Advanced JVM obfuscation,
zero-overhead native execution.
NekoObfuscator is an open-source Java bytecode and native obfuscation toolkit that rivals commercial tools like ZKM — with deep HotSpot integration that bypasses JNI entirely, delivering native performance indistinguishable from raw speeds.
Every layer counts.
Eight independent transform stages that stack into a hardened protection chain. Each operates at the bytecode level — no source modifications required.
Renamer
ZKM-style class, field, and method renaming with mapping output and automatic reflection rewriting.
Key Dispatch
Hidden long-key injection into method signatures with automatic call-site rewriting.
Control-Flow Flattening
Keyed island dispatchers over verifier-safe blocks with per-edge evolving keys.
Runtime Variable Obfuscation
CFF-live keyed shadow storage for primitives — no ThreadLocal warehouse needed.
Constant Obfuscation
Numeric push, LDC, IINC, and ConstantValue rewriting bound to live CFF state.
String Encryption
AES/DES + XOR stream mixing with class-local cipher caches. No helper classes.
InvokeDynamic
CFF-state keyed indy indirection that eliminates static reference graphs from the constant pool.
Native Translation
Bytecode-to-C translation via Zig with direct HotSpot method-entry patching.
Not JNI. Not JVMTI.
HotSpot.
Every other native obfuscator pays the JNI tax. Neko patches HotSpot directly, achieving native execution speeds within measurement noise — and sometimes faster than — raw, un-obfuscated code.
HotSpot entry patching
During JNI_OnLoad, Neko patches vtable/itable entries in HotSpot's Method structures, redirecting execution to compiled native code without JNI overhead.
Zero JNI boundaries
Traditional native obfuscators cross JNI on every call — marshalling, handle management, JNIEnv lookups. Neko bypasses all of it.
Indistinguishable performance
Native execution within measurement noise of raw JVM speeds — and faster in compute-heavy workloads. No soft fallback, strict barriers or abort.
JDK 21+ multi-platform
Fresh runtime validation for each target JDK, platform, and GC mode. Compiled via Zig for Linux x64, with cross-platform support expanding.
Built by autonomous agents,
not boilerplate generators.
Every line of NekoObfuscator — from the bytecode IR to the HotSpot patching layer — was synthesized by a multi-agent harness. One agent architects the system and generates the heavy-lifting code; another verifies safety, models JVM internals, and orchestrates native compilation. No human wrote a single transform.
This isn't AI-assisted coding with autocomplete. It's autonomous software engineering — agents that reason about JVM specs, design IR lowering passes, and write cross-compilation pipelines. The result rivals commercial obfuscators in structural complexity, built entirely by LLMs collaborating through a structured harness.
codebase
Near-zero overhead.
Sometimes faster than raw.
By bypassing JNI entirely and compiling to native via Zig, Neko eliminates the marshalling tax that cripples traditional native obfuscators. In compute-heavy workloads, the native code can even outperform the JVM JIT.
* Benchmarks run on Linux x64, JDK 21+, G1 GC. Neko native compiled via Zig with
-march=x86_64_v3. JNI reference values are typical for standard
JNI-bound native obfuscators — the overhead comes from argument marshalling,
JNIEnv lookups, and object handle management on every call boundary.