← Documentation index · ← NeverC project

NeverC DynCode Compiler

Compile C source code directly into position-independent, zero-relocation, zero-data-section flat binary dyncode.

Guides

Core Goals

Users write normal C — no dyncode-specific tricks required.
Fully automatic pipeline — static int counter = 0, const char s[] = "...", recursive functions, write/exit/read/..., and large constant arrays all work internally without requiring user code modifications.
Zero external dependencies — the output .bin is pure instruction stream with no references to dyld, libSystem, or any data section.
CLI options defined via TableGen — every -fdyncode-* option is registered in neverc/include/neverc/Invoke/Options.td.h, not hard-coded string matching. Typos get did-you-mean suggestions and --help displays all options.
Output-level constraints are verifiable — -fdyncode-bad-bytes= / -fdyncode-bad-byte-profile= scans the final .bin after the post-extract interpose and rejects output on forbidden byte hits, reporting offset, byte, and context.
Cross-platform single pipeline — driven by TargetDesc table lookups. The same C source produces dyncode for macOS / Linux / Android / Windows. Adding a new platform means filling one more table row + writing one extractor implementation, not duplicating five passes.

Supported Targets

Triple	Format	User-mode syscall	Ring-0 resolver	Status
`arm64-apple-macos*`	Mach-O	`svc #0x80` (Darwin BSD)	`DarwinXNUKextShim`	Native loader round-trip + kernel resolver covered
`x86_64-apple-macos*`	Mach-O	`syscall` (BSD class mask `0x2000000`)	`DarwinXNUKextShim`	Compile + extract passing; x86_64 `__text` has no reloc expectation
`aarch64-linux-gnu`	ELF	`svc #0` (x8 = nr)	`LinuxKallsymsShim`	Compile + extract + kernel resolver passing
`x86_64-linux-gnu`	ELF	`syscall` (rax = nr)	`LinuxKallsymsShim`	Compile + extract + kernel resolver passing
`aarch64-linux-android*`	ELF	Same as Linux arm64	`LinuxKallsymsShim` (GKI)	Compile + extract passing
`x86_64-linux-android*`	ELF	Same as Linux x86_64	`LinuxKallsymsShim` (GKI)	Compile + extract passing
`aarch64-pc-windows-msvc`	PE/COFF	PEB walk (`ldr xN, [x18, #0x60]`)	`WindowsKernelResolverShim`	User-mode PEB read byte sentinel `32 40 f9` validated; ring-0 uses loader resolver
`x86_64-pc-windows-msvc`	PE/COFF	PEB module walk + PE export-table lookup	`WindowsKernelResolverShim`	User-mode resolver is full IR-level PEB walk; ring-0 does not reuse PEB

All eight (OS, arch) triples are driven by the same set of passes. Differences are isolated in TargetDesc.cpp table entries + three extractor arch switches. Adding a new platform = fill one more table row + add one case in each extractor. The ExecutionLevel dimension is orthogonal: User uses the user-mode syscall / PEB pipeline; Kernel disables both and injects KernelImportPass to rewrite extern calls through resolver shims. See kernel-mode-dyncode.md.

Quick Start

# Always pass -target — output triple is independent of the compiler host.

# 1) Pure computation dyncode — no system calls
neverc -fdyncode -target arm64-apple-macos add.c -o add.bin

# 2) Darwin hello world — write/exit → svc #0x80
neverc -fdyncode -target arm64-apple-macos -mdyncode-syscall hello.c -o hello.bin

# 3) Linux arm64: svc #0 + x8=nr
neverc -fdyncode -target aarch64-linux-gnu -mdyncode-syscall \
       hello.c -o hello_linux_arm64.bin

# 4) Linux x86_64: syscall + rax=nr
neverc -fdyncode -target x86_64-linux-gnu -mdyncode-syscall \
       hello.c -o hello_linux_x64.bin

# 5) Windows x86_64 (PEB walk for API calls)
neverc -fdyncode -target x86_64-pc-windows-msvc \
       -mdyncode-win-peb-import win.c -o win.bin

# 6) Custom entry symbol
neverc -fdyncode -target arm64-apple-macos -fdyncode-entry=dyncode_main kernel.c -o k.bin

# 7) Keep intermediate object for audit (otool / llvm-objdump / dumpbin)
neverc -fdyncode -target arm64-apple-macos -fdyncode-keep-obj=/tmp/dump.obj x.c -o x.bin

# 8) Reject forbidden bytes in final .bin
neverc -fdyncode -target arm64-apple-macos -fdyncode-bad-bytes=00,0a,0d x.c -o x.bin

