Protection modes
How each Aegis protection layer works, and when to use which mode.
Protection layers
Each layer is an independent toggle in the dashboard.
String encryption
Every string literal is XOR-encrypted with a unique key and decoded by a memoizing helper at runtime. Plaintext never appears in the output, and repeated reads stay fast thanks to caching.
Number obfuscation
Integer constants become exact arithmetic expressions; floats become exact integer division. Hardcoded numbers disappear from the source.
Control-flow flattening
Statement lists become a shuffled state machine (while true / if state == N ...). The original order of your logic is destroyed.
Variable renaming
Scope-aware renaming scrambles locals, labels and (optionally) globals. Source identifiers are reserved first so generated names never collide.
Custom bytecode VM
VM onlyCompiles your program into a custom register-based instruction set and ships a self-contained Lua interpreter. Instructions are chain-encrypted and decrypted one at a time during execution, with an extra per-build opcode mask and a self-integrity check that corrupts the keys on tampering.
Environment lock
VM onlyFolds a hash of the game environment (resource name, AEGIS_ENV or PlaceId) into both decryption keys. The file only runs in that exact environment.
ServerShield
VM onlyThe decryption key never ships with your file — it is stored server-side and delivered at runtime after a license fingerprint check. The protected file contains no strings, opcodes or key math at all.
VM support matrix
The VM compiler covers common Lua constructs. Anything unsupported automatically falls back to source mode for that construct.
| Closures & upvalues | Supported |
| Recursion | Supported |
| Method calls (a:b(...)) | Supported |
| Tables (array + dict) | Supported |
| Varargs (...) | Supported |
| Bitwise operators (& | ~ << >>) | Supported |
| Numeric for / while / repeat | Supported |
| break | Supported |
| Generic for ... in loops | Falls back to source mode |
| continue | Falls back to source mode |
| goto / labels | Falls back to source mode |
Protected file header
Every encrypted file starts with a versioned Aegis header on line 1, a blank line 2, and your protected code from line 3 onward. The build number changes with each release.
-- This file was protected by Aegis Obfuscator Build 2.4.0 [https://aegisob.com] -- (your protected code starts here, line 3)
ServerShield
ServerShield removes the decryption key from your file entirely. Your script is packed into one encrypted blob, and the key stays on the Aegis server. At runtime the file sends its license fingerprint to /api/runtime/key and only receives the key if the fingerprint matches. The protected file itself contains no strings, no opcodes and no key math - static analysis of the file alone cannot recover the payload.
Enable
Toggle ServerShield in the dashboard before encrypting. Optionally enter a license key (e.g. your FiveM sv_licenseKey or a Roblox place id) to bind the build to one customer, and an environment string to lock it to one server.
Requirements
The runtime needs internet access once at startup: FiveM uses PerformHttpRequest, Roblox uses HttpService. You can also provide a custom AEGIS_KEY_PROVIDER global.
Build 2.4 hardening
The payload is now double-encrypted: the blob key comes from the server, and inside the blob every instruction and constant has its own keyed stream, an extra per-build opcode mask and a lazy self-integrity hash that corrupts the keys on tampering. Both key layers fold in the environment lock and a hook fingerprint of the standard library — running the file on the wrong server, under a debugger, or with a single patched byte destroys the decryption instead of revealing anything. There is no bulk plaintext phase anywhere: instructions are decrypted one at a time at fetch.
Honest note
No obfuscation is unbreakable - a determined attacker with a custom Lua engine can still trace the VM at runtime. ServerShield raises the bar dramatically: without the server key, the environment and an unhooked runtime there is nothing to statically decrypt, and even a licensed copy has no bulk plaintext to dump.
Environment lock
VM and ServerShield builds can be locked to a game environment. Aegis folds a hash of the environment identifier into both decryption keys: the runtime reads GetCurrentResourceName() (FiveM), the AEGIS_ENV global, or game.PlaceId (Roblox) - in that order. If the file runs anywhere else, the keys come out wrong and the VM corrupts itself. An attacker who only has the file is missing a secret that is never stored inside it.
Enable
Type your resource name / place id in the Environment lock field. Leave the field empty to lock against the auto-detected environment. A file encrypted with an explicit environment string errors out if that environment cannot be found.
Use cases
Selling FiveM scripts bound to one resource name, Roblox games bound to one PlaceId, or simply keeping offline copies of your scripts from ever running on another server. Combine with ServerShield for defense in depth: ServerShield hides the payload, the environment lock hides the keys.