Tigress

Tigress is a diversifying obfuscator for C that transforms source code to make static and dynamic reverse engineering harder. Users apply command-line transformation sequences and options to produce new C source, and one input program can generate multiple different outputs. Documented transformation families include control flow, data, functions, integrity, and anti-analysis. Listed targets include Linux, Darwin, Android, and Windows, as well as Intel, ARM, and WebAssembly; output can be 32- or 64-bit. Cross-compilation is configured through Compiler and Environment options. Tigress accepts one C file at a time, so multi-file programs must be merged before transformation. The maker lists support for C99 source and GCC, Clang, Emscripten, and cl. Nonprofit organizations can use Tigress for free. For-profit commercial deployment requires a license from the University of Arizona, though users may try it for any length of time before deployment. The source is not generally open source but may be shared with researchers at universities or research labs on request. The maker also presents Tigress for student learning and reverse-engineering research and notes that generated code can be slow, especially for huge programs.

Tigress offers configurable C transformations and a broad list of targets for research, learning, and software protection. Account for the one-file input requirement, possible performance costs, and licensing needed for for-profit deployment.

Tigress may suit C developers, students, and researchers working on software protection or reverse-engineering challenges. Nonprofit organizations can use it for free; for-profit deployment requires a license.

Tigress is a command-line obfuscator for C developers, researchers and students studying software protection or reverse engineering. It offers a broad set of transformations and target options, but its single-file workflow and potential runtime costs make it a poor fit for projects that need a frictionless build step.

Overview

Tigress converts C source into transformed C source using sequences of command-line operations and options. A single input can yield multiple different outputs, making it useful when build variation matters rather than one fixed protected binary. Its documented transformation families cover control flow, data, functions, integrity and anti-analysis; supported capabilities include control-flow obfuscation, string encryption and anti-tamper controls.

The main integration constraint is substantial: Tigress accepts one C file, so a multi-file program must be merged before transformation. Generated code can also run slowly, with the impact depending on chosen transformations and options; huge programs may be particularly slow. Users should weigh protection goals against performance budgets and the assets and adversary they need to defend against.

Key features

• Diversified builds: The same source can produce different transformed outputs, useful for teams seeking variation across builds.
• Transformation breadth: Control-flow, data, function, integrity and anti-analysis options let users choose different approaches rather than apply one fixed transformation.
• Cross-compilation targets: Compiler and Environment options support targeting Linux, Darwin, Android and Windows, with Intel, ARM and WebAssembly architectures. Supported compilers include GCC, Clang, Emscripten and cl.
• Command-line workflow: CLI integration suits users who can incorporate transformation into their own build process, but the one-file input requirement adds preparation for multi-file projects.

Pricing

Research use: free for non-profit organizations. This is the fit for qualifying research and student use; Tigress is not generally open source, though its maker may share the source with researchers at universities or research labs on request.

Commercial license: custom pricing. For-profit organizations need a license from the University of Arizona before commercial deployment. Users can try Tigress for any length of time before deployment, but the unrestricted trial does not remove the licensing requirement.

Christian Collberg, Tigress's primary developer and a University of Arizona computer science professor, offers consulting and invites inquiries about unsupported features or target platforms.

Platforms

Tigress transforms C99 source and targets Linux, Darwin, Android and Windows. Its architecture targets include Intel, ARM and WebAssembly. Cross-compilation uses the Compiler and Environment options; deployment is self-hosted rather than a hosted service.

Who it's for

Tigress is a strong match for non-profit researchers comparing obfuscation techniques, reverse-engineering researchers attacking generated code, and students learning about obfuscation or building reverse-engineering challenges. C software teams can consider it when transformation control and diversified outputs justify the work of merging source files and managing performance trade-offs. It is less suitable when a project cannot be reduced to one input file or when slow generated code would exceed its performance budget.

Pros and cons

Pros

• Multiple outputs from one input: Build variation can help software-protection work avoid relying on a single transformed result.
• Wide transformation and target range: The documented families and operating-system, architecture and compiler options give technically capable users room to shape transformations and target builds.
• Non-profit use is free: Research organizations can use it without a paid plan.

Cons

• Single-file input: Multi-file programs need merging before they can be transformed, adding a required preprocessing step.
• Performance risk: Generated code may be slow, especially for huge programs, so protection choices need to fit the runtime budget.
• For-profit deployment requires a license: Commercial users must contact the University of Arizona, and the price is custom.
• Source access is limited: The source is not generally open source, which may not suit users who require unrestricted source access.

Alternatives

Compare code obfuscation software if you want to review a broader set of options.

• ByteHide Shield is worth considering for individual developers and small projects seeking a free core obfuscation plan or a broader platform selection that includes web and iOS.
• ProGuard is a free, open-source option for Java or Kotlin shrinking; choose it when that language-focused workflow is a better fit than Tigress's C transformations.
• Allatori may suit readers seeking a freemium alternative with a single-developer license update plan at $75 a year.
• DashO offers a free trial and paid team and enterprise plans; consider it if those plans better match your protection workflow.
• DexGuard is an Android-only paid alternative for readers focused on Android apps.
• DexProtector is a paid alternative with a free trial for Android and iOS apps and SDKs.
• iXGuard is a paid option for iOS protection.
• R8 is a free, open-source choice for readers seeking an API- and Linux-platform option.

Verdict

Choose Tigress if you work directly with C and need configurable transformations, varied outputs or a research and teaching tool. Its broad targets and free non-profit use are meaningful strengths, but the single-file input and possible performance costs demand planning. For-profit teams should also compare alternatives if custom licensing or limited source availability is a concern.