# Configurations

Source: https://hashisoft.com/docs/configurations

Keep your settings in an RR file and upload it with each build.

The API takes two files: your compiled Jar and a UTF8 RR configuration. There is no configuration ID to create or select. Name the configuration cat.rr, release.rr or any other filename.

## An API configuration

Download this example and edit the engine block. Keep format 1 and the Lithium profile declaration. The API assigns input, output and workspace paths inside each job, so local Windows paths are unnecessary.

[Download api.rr](https://hashisoft.com/presets/api.rr)

```rr
format 1;
use "lithium";
engine ^ {
    skipFlow false;
    skipString false;
    skipArithmetic false;
    linkedIndy true;
    chainedControlFlow true;
    stringProtectionProfile "strong";
}
```

Use false for skipFlow, skipString and skipArithmetic to enable those passes. Set a skip option to true to leave that part unchanged. Positive controls such as linkedIndy and chainedControlFlow use true to enable the feature.

### