d35ha/CallObfuscator
Obfuscate specific windows apis with different apis observed · 2026-08-28
Health v2 · maintenance only
23/100
- Activity 0
- Release rhythm 8
- Longevity 100
Flags: no_license
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: n/a
- age_days: 2621
- days_rel: n/a
- days_push: 2019
- n_releases_24m: 0
Adoption not part of the score
1024 stars · 174 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
CallObfuscator is a C++ library and CLI tool that hides Windows PE imports by rewriting the Import Address Table so sensitive APIs appear as innocuous ones, with runtime shellcode restoring the real addresses. It is aimed at malware research and understanding anti-analysis techniques.
Use cases
- hide windows api imports from static analysis
- obfuscate pe iat entries
- learn how import table obfuscation works
- malware research tooling
- replace imported symbols in an executable
When to choose
- you are researching evasion techniques or analyzing obfuscated samples
- you need to demonstrate IAT manipulation in a controlled lab
When to avoid
- you want to obfuscate software for legitimate protection of production apps
- you need a maintained tool with a license and active support
- you target non-Windows platforms
Facets
library · maturity maintenance
security reverse-engineering developer-tools security reverse-engineering windows windows cpp cli pe-patching iat-obfuscation malware-analysis windows-api anti-analysis
1 source
- readme: https://github.com/d35ha/CallObfuscator · fetched 2026-08-28 · d73ef878f73b
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| d35ha/CallObfuscator | main | 23 |
For agents
markdown · JSON · MCP: product_card(name="d35ha/CallObfuscator")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem