The forensic-first systems programming language.
JOCKY is a programming language and compiler ecosystem built for low-level control, security and traceability, with first-class support for practical digital-forensics workflows.
The obfuscator is not a plugin — it's the heart of the compiler.
- Lexersource → tokens
- Parsertokens → AST
- Semantic analysisnames, scopes
- Type checkingtyped AST
- LLVM IR generationAST → IR
- Combined ObfuscationIR → polymorphic IR
- Optimization passesobfuscated IR → optimized
- Machine codevia LLVM
Systems programming with forensics in mind
Most languages treat investigation and traceability as someone else's problem. JOCKY builds them into the language, the compiler and the tooling.
Low-level control
Write code that sits close to the machine, with direct control over how your program is laid out and runs.
Security
Security is a design goal of the language and compiler from the start, not a layer added afterwards.
Traceability
Understand what your code became, from source through each compiler stage to the final binary.
JOCKYShield Obfuscator
8-layer simultaneous obfuscation engine. After LLVM IR generation, the compiler applies multiple compounding layers of advanced code obfuscation
Forensic workflows
Language features and tooling aimed at practical digital-forensics work.
LLVM backend
JOCKY generates LLVM IR and runs its own optimization passes before producing machine code.
8 simultaneous layers. Every build looks like a different program.
The JOCKYShield Obfuscator doesn't just pack the binary — it transforms it at the IR level. Eight independent obfuscation passes run simultaneously after LLVM IR generation, each making the next harder to analyze. By the time LLVM optimization sees the IR, it's already unrecognizable.
- CMOV control flowno branching — flat CFG
- Runtime-derived keysBLAKE2b XOR · no static blobs
- Opaque predicate gatesmathematical routing · no junk
- Decoy function chainslegit-looking · real dead ends
- Polymorphic symbolsdictionary-driven · no hex prefixes
- Dispatch type rotationper-build dispatcher selection
- Synthetic call graphpoisoned · looks real
- Stack frame randomizationshifting offsets · no fixed layout
Why simultaneous, not sequential?
Research into LLM-powered deobfuscation shows that single-layer obfuscation is progressively transparent — modern AI models can deobfuscate CFG flattening, string XOR, and polymorphic symbols individually. But the research consistently finds universal failure against combined techniques.
By applying all 8 layers at once — each layer obscuring a different detection vector — the obfuscator defeats:
- Static analysis — encrypted strings, no plaintext .rdata, unique hash per build
- YARA rules — no fixed byte patterns, polymorphic symbols each build
- Behavioral telemetry — decoy functions, legitimate API patterns
- LLM deobfuscation — combined techniques create high resistance
- Kernel callbacks — indirect syscalls, ETW layering
Latest Releases
All newsLoading releases from GitHub…
Community
More- StartWelcome thread: introduce yourselfGitHub Discussions
- AskQuestions, ideas and show-and-tellGitHub Discussions
- ReportFound a compiler bug? Open an issueGitHub Issues
- BuildRead the contributing guideCONTRIBUTING.md
Help build JOCKY
You don't need to be a compiler engineer. Fix a bug, improve the docs, add tests or propose a language feature. Contributors of every experience level are welcome.