# 9) Built-in bad-byte profile (same as forbidding 00/0a/0d)
neverc -fdyncode -target arm64-apple-macos -fdyncode-bad-byte-profile=http-newline x.c -o x.bin

# 10) Run on macOS (platform-specific loader)
./loader_arm64_macos add.bin 3 4   # exit code = 7

# 11) Verbose extractor summary
neverc -v -fdyncode -target arm64-apple-macos fib.c -o fib.bin
#   dyncode-extractor: wrote 64 bytes to 'fib.bin'
#   dyncode-extractor: target   = arm64-apple-macos (Mach-O)
#   dyncode-extractor: entry symbol = _main
#   dyncode-extractor: patched 1 BRANCH26, 0 PAGE21, 0 PAGEOFF12 intra-section reloc(s)

CLI Options (all defined in `Options.td.h`)

Option	Description
`-fdyncode`	Enable dyncode compilation mode.
`-fno-dyncode`	Cancel a preceding `-fdyncode`.
`-fdyncode-all-blr`	Aggressive mode: indirect-ize intra-module direct calls to `blr xN` / `call *rax`, eliminating all relative branch relocations. Not needed for normal use.
`-mdyncode-syscall`	Explicitly enable syscall stubs (already default under `-fdyncode` for Darwin/Linux/Android; mainly for expressing intent or script compat).
`-mdyncode-libsystem`	Darwin legacy alias for `-mdyncode-syscall`.
`-mdyncode-win-peb-import`	Explicitly enable Windows PEB import (already default under `-fdyncode` + Windows triple).
`-fdyncode-keep-obj=<path>`	Copy intermediate object file to `<path>` for native disassembler audit.
`-fdyncode-entry=<name>`	Override default entry name. Defaults accept `main` / `_main` / `dyncode_entry` / `_dyncode_entry`.
`-fdyncode-bad-bytes=<hex-list>`	Comma-separated forbidden byte list, e.g. `00,0a,0d` or `0x00,0x0a`. Extractor scans the final `.bin` after post-extract interposes; hits cause failure with no file written.
`-fdyncode-bad-byte-profile=<name>`	Built-in forbidden byte profiles: `null`, `c-string`, `http-newline`, `line`, `whitespace`, `ascii-control`. Combinable with `-fdyncode-bad-bytes=`.
`-fdyncode-obfuscate=<spec>`	Passed through to registered IR-level plugin interposes via the Plugin API. No-op when no plugin is loaded. See ir-pass-design.md §9 — Obfuscation Interposes.
`-fdyncode-mir-obfuscate=<spec>`	Passed through to MIR-level obfuscation interposes (`RunBeforePreEmit` / `RunAfterPreEmit`). Falls back to `-fdyncode-obfuscate=` value if unset. See mir-pass-design.md §3 — User Obfuscation Interposes.

Architecture Overview

The pipeline splits into target-independent IR passes + target-specific extractors:

flowchart TD
    Driver["neverc -fdyncode · OptTable + Options.td.h"]
    Frontend["C23 Frontend · PIC default"]
    Driver -->|describeTriple| Frontend
    Frontend -->|LLVM IR| ZRP

    subgraph IR["Target-Independent IR Passes"]
        direction TB
        ZRP["① ZeroRelocPass — Prep\ninternal + always_inline\nreject ctors / thread_local / extern_weak"]
        IBP["② IndirectBrPass\ncomputed-goto → switch"]
        SSP["③ SyscallStubPass\nlibc → svc #0x80 / svc #0 / syscall"]
        WPP["④ WinPEBImportPass\nextern Win32 API → PEB-walk thunk"]
        MIP["⑤ MemIntrinPass\nmemcpy/memset/str* → byte-loop"]
        CRP["⑥ CompilerRtPass\ni128 div/mod → inline long-division"]
        D2T1["⑦ Data2TextPass — Phase 1\nconst GV → stack stores"]
        ZRP --> IBP --> SSP --> WPP --> MIP --> CRP --> D2T1
    end

    Backend["AArch64 / X86 Backend\nSROA · InstCombine · AlwaysInliner · SLP"]
    D2T1 --> Backend

    Backend --> D2T2
    subgraph Post["Post-Backend IR"]
        direction TB
        D2T2["⑧ Data2TextPass — Phase 2\nvector const split"]
        ZRS["⑨ ZeroRelocPass — Stackify\nglobals → entry alloca"]
        ABP["⑩ AllBlrPass (optional)\ndirect call → indirect call"]
        D2T2 --> ZRS --> ABP
    end

    Codegen["Codegen · IR → MIR → Register Allocation"]
    ABP --> Codegen

    Codegen --> MH1
    subgraph MIR["MIR Layer"]
        direction TB
        MH1["⑪ RunBeforePreEmit interpose"]
        MIRP["⑫ DynCodeMIRPrepPass\nstrip CFI / EH_LABEL / XRay / StackMap"]
        MH2["⑬ RunAfterPreEmit interpose\ninstruction-level obfuscation entry"]
        MH1 --> MIRP --> MH2
    end

    MH2 -->|"Mach-O / ELF / COFF .o"| Extractor

    subgraph Extract["Extractor Layer"]
        Extractor["DynCodeExtractor\nMachO · ELF · COFF\npatch intra-.text relocs\nreject external reloc / data section\nbad-byte audit"]
    end

    Extractor --> Output(["flat .bin dyncode"])

Table-Driven Platform Differences

neverc/include/neverc/DynCode/Pipeline/TargetDesc.h defines a TargetDesc struct describing all differences for each (OS, arch) combination:

TextSectionName: Mach-O __text / ELF .text / COFF .text
SyscallABI: enum value (DarwinSvc80 / LinuxSvc0 / LinuxSyscall / WindowsPEB / None)
AsmTemplate: svc #0x80 / svc #0 / syscall
SyscallNumberReg: x16 / x8 / rax
SyscallRetReg: x0 / rax
ArgRegs: ordered list of platform ABI argument registers + count
TCBReadAsm / TCBReadConstraint: inline-asm single-instruction template for reading TEB/PEB pointer (Windows x86_64 = movq %gs:0x60, $0, Windows arm64 = ldr $0, [x18, #0x60]). WinPEBImportPass reads directly from the table.
DriverInjectFlags: platform-specific driver flags as a null-terminated static array (x86_64 Unix gets -fpic -mcmodel=small; Windows gets -mno-stack-arg-probe / /GS-). perTargetInjectFlags reads from the table.

SyscallStubPass and WinPEBImportPass both generate InlineAsm from TargetDesc fields. The compiler backend still uses TableGen-defined instruction patterns. Adding a new target means one more row in describeTriple and one more case in each extractor's switch.

Extractor Layer

Format	Implementation	Patchable intra-section relocations
Mach-O	`MachOExtractor.cpp`	arm64: `ARM64_RELOC_BRANCH26` / `PAGE21` / `PAGEOFF12`; x86_64: `X86_64_RELOC_SIGNED` / `SIGNED_1/2/4` / `BRANCH` (intra-`__text` pcrel32); `UNSIGNED` / `GOT_LOAD` / `GOT` / `SUBTRACTOR` / `TLV` rejected
ELF	`ELFExtractor.cpp`	arm64: `R_AARCH64_CALL26` / `JUMP26` / `ADR_PREL_PG_HI21(_NC)` / `ADD_ABS_LO12_NC` / `LDST{8,16,32,64,128}_ABS_LO12_NC` / `PREL32`; x86_64: `R_X86_64_PC32` / `PLT32` (`GOTPCREL` rejected)
COFF	`COFFExtractor.cpp`	arm64: `IMAGE_REL_ARM64_BRANCH26` / `PAGEBASE_REL21` / `PAGEOFFSET_12A` / `PAGEOFFSET_12L` / `REL32`; x86_64: `IMAGE_REL_AMD64_REL32` / `REL32_[1-5]`

Any other type or cross-section relocation is a hard failure with actionable hints (libc guess → syscall stub / _Complex → manual struct / literal pool backend fallback, etc.).

