Building scLock: A 256-Slot Polymorphic Non-Linear MBA VM Bound to the Apple Secure Enclave (8.15 us Hot Path)

relay — Sun, 25 Oct 2026 07:20:33 +0000

Modern LLM-assisted reverse-engineering agents (coupled with Ghidra, IDA Pro, and Binary Ninja MCP servers) can decompile and patch standard macOS Mach-O (arm64) binaries in seconds. Traditional symbol stripping (strip -x) or branch-based ptrace checks (if (is_debugged) exit(1)) are trivial to locate and NOP out.

Furthermore, conventional software obfuscators suffer from a fatal structural flaw: they embed static AES/XOR decryption keys inside the Mach-O binary itself. Anyone who dumps process memory at runtime can extract the key and reconstruct the underlying control-flow graph.

We are relay (relay // SYSTEMS), and we built scLock (Supercluster Lock) to solve this for native macOS (arm64 Apple Silicon) applications, Rust crates, audio plugins (AU/VST3), and commercial software.

GitHub Repository & Free CrackMe Challenge: https://github.com/planners1490/sclock
Live Benchmarks & Documentation: https://planners1490.github.io/sclock/
Commercial SDK (macOS arm64): https://planners3.gumroad.com/l/sclock

The 4 Engineering Constraints Behind `scLock`

1. Zero Keys in the Binary via Physical Apple Secure Enclave (`SEP`)

Instead of storing decryption keys in __TEXT,__const or __DATA, scLock derives the 128-bit sponge master keys at runtime inside the physical Apple Silicon Secure Enclave (kSecAttrTokenIDSecureEnclave) coprocessor via hardware-locked P-256 ECDH and HKDF-SHA256.

Static keys stored in binary: 0 bytes.
Even if an attacker extracts the entire Mach-O binary from disk, the key material physically resides inside the Secure Enclave silicon.

2. Per-Build 256-Slot Polymorphic ISA + Non-Linear MBA ($\mathbb{Z}_{2^{64}}$)

Every invocation of sclock compile synthesizes a brand-new 256-entry instruction set from a 256-bit OS CSPRNG seed:

172 Active Micro-Handlers + 84 State-Corrupting Chaff Traps.
Arithmetic and bitwise operations are expanded into degree-2 and degree-3 Non-Linear Mixed Boolean-Arithmetic (MBA) identities over $\mathbb{Z}_{2^{64}}$, coupled with 2-adic permutation polynomials (P(X) = Q(X) mod 2^64) and Hensel-lifted opaque predicates ($7x^2 - 1 \not\equiv y^2 \pmod{2^{64}}$).
When loaded into Ghidra 11.x, DecompileCallback hits its >330s timeout (Decompiler process killed) attempting to simplify the entangled algebraic state graph.

3. Branchless Anti-Debug State Entanglement

Conditional anti-debug branches (B.EQ, CBZ, TBNZ) are the first thing reverse engineers patch. scLock emits zero conditional anti-debug branches.
Instead:

The prologue instruction bytes of all 256 handlers (detecting software BRK / 0xCC breakpoints) and the kernel sysctl(P_TRACED) bit (0 or 1) are XOR/ARX-mixed directly into the 256-bit sponge state accumulator.
If lldb or frida is attached (P_TRACED == 1), the sponge keystream silently diverges—causing the VM to decode valid-looking chaff instructions without ever crashing or revealing where the check occurred.

4. `8.15 us` Hot-Path Latency (~120,000 calls/sec)

Using AtomicU64 live-integrity-masked key caching after the initial cold SEP handshake, a single virtualized function call takes 8.15 microseconds (0.00815 ms) on Apple Silicon—consuming <0.1% of a 120Hz frame budget (0% frame drop).

Try the Public Reverse-Engineering Challenge (CrackMe)

Don't take our word for it—test scLock in your own disassembler and debugger right now.

We published a standalone arm64 Mach-O binary protected by scLock v1.0.0 in our GitHub repository:

git clone https://github.com/planners1490/sclock.git
cd sclock/crackme

# 1. Verify zero symbol or string leaks
nm -gU ./challenge_protected
strings ./challenge_protected | grep -iE "sclock|vm|opcode|mba|chaff" || echo "0 leaks found"

# 2. Run on Apple Silicon
chmod +x ./challenge_protected
./challenge_protected

Open ./challenge_protected in Ghidra, IDA Pro, Binary Ninja, or LLDB and share your findings in Issue #1 (Official CrackMe Challenge Thread)!

How the Commercial SDK Works in 3 Commands

# 1. Compile C/C++ into a Zero-Key Hardware-Locked binary (or emit a drop-in Rust crate)
sclock compile protect_me.c -o protect_me_locked --sep-lock

# 2. Scrub compiler paths, strip symbols & apply Hardened Runtime to any macOS app
sclock protect-app ./target/release/my_commercial_app

# 3. Run the 5-Stage Zero-Leak Security Auditor
sclock verify ./protect_me_locked

GitHub Repository & CrackMe: https://github.com/planners1490/sclock
Get scLock Commercial SDK ($79 on Gumroad): https://planners3.gumroad.com/l/sclock

DEV Community: relay