Post: LLVM obfuscation for imix — 587 → 0 eldritch strings

[hulto]

Summary

New dev-blog post documenting our recent imix obfuscation work: strings imix | grep -i eldritch went from 587 hits to 0.

The post covers:

• The string audit — breaking down all 587 eldritch leaks into 5 root causes (panic-location file!() strings, mangled symbol names, rust-embed paths, a temp-file prefix literal, and a prost-generated proto field name)
• Step-by-step LLVM obfuscation setup for Realm — building eshard/obfuscator-llvm against LLVM 20 with -fno-rtti, loading it into a matching nightly rustc via -Z llvm-plugins / -C passes, and wiring it workspace-wide through .cargo/config.toml
• Three hard-won traps:
  1. cargo rustc flags only hit the final crate — use RUSTFLAGS so every dependency gets the pass
  2. Plugin/rustc LLVM ABI mismatch → deterministic SIGSEGV on rustls (plugin built against distro LLVM 20 vs rustc's bundled libLLVM-20.1-rust); load works, the pass corrupts the heap
  3. string-encryption only encrypts NUL-terminated C strings (isCString()), so prost field names like [8 x i8] c"eldritch" are skipped — the sneaky final leak, which also gets MIR-inlined into libtransport
• The fixes that got to 0 without a working plugin: -Z location-detail=none, -C strip=symbols (the config's -Cstrip=debuginfo was shadowing the profile's strip=true), embedded-file rename (main.eldritch → main.svc), temp-prefix rename, and the wire-compatible Tome.eldritch → Tome.script field rename in the generated Rust code
• Full condensed step-by-step recipe with verification commands

Notes

• The post intentionally reflects the current state: the plugin path is documented as blocked by the LLVM ABI mismatch until the plugin is built against rustc's exact bundled LLVM — this is called out under "What's next".
• The realm-side changes described in the post (in spellshift/realm) are local work-in-progress and are not part of this PR — this PR is the blog post only.

Checklist

• Post uses the standard front matter (layout: post, gh-repo, gh-badge, tags, author: Hulto)
• Filename follows Jekyll convention YYYY-MM-DD-slug.md
• Factual content verified against the actual session (toolchain nightly-2025-08-01 = LLVM 20.1.8, plugin built with -fno-rtti, crash reproduced/isolated)