---

Why scLock?

Standard macOS Mach-O (arm64) binaries compiled from C, C++, Rust, Swift, or Objective-C expose clean control-flow graphs and plaintext constants in Ghidra, IDA Pro, and Binary Ninja within seconds. Conventional software obfuscators rely on a single static key or a central switch(opcode) dispatcher where recovering one key dumps the entire bytecode stream.

scLock (Supercluster Lock) combines compile-time 256-slot polymorphic virtualization, per-handler MBA key shattering, and dual-tier Apple Silicon Secure Enclave (SEP) binding:

1. Per-Build 256-Slot Polymorphic ISA + 84 Chaff Traps: Every compilation (sclock compile) synthesizes a brand-new 256-entry instruction set (172 active micro-ops + 84 state-corrupting chaff handlers) from a 64-bit polymorphic seed. No two builds ever share the same bytecode encoding or handler table.
2. Per-Handler Runtime-Entangled (black_box + vm.anchor) MBA Salt Shattering: Even when an analyst computes the outer sponge keys (k0, k1) in Portable mode, bytecode packets cannot be decrypted from static tables or immediate constants. Raw handler salts (op_secret_salt) are omitted from static data sections (replaced by one-way Davies-Meyer ANCHOR_SHARDS) and pre-masked against the code-integrity anchor. Inside each of the 256 compiled ARM64 handlers (__sc_lut_op_000..255), h_salt and operand masks (hm1, hm2, hm3) are reconstructed at runtime by combining std::hint::black_box-guarded affine parameters with the live vm.anchor ([x0, #0xa0]) through non-linear MBA polynomials—defeating LLVM (-C opt-level=3) constant folding and InstCombine simplification.
3. Non-Linear Mixed Boolean-Arithmetic ($\mathbb{Z}_{2^{64}}$) & 2-adic Bijections: Arithmetic, multiplication, constants, and control-flow transitions are lifted into degree-2/3 non-linear MBA identities over $\mathbb{Z}_{2^{64}}$ coupled with 2-adic number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod{2^{64}}$).
4. Dual-Tier Apple Secure Enclave (SEP) Architecture:
   • Portable Multi-Mac Mode (Default, SCP1): Built for universal end-user macOS distribution and the public CrackMe so the binary runs offline on any Apple Silicon Mac (M1 / M2 / M3 / M4). Derives the outer sponge keys (k0, k1) via a 1,024-round SHA-256 Code-Anchor White-Box KDF paired with a Live SEP Commutative P-256 Double-ECDH Anti-Emulation / Anti-Hooking Gate ($d_{\text{SEP}} \cdot Q_P \stackrel{?}{=} d_P \cdot Q_{\text{SEP}}$ executed on the Secure Enclave to poison execution under non-SEP emulators or API hooks). Because offline execution across all Macs requires deterministic key derivation, static extraction defense in SCP1 is provided by per-handler runtime-entangled (vm.anchor + black_box) MBA salt shattering and state-dependent sponge chaining across all 256 handlers.
   • Hardware UID Node-Locked Mode (--sep-lock / --host-sep-lock): Seals the P-256 private key directly inside the target Mac's physical Secure Enclave UID (kSecAttrTokenIDSecureEnclave hardware-wrapped rk1/dacl blob). Zero unsealable key material exists anywhere in the Mach-O binary—offline key derivation is physically impossible without the target Mac's Secure Enclave silicon.
5. Branchless Anti-Debug State Entanglement & Zero-Leak Camouflage: Instead of patchable if (is_debugged) exit() branches, scLock mixes the kernel sysctl P_TRACED bit and ARM64 prologue BRK (0xD4200000) scans directly into the 256-bit sponge state accumulator, with automatic symbol and toolchain path scrubbing (sclock protect-app).

---

Public Reverse-Engineering Challenge (CrackMe)

Don't take our word for it—test scLock in your own disassembler and debugger right now.

This repository includes a standalone Mach-O arm64 binary protected by scLock (v1.0.0, compiled in Portable SCP1 mode so it runs on any Apple Silicon Mac):

• Binary Path: crackme/challenge_protected (or download scLock-CrackMe-Challenge-macOS-arm64.zip)
• Architecture: Mach-O 64-bit executable arm64 (Apple Silicon M1 / M2 / M3 / M4)

Run & Audit It Yourself

# 1. Clone this repository (or unzip the release archive)
git clone https://github.com/planners1490/sclock.git
cd sclock/crackme

# 2. Clear macOS Gatekeeper quarantine (if downloaded via browser) & make executable
xattr -cr ./challenge_protected
chmod +x ./challenge_protected

# 3. Inspect symbol table & strings (Zero VM/Obfuscator leaks)
nm -gU ./challenge_protected
strings ./challenge_protected | grep -iE "sclock|vm|opcode|mba|chaff" || echo "0 leaks found"

# 4. Execute the protected binary on any Apple Silicon Mac
./challenge_protected            # Runs built-in self-test (seats=20, pin=1234 -> 83300)
./challenge_protected 20 1234    # Pass custom <seats> <unlock_pin>

The Challenge Goal

Open crackme/challenge_protected in Ghidra, IDA Pro, Binary Ninja, or LLDB and attempt to:

1. Recover all 256 per-handler MBA salts (h_salt) and decompile the virtualized pricing/verification routine without triggering Ghidra's decompiler timeout (>330s).
2. Attach lldb and step through the virtualized dispatch loop without corrupting the P_TRACED-entangled sponge state.
3. Find the hidden secondary 4-digit master PIN (arg2 != 1234) and the exact 64-bit algebraic mixing constants inside the virtualized routine.

Found an interesting analysis or write-up? Post it in Issue #1 (Official CrackMe Challenge Thread)!

---

Empirical Benchmarks

Tested on Apple Silicon (macOS arm64, Release profile):

1. Reverse-Engineering & Decompiler Resistance