FireflyProtector Documentation

A native desktop protector that applies full-function virtualization, anti-debug, anti-VM, anti-tamper and licensing to compiled applications. The SDK targets x64 EXE, DLL and Linux ELF / .so outputs. Function virtualization can be targeted by PDB or by markers.

Supported input

• Windows x64 .exe and .dll files (PE).
• Linux ELF / .so targets (in development).
• It does not process .NET/CLR managed assemblies.

Security options (user-facing)

• Anti-Dump — prevents memory dumping of the protected process.
• Anti-Debugging — detects debuggers; configurable level (1–3) and policy (Desktop / VM Allowed / High Risk).
• Anti-VM — detects VMWare, VirtualBox, Virtual PC, Sandboxie, Hyper-V, Parallels and QEMU; each can be toggled individually.
• Anti-Sandbox — refuses to run inside analysis sandboxes.
• Anti-Monitor — blocks screen-capture and monitoring tools.
• Virtualization — full native-code virtualization with bytecode encryption, mutation and trash generation sliders.
• Entry Point Virtualization & Native Packing — virtualize the entry point and pack the output.
• Anti-Tamper — integrity checks; the app refuses to run if patched.
• HWID Lock, Time Limit & Region Lock — bind output to specific hardware, an expiry date, or allowed regions.
• FireflyWrapper — secure in-memory launcher with parent-child authorization.
• Designer — fully custom user-facing messages and branding.

A professional-grade Python obfuscator that parses your source into an AST and applies multiple independent transformation passes, wrapping the result in a custom virtual machine. Runs entirely in the browser at /python-obfuscator — no download required.

Protections (all on by default)

An Intensity Preset slider (Low → High, default High) drives how many of these layers are stacked on, from rename-only up to the full virtualization stack.

A JavaScript obfuscator that parses source into an AST and rewrites the logic into a custom, polymorphic bytecode VM — every build produces unique output. Runs in the browser at /js-reactor.

Protections (all on by default)

A Lua obfuscator that translates readable source into a VM-based protected program, constrained to Lua 5.1 / Luau semantics so the output runs in Roblox. Runs in the browser at /lua-virtualbox. Before the editor opens you pick an engine version on the chooser page.

Two engines

• Legacy 1.0.4 — Compact — fast loading, best for Roblox-style scripts. Adds a Preset dropdown (Roblox / Luau, Balanced, Maximum Security) plus Beautify Output and VM Shuffle toggles.
• Current 1.3.0 — Max protection — strongest public output; intentionally exposes only the three presets.

VM profiles

• Min — lightest preset; best when size matters.
• Med — balanced protection with stronger output.
• Max — strongest preset; largest and heaviest.

A desktop application that stores sensitive files inside password-protected vaults, encrypting them in place with AES-256. Images, video, audio, PDFs and text can be previewed directly inside the app without writing decrypted copies to disk. Fully offline — no cloud account or remote service is required.

Download from the HuTaoCrypt downloads page. The builds are self-contained (no separate runtime needed). macOS is not supported; the Linux builds currently lag behind Windows.

Basic usage

1. Create a vault — pick a source folder, name the vault, set a password; files are encrypted in place.
2. Unlock — locked vaults stay sealed until the correct password is entered.
3. Browse & preview — view images, video, audio, PDFs and text directly inside the app.
4. Use built-in tools — scan for unencrypted files, strip metadata, shred leftovers, generate passwords, or encrypt short text.
5. Configure — theme, transparency, auto-lock, inactivity timeout and vault paths.

A defensive analysis tool that reconstructs obfuscated Roblox/Lua scripts back into readable Lua by simulating a mock environment, hooking environment calls, and translating execution traces. The hosted web version has been intentionally removed — running reconstructed Lua server-side is an inherent remote-code-execution risk.

The tool is distributed as source you run locally from its public repository. Requirements: Python 3; a Lua 5.1 executable is already bundled in the repo.