Kagura: A Game Anti-Cheat Obfuscation Toolkit for the LLVM New Pass Manager

Kagura is an open-source LLVM New Pass Manager obfuscation and anti-tamper toolkit for mobile game anti-cheat binaries on iOS and Android. It provides nine composable LLVM passes, including control-flow flattening, bogus control flow, instruction substitution, string encryption, constant obfuscation, memory-value obfuscation, indirect branching, and basic-block splitting/reordering. Kagura also includes game-focused protections such as IL2CPP-aware string handling and dual-XOR tamper detection. Evaluation on anti-cheat microbenchmarks shows 1.69×–1.87× text-section overhead while documenting practical limitations against dynamic instrumentation, MBA simplification, and automated deobfuscation tools.