New CodeDefender now supports Windows ARM64 binaries.

Raise the cost of reverse engineering.

CodeDefender transforms compiled Windows binaries across x86-64 and ARM64. Compose mutation, control-flow protection, MBA, advanced code virtualization, and more without source changes.

Explore capabilities Talk to an engineer
  • Windows PE
  • x86-64 + ARM64
  • No source changes
protection profile
  1. 01

    Analyze

    PE + optional PDB

    Discover functions, control flow, references, and unwind metadata.

  2. 02

    Transform

    Composable passes
    VM · x86-64 + ARM64 Mutation Control flow Constants
  3. 03

    Rebuild

    x86-64 + ARM64

    Emit the protected binary with an optional debug map.

AMD64 & ARM64

Native PE rewriting

SEH + C++ EH

Exception-aware

CET + CFG

Mitigation-compatible

Optional PDB

Debug-aware

API + SDK

Pipeline-ready

Protection stack

Advanced techniques, composed around your threat model.

Build focused profiles instead of applying one opaque preset. Protect selected functions with the layers that fit their architecture, runtime constraints, and risk.

Advanced code virtualization

Virtualize selected x86-64 and ARM64 code as randomized, key-driven handlers with isolated VM state and configurable handler composition.

  • x86-64 + ARM64
  • Virtual machine

Mutation and MBA

Reshape protected computations with a mutation engine, Mixed Boolean Arithmetic, loop-encoded semantics, and layered expression transforms.

  • Mutation engine
  • MBA

Control-flow protection

Combine indirect control flow, hash-encoded conditions, opaque branches, block duplication, and reference hiding in reusable profiles.

  • Opaque flow
  • Indirect branches

Constants and references

Harden constants, obscure references, and protect imports to remove the stable landmarks reverse engineers rely on.

  • Constant hardening
  • Import protection

Binary diversification

Generate structurally distinct builds through instruction reordering, basic-block shuffling, and other lightweight transformations.

  • SigBreaker
  • Per-build variance

Architecture-aware rewriting

Analyze and transform 64-bit Windows PE targets across x86-64 and ARM64 with architecture-aware lifting and code generation.

  • x86-64
  • ARM64

Production binaries

Protection that works with the platform.

CodeDefender is built around the details that make native binary rewriting difficult: exceptions, unwind metadata, indirect control flow, debug information, and modern Windows mitigations.

  • Safety-first analysis

    Function boundaries, control flow, and unwind metadata are analyzed before rewriting. Functions that cannot be transformed safely are reported.

  • Exception-aware rewriting

    Preserve structured exception handling and C++ exceptions while working with modern Windows mitigations such as CET and CFG.

  • Debug mapping

    Request a debug map with protected builds and reconstruct PDB mappings when you need to investigate a production crash.

Architectures

x86-64 + ARM64

Windows PE today; Android support coming soon

Binary formats

EXE, DLL, drivers

Including UEFI modules where supported

Windows compatibility

SEH, CET + CFG

ACG-aware protection profiles

Integration

Web, API, CLI + SDK

Fit protection into your release pipeline

Stability is a requirement.

Obfuscation only matters if the protected binary still behaves like the original. Unstable obfuscators can crash often enough that QA teams must be paid to re-test every protected build. CodeDefender treats semantic preservation, compatibility, and repeatable output as requirements, not afterthoughts.

Compatibility testing

Proven on complex Windows binaries.

Internal transformation-coverage results from production-scale targets, including a browser, the Windows kernel, and a hypervisor component.

Hyper-V

hvix64.exe

98.9%

Functions transformed

Google Chrome

chrome.dll

95.8%

Functions transformed

Windows kernel

ntoskrnl.exe

92.0%

Functions transformed

Coverage measures discovered functions transformed in the referenced internal test target. Results vary by binary, architecture, and selected protection profile.

Workflow

From binary to protected build.

Start in the web interface, then automate the same workflow when you are ready.

  1. 01

    Analyze your binary

    Submit a Windows PE binary and optional PDB. CodeDefender surfaces eligible functions and explains any rejected regions.

  2. 02

    Build a protection profile

    Choose the functions that matter and compose architecture-appropriate virtualization, semantic, control-flow, constant, and anti-analysis passes.

  3. 03

    Protect and integrate

    Download the transformed binary and optional debug map, or automate repeatable builds through the API, CLI, or SDK.

Work with Aftermath Labs

Protect the code you ship.

Tell us about your binary, deployment environment, and threat model. We’ll help you choose a protection profile that fits.

Talk to Aftermath Labs