User Code Capability Matrix

Scenario	User code	Supported	Mechanism
Integer arithmetic / bitwise	`int f(int a) { return a*3+1; }`	Yes	Pure instruction stream
Recursion / loops	`int fib(int n) { ... }`	Yes	`static` + always_inline
`switch / case`	`switch (op) { case 0: ... }`	Yes	Driver injects `-fno-jump-tables`
Struct by-value passing	`struct Vec3 v = {...}; dot(v);`	Yes	Stack-ified + always_inline
Floating-point	`double y = x * 3.14;`	Yes	Data2Text rewrites ConstantFP to volatile-loaded bit pattern
Small constant arrays	`const int t[4] = {1,2,3,4};`	Yes	Data2Text stack-ifies
Large constant arrays (256B+)	`const unsigned char tbl[256] = {...}`	Yes	Data2Text, no size limit
String literals	`const char s[] = "hi\n";`	Yes	Data2Text stack-ifies
`memcpy` / `memset` / `memmove` / `memcmp`	`memcpy(dst, src, n);`	Yes	MemIntrinPass byte-loop wrappers
`strlen` / `strcpy` / `strcmp` / etc.	`strlen(buf);`	Yes	MemIntrinPass byte-loop wrappers
`__int128` division / modulo	`u128 q = a / b;`	Yes	CompilerRtPass inline long-division
`_Atomic` / `__atomic_` / `__sync_`	`__atomic_fetch_add(&c, 1, ...)`	Yes	Inline LDXR/STXR (arm64) / LOCK (x86_64)
`__builtin_*` family	`__builtin_popcount(x)`	Yes	Backend single-instruction selection
VLA / flexible array / compound literal	Normal C99/C11	Yes	`-fno-jump-tables` + Data2Text
Mutable globals	`static int counter = 0;`	Yes	ZeroReloc stack-ifies
libc write/exit	`write(1, s, 3);`	Yes (with `-mdyncode-syscall`)	Syscall wrapper
POSIX includes	`#include <unistd.h>`	Yes (dyncode mode auto-switches to shim)	Driver injects `__NEVERC_DYNCODE__`
Win32 API	`WriteFile(h, buf, n, &w, 0);`	Yes (with `-mdyncode-win-peb-import`)	PEB-walk thunk
Windows SDK includes	`#include <windows.h>`	Yes (dyncode mode auto-switches to shim)	Lightweight shim headers
Custom entry name	`int dyncode_main(...)`	Yes (with `-fdyncode-entry=...`)	Driver pass-through
Global constructors	`__attribute__((constructor))`	No	No runtime to trigger them
TLS / thread_local	`thread_local int x;`	Auto-demoted to static	ZeroRelocPass.Prep silently demotes
C++ / ObjC	—	No	Project scope is C only

Directory Structure

neverc/
├── include/neverc/Invoke/Options.td.h           # -fdyncode-* TableGen definitions
├── include/neverc/DynCode/                  # Headers (organized by subsystem)
│   ├── Pipeline/                              # Pipeline / driver integration
│   │   ├── Pipeline.h                         # IR + MIR interpose registration
│   │   ├── DriverIntegration.h
│   │   ├── TargetDesc.h                       # Platform table / descriptors
│   │   ├── DynCodeOptions.h                 # Cross-subsystem config
│   │   ├── Diagnostics.h                      # Cross-subsystem diagnostics
│   │   └── SymbolNames.h                      # Cross-subsystem symbol utilities
│   ├── Extractor/
│   │   └── DynCodeExtractor.h
│   ├── IR/                                    # IR-level passes and ABIs
│   │   ├── ZeroRelocPass.h / ZeroRelocABI.h
│   │   ├── Data2TextPass.h / Data2TextABI.h
│   │   ├── AllBlrPass.h / IndirectBrPass.h
│   │   ├── MemIntrinPass.h                    # memcpy/memset/str* inlining
│   │   ├── StringRuntimePass.h / StringRuntimeABI.h
│   │   ├── HeapArenaPass.h                    # malloc/free → arena + OS fallback
│   │   ├── MmapABI.h                          # Shared mmap constants (prot/flags)
│   │   ├── DynCodeIRHelpers.h               # Common IR utilities (getSizeType, etc.)
│   │   ├── ExternRewriter.h                   # Extern function rewrite utilities
│   │   └── CompilerRtPass.h                   # __int128 division inline
│   ├── MIR/
│   │   └── MIRPrepPass.h                      # Catch-all MachineFunctionPass
│   ├── Import/                                # User-mode + kernel-mode import resolution
│   │   ├── SyscallStub.h / SyscallTables.h
│   │   ├── WinPEBImport.h / WinImportTables.h
│   │   ├── KernelImportPass.h / KernelImportABI.h
│   │   └── PtrCacheHelpers.h                  # Shared address cache encryption helpers
│   └── Tables/                                # User-extensible .def tables
├── lib/DynCode/                             # Implementation (mirrors header structure)
│   ├── Pipeline/ Extractor/ IR/ MIR/ Import/
└── lib/Invoke/Core/Driver.cpp

tests/neverc/                                   # Tests (GTest)
├── DynCodeTests.cpp                         # Core dyncode round-trip tests
├── DynCodeStressTests.cpp                   # Stress tests (VLA, __sync_*, __int128, etc.)
├── DynCodeCrossTargetTests.cpp              # Cross-target compile-only smoke tests
├── dyncode/
│   ├── loader_arm64_macos.c / loader_linux.c / loader_windows.c
│   └── test_dyncode_*.c

docs/dyncode-compiler/
├── README.md                                  ← This file
├── arm64-assembly-tutorial/README.md
├── cross-platform-architecture/README.md
├── ir-pass-design/README.md
├── kernel-mode-dyncode/README.md
├── mir-pass-design/README.md
├── pipeline-and-pic/README.md
├── platform-extension-guide/README.md
├── progress/README.md
└── roadmap/README.md

Prerequisites (cross-platform)

DynCode load address must be 4 KB aligned — the natural behavior of mmap / VirtualAlloc; all loader code already complies.
Calling conventions follow the target OS native ABI:
- Darwin / Linux / Android: System V AMD64 or AAPCS64
- Windows: Win64 (rcx/rdx/r8/r9)
The loader is responsible for i-cache flush (arm64) / FlushInstructionCache (Windows).

