Orvex

OrvexSecurity / Lua protection engine

No one reverses what no one understands.

What We Do

Orvex runs Lua scripts through several transformations: control-flow rewrites, string handling, bytecode encoding, a metamorphic VM and different dispatch paths. A new build can change the opcode table, encoding format and handler logic. The generated Lua and handler layout depend on those build parameters.

Start for free See features

Unique every run

Lua 5.1–5.4 · Luau · LuaJIT

Input · Lua sourceProtected output

-- Original Lua script
local function calculateDamage(base, multiplier)
  local crit = math.random() > 0.85
  local dmg = base * multiplier
  if crit then dmg = dmg * 2.5 end
  return math.floor(dmg)
end

local player = {
  name = "Hero",
  health = 100,
  attack = 45
}

Run the demo to compare source and protected output

Click “Obfuscate demo” to see the transformation

Why Orvex

Protection that varies per build

Orvex does more than rename and mask strings. Builds can output different internal representations: VM layout, opcode encoding, dispatch logic and bytecode parameters can change so outputs are not trivially identical.

Metamorphic VM

Each build can produce a different VM layout: opcode identifiers, instruction formats and the dispatch mechanism can be rearranged so a parser or static analyzer tuned to one layout fails on another.

Protected bytecode

Orvex transforms and encodes bytecode before embedding it in the output. The encoding format and masking choices are build-dependent, adding a decoding step between raw bytecode and VM execution.

Variable dispatch

Dispatch handlers are generated with build-specific choices: handler placement, handler ordering and comparison logic can vary. The dispatch routine emitted in the output may use different jump tables, computed branches or indirect calls depending on build options.

Control-flow disruption

Control flow is rewritten: opaque predicates, fake branches, dead code paths and virtual dispatch are inserted so the emitted control flow graph does not map directly to the original source flow.

VM→Opcodes→Dispatch→Encoding→Junk / decoys→Build parameters

Two builds of the same script can differ even after stripping names and constants. The generated Lua output and VM representation can change, not just identifiers and literals.

Practical tools for protecting Lua code

A staged Lua obfuscation engine focused on real-world resistance to static analysis and casual reverse engineering.

Orvex applies multiple, independent transformations so reversing the final output requires additional analysis, different tooling and manual effort. No single technique is invulnerable.

Control flow rewrites, VM bytecode encoding and multiple independent layers. Each layer forces extra manual analysis.

Premium

Full Second Protection Pass

Premium runs your VM-protected script through the entire pipeline again — fresh identifier renaming, number encoding and string encryption — then adds control-flow flattening, virtual dispatch on native calls, and pointer indirection on top. More independent layers to strip before anything is readable.

Premium

Metamorphic VM Dispatch

The VM's opcode ids, dispatch order and even which fused instruction forms exist are reshuffled independently on every single compile. A devirtualizer built against one output doesn't transfer to the next — there's no fixed opcode table to reverse.

Pro

VM Anti-Tamper Layer

A fast custom Lua VM: crypto-seeded opcode map and per-position bytecode masking, backed by a runtime check that catches a debugger before it reaches your code — even one that spoofs debug.gethook or redefines error() to hide itself.

Free

Mini VM

Even on the free tier, core logic is compiled to a compact custom bytecode and run by a lightweight interpreter — genuine virtual-machine protection, not just renaming, and near-instant to execute.

Pro

Dynamic Load Protection

Static string arguments passed to load() and loadstring() are detected and recursively obfuscated too — not shipped in clear text like every other obfuscator leaves it. Your dynamically-loaded logic gets the same protection as the rest.

Pro

Live Anti-Hook & Anti-Debug

Before a protected function runs, the runtime checks whether a debug hook is already attached — and keeps polling afterward. Attempts to hide a hook by monkey-patching debug.gethook, type() or error() are caught rather than trusted, and a detected debugger corrupts execution instead of ever handing back real data.

Free

Non-Deterministic Output

Identical source never produces the same output twice. Identifiers are redrawn from a fresh pool of natural-looking names and the whole structure is rebuilt on every compile, so signature-based detection, pattern-based renaming and script-diffing tools get nothing consistent to lock onto.

Free

Control Flow Flattening

All branching logic is collapsed into dispatch loops driven by opaque predicates. The original control graph is unrecoverable — decompilers produce unreadable, misleading output.

Free

9-Mode String & Number Encryption

Every string literal and constant is encrypted with one of 9 independent cipher modes, each value carrying its own randomly-generated key. Static string extraction returns nothing useful, and decoding happens byte-by-byte into a table instead of building the plaintext up in one variable, so a mid-execution memory read never catches more than a single decoded character at a time.

Pro

REST API

Integrate obfuscation directly into your build pipeline. Submit scripts and retrieve protected output programmatically — single jobs or batched.

