›glacis
Start protecting

Android & iOS · CLI or cloud

Every build unique.
Every byte verifiable.

Obfuscation, encryption, and integrity protection for Android and iOS binaries, from your CLI or our cloud.

Start protecting →$ npx glacis init

How it works

From your binary to a sealed build

One engine, two ways to run it. Protect locally from the CLI or in the cloud, and the output is identical down to the byte.

1

Submit your build

Point the CLI at your .so or Mach-O, or send it to the cloud API. The engine is pinned and checksum-verified before it ever runs.

2

The engine rewrites it

A seed is derived, then strategies are picked within budget: MBA, opaque predicates, control-flow restructuring and byte-measured encryption. No two builds look alike.

3

Sealed and verifiable

A freestanding runtime stub rides inside, checking integrity with no network calls. The same input and seed reproduce the exact same binary, every time.

Local or cloud

One engine, run it your way

Protect on your own machine or hand it to the cloud. It is the same engine version either way, CI-verified to behave identically.

Local · CLI

Protect on your machine

$ glacis protect app.so --policy prod
→ engine 4.8.2 · pinned · digest ok
✓ protected in 12.4s
  app.protected.so

The engine is downloaded, pinned and checksum-verified before it ever runs. Nothing leaves your box.

= identical

Cloud · API

Submit, stream, collect

$ glacis protect app.so --cloud
→ build gx-7f2d submitted
→ streaming logs…
✓ report ready · artifact deleted

Submit a build, stream the logs, pull a JSON + HTML report. No-retention storage: artifacts are garbage-collected, never kept.

Core protection

What the engine does to your code

A polymorphism engine derives a seed and picks strategies within budget, so no two protected builds look alike. Then it locks the result down.

Confuse

  • Mixed Boolean-Arithmetic obfuscation
  • Opaque predicates & bogus control flow
  • Control-flow restructuring

Encrypt

  • Keys measured from the binary itself
  • Lazy decryption, only when needed

Prove

  • Embedded freestanding runtime stub
  • Reproducible, seed-pinned output

The console

Every build, documented

A report for every protection run, the symbols behind it, and dashboards across all your projects.

  • Per-build reports, JSON + HTML
  • Symbol browser, parsed server-side
  • Policy editor in the UI
  • Full build history
  • Analytics: launches, regions, threats
  • Projects, API keys & quotas

Policy & control

Protection you version

Protection is configuration, not a one-off command. It lives in your repo and moves through review.

# glacis.policy.toml
engine = "4.8.2"
 
[obfuscation]
mba = "aggressive"
opaque_predicates = true
 
[encryption]
byte_measured = true
lazy = true

Policy as code

Validate, version and diff your protection policies like any other file in the repo.

Drift detection

Catch when a policy has moved away from the configuration it is meant to hold.

Version-aware enforcement

Policies record the engine version they were authored against. The engine refuses versions it cannot honor.

No-retention storage

Uploaded artifacts are garbage-collected, never kept.

Verified engine binaries

The CLI never runs a binary it has not digest-checked.

Schema-stable analytics

Unknown values degrade gracefully instead of breaking.

Backward compatible

Older engines keep working as event schemas grow.

Ship a build they can’t read.

One command locally, or one API call in the cloud. Same engine, same result, every time.

Start protecting →$ npx glacis init