Obfuscation & Plugin Extension

The dyncode pipeline itself only ensures "the code runs correctly". Obfuscation, polymorphism, staged encoders, and similar strategy-layer features are intentionally not built-in — they are provided by out-of-tree plugins through the Plugin API.

The pipeline exposes 11 interpose points across three layers, all accessible via the C Plugin API (NEVERC_INTERPOSE_SC_*):

IR level (6 interposes):

NEVERC_INTERPOSE_SC_BEFORE_PREP — Before any dyncode pass
NEVERC_INTERPOSE_SC_AFTER_PREP — Linkage unified (internal + always_inline)
NEVERC_INTERPOSE_SC_BEFORE_INLINING — Last chance before AlwaysInliner
NEVERC_INTERPOSE_SC_AFTER_INLINING — IR fully compressed into one large function
NEVERC_INTERPOSE_SC_AFTER_STACKIFY — Final IR shape, next step is codegen
NEVERC_INTERPOSE_SC_AFTER_FINAL_IR — After AllBlrPass, the true last IR interpose

MIR level (3 interposes):

NEVERC_INTERPOSE_SC_BEFORE_PREEMIT — Registers allocated, CFI/EH pseudos still present
NEVERC_INTERPOSE_SC_AFTER_PREEMIT — Built-in MIRPrepPass has stripped pseudos, closest to the byte form AsmPrinter will see; ideal for instruction-level obfuscation/register renaming
NEVERC_INTERPOSE_SC_AFTER_FINAL_MIR — True last MIR interpose, after LLVM addPreEmitPass2(), just before AsmPrinter

Byte-stream level (2 interposes):

NEVERC_INTERPOSE_SC_POST_EXTRACT — After extractor completes intra-text relocation patching and data-section audit; before .bin is written. Use for whole-payload encryption, junk byte insertion, or custom headers.
NEVERC_INTERPOSE_SC_POST_FINALIZE — After all finalize steps; NeverC performs no further auditing.

See the Plugin API documentation for the full interpose list, pass registration, and code examples.

IR-level design: ir-pass-design.md §9 — Obfuscation Interposes.
MIR-level design: mir-pass-design.md §3 — User Obfuscation Interposes

Current Limitations

Supports 8 (OS, arch) combinations (see matrix above). Other triples (RISC-V, PowerPC, 32-bit x86, big-endian ARM, etc.) are rejected at describeTriple() with the full supported set listed as a hint. Each (OS, arch) row has independent User / Kernel contexts, yielding 16 (OS, arch, level) variants.
Windows PEB walk is fully implemented with multi-DLL dispatch. __neverc_win_resolve accepts (dll_hash, api_hash) pairs. The current whitelist covers kernel32.dll (~125 APIs), ntdll.dll (~26), user32.dll (~13), ws2_32.dll (~23), advapi32.dll (~16), shell32.dll (~6). Adding an API = one row in Tables/Win32Apis.def + one declaration in lib/Headers/windows.h.
External function whitelist only covers Darwin BSD / Linux / Android common syscalls (~80+) + Win32 APIs (~210). stdio and similar runtime-heavy interfaces are not included — dyncode cannot embed the full stdio state machine.
Does not support C++ / ObjC / CUDA — NeverC is C-only by design.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

NeverC DynCode Compiler

Guides

Core Goals

Supported Targets

Quick Start

CLI Options (all defined in `Options.td.h`)

Architecture Overview

Table-Driven Platform Differences

Extractor Layer

User Code Capability Matrix

Directory Structure

Prerequisites (cross-platform)

Obfuscation & Plugin Extension

Current Limitations

Uh oh!

FilesExpand file tree

README.md

Latest commit

History

README.md

File metadata and controls

NeverC DynCode Compiler

Guides

Core Goals

Supported Targets

Quick Start

CLI Options (all defined in Options.td.h)

Architecture Overview

Table-Driven Platform Differences

Extractor Layer

User Code Capability Matrix

Directory Structure

Prerequisites (cross-platform)

Obfuscation & Plugin Extension

Current Limitations

CLI Options (all defined in `Options.td.h`)