SCFU - S&box Obfuscator
Released
Reversible source level obfuscator for s&box projects
Adds an SCFU menu to the editor: hit Fuck before publishing to scramble identifiers, file names, enum values, fields and method layouts across your code; hit Unfuck afterwards to restore the original tree byte for byte.
DISCLAMER
SCFU DOWNLOADS CLOSED SOURCE BINARIES AT RUNTIME AND EXECUTES ARBITRARY CODE. YOU ARE UNDER NO OBLIGATION TO TRUST IT. USE IT AT YOUR OWN RISK, YOUR PROJECTS ARE YOUR RESPONSIBILITY.
SCFU needs a native scfu.exe (plus its managed dependencies) to actually rewrite your project. It can't be shipped inside the library for two reasons:
1. s&box library packages can't contain native executables. A .sbproj library is a sandboxed bundle of managed C#, the engine won't mount, extract, or execute a .exe from inside it. The obfuscator has to live on disk as a real file before Process.Start can launch it.
2. The obfuscation logic is intentionally closed source. Publishing the exe alongside the library would put the full transformation pipeline on asset.party as a downloadable artifact and for people to reverse engineer and write deobfuscation software for it (well, for some of the methods employed). Hosting it on f4pl0.com/scfu/ keeps the internals private while still letting the editor menu drive it.
On invoke, the library fetches the binaries into %LOCALAPPDATA%\scfu, runs the requested command against your project root, and deletes the cache directory immediately after, nothing persists between runs.
SCFU doesn't network anything, you can safely block it with firewall and it will run just fine, and it does not do anything except obfuscate and restore the original code.
SCFU needs a native scfu.exe (plus its managed dependencies) to actually rewrite your project. It can't be shipped inside the library for two reasons:
1. s&box library packages can't contain native executables. A .sbproj library is a sandboxed bundle of managed C#, the engine won't mount, extract, or execute a .exe from inside it. The obfuscator has to live on disk as a real file before Process.Start can launch it.
2. The obfuscation logic is intentionally closed source. Publishing the exe alongside the library would put the full transformation pipeline on asset.party as a downloadable artifact and for people to reverse engineer and write deobfuscation software for it (well, for some of the methods employed). Hosting it on f4pl0.com/scfu/ keeps the internals private while still letting the editor menu drive it.
On invoke, the library fetches the binaries into %LOCALAPPDATA%\scfu, runs the requested command against your project root, and deletes the cache directory immediately after, nothing persists between runs.
SCFU doesn't network anything, you can safely block it with firewall and it will run just fine, and it does not do anything except obfuscate and restore the original code.
Usage:
1. Toolbar → SCFU → Fuck
2. RESTART THE EDITOR
3. CHECK IF EVERYTHING IS WORKING AND BEHAVING AS INTENDED (SCFU is still in early days, it might unintentionally break stuff)
3. Publish your game from the editor
4. Toolbar → SCFU → Unfuck
5. RESTART THE EDITOR
2. RESTART THE EDITOR
3. CHECK IF EVERYTHING IS WORKING AND BEHAVING AS INTENDED (SCFU is still in early days, it might unintentionally break stuff)
3. Publish your game from the editor
4. Toolbar → SCFU → Unfuck
5. RESTART THE EDITOR
What it does:
- Renames classes, methods, fields, properties, parameters, locals, and source filenames
- Rewrites razor component references and SCSS imports/selectors to match renamed files
- Mangles CSS class names that are safe to rename
- Updates scene/prefab JSON __type keys to follow renamed types
- Encodes string literals into byte array decoder calls; each class gets its own unique decoder
- Replaces numeric literals with arithmetic/XOR identities that compute the same value
- Splits eligible methods into many tiny fragment methods
- Wraps method bodies in opaque predicates with dead decoy branches
- Scatters always false if blocks of fake decoy work between real statements
- Flattens control flow into state machine switch loops
- Scrambles method bodies into goto/label spaghetti
- Fuses unrelated private methods into one dispatcher with switch + local function bodies
- Wraps method bodies in try/catch with unreachable throw and false when filters
- Sprinkles fake attributes
- Spoofs editor display names ([Title], [Description], [Group], [Category], [Icon])
- Optional: renames [Property] fields/properties and adds Name = "original" so scene serialization still works
- Indirects static method calls through hoisted Action/Func delegate fields
- Shuffles field declaration order and injects random decoy fields
- Strips comments, removes log calls
- Injects fake-looking "subsystem" helper classes that real code never calls
Why:
Published s&box games ship their non-compiled assembly. Without obfuscation, code that you worked so hard on is available for everyone to see. SCFU shreds that shit so casual reverse engineering returns noise, without you having to commit obfuscated code or lose your dev ergonomics or gaming socks.