortless integration or straightforward commercial deployment.