Pro

Virtualized Strings

On VM-protected builds, string literals never decode through a visible Lua function. They rebuild inside the virtual machine itself through a dedicated instruction, each reference scrambled by a per-build selector and buried among decoy records, with the encrypted pool held outside the constant table. Even after devirtualization there's no decoder to lift and nothing ties an instruction back to its original text.

Free

Analytics Dashboard

Track every obfuscation job, monitor quota usage, and review your full submission history from one place.

Pricing

Simple, transparent pricing

Simple monthly tiers. Start on the free plan and upgrade when you need more.

Free

30 / month

Try Orvex with no commitment. Covers personal scripts and small experiments.

Free

30 obfuscations per month
16-layer protection pipeline
Control flow & dead-code hardening
Bytecode VM virtualization
Encrypted literals (strings & numbers)
Unique output every run
6 Lua runtime targets
History (7 days)
Advanced protection options
Archive batch obfuscation (.zip)
REST API access
Integrity verification header
load() / loadstring() obfuscation
Second protection pass
Priority support

Start for free

Tested. Fixed. Improved.

Orvex is covered by automated tests and continuous builds. Frequent runs exercise compatibility, edge cases and regressions before release.

998/999

Failures seen in pre-release runs are tracked. Issues that occur in rare runs are converted into tests or fixes to reduce recurrence.

We document what Orvex changes and its limits. No obfuscation is unbreakable; Orvex increases the analysis work required to recover original logic.

Recent updates

v15.0Latest

Major VM protection and stability update
Improved FiveM, Roblox, Luau and LuaJIT compatibility
Host APIs remain native while sensitive logic receives stronger virtualization
Improved VM diversification, dispatch and register mapping
Safer handling of globals, upvalues, varargs and dynamic environments
Removed unnecessary debug probes and reduced runtime exposure
Improved string protection and removed string.dump from the VM environment
Native pipeline and large-script performance improvements

v14.1

Output up to 10× lighter for some content
Optimized runtime decoding
Extended VM coverage
Better handling of large scripts
Edge-case fixes
Mini VM introduced — a first layer of virtualization, free

v14

Hardened virtualization core
Dynamic-load (load / loadstring) protection
Improved reliability
New protection layer

FAQ

Frequently Asked Questions

Questions? Send a message. We aim to reply within 24 hours.

Your account data and usage quotas are protected with industry-standard encryption. Sensitive information like API keys and billing data are never stored in plain text, ensuring your account remains secure even in the unlikely event of a data breach.

Both rely on a custom per-build VM, so there's real overlap in approach. Where Orvex stands apart: it natively targets FiveM and GTA V alongside Roblox, Luau, LuaJIT and Lua 5.1–5.4; it also protects code inside load() and loadstring() calls, which most obfuscators leave in clear text; and its output is regenerated with a different internal structure on every build. Pricing is flat monthly quotas — no tokens, no per-obfuscation charges. We won't claim any obfuscator is unbreakable, but Orvex is built to make automated deobfuscation impractical and is actively maintained.

No obfuscation is permanent — given enough time and expertise, a determined attacker can reverse anything. What Orvex does is raise the cost significantly: the custom per-build VM has no public specification, every build is structurally different, and multiple independent layers must each be broken before the original logic becomes readable. The goal is to make the effort not worth it in practice.

No. Orvex performs semantic-preserving transformations — the obfuscated script behaves identically to the original. We run automated correctness tests on every output before delivery.

API access starts with the Pro plan. Free users can obfuscate through the web dashboard only.

Enterprise customers with an approved use case may obfuscate scripts on behalf of their end-users. This is not permitted on any other plan to prevent abuse.

Orvex fully supports Lua 5.1, 5.2, 5.3, 5.4, and LuaJIT. Roblox Luau is also supported with dedicated settings.

What We Do

Unique every run

Lua 5.1–5.4 · Luau · LuaJIT

-- Original Lua script local function calculateDamage(base, multiplier) local crit = math.random() > 0.85 local dmg = base * multiplier if crit then dmg = dmg * 2.5 end return math.floor(dmg) end local player = { name = "Hero", health = 100, attack = 45 }

Practical tools for protecting Lua code

A staged Lua obfuscation engine focused on real-world resistance to static analysis and casual reverse engineering.

Orvex applies multiple, independent transformations so reversing the final output requires additional analysis, different tooling and manual effort. No single technique is invulnerable.

Control flow rewrites, VM bytecode encoding and multiple independent layers. Each layer forces extra manual analysis.

Tested. Fixed. Improved.

Orvex is covered by automated tests and continuous builds. Frequent runs exercise compatibility, edge cases and regressions before release.

998/999

Failures seen in pre-release runs are tracked. Issues that occur in rare runs are converted into tests or fixes to reduce recurrence.

We document what Orvex changes and its limits. No obfuscation is unbreakable; Orvex increases the analysis work required to recover original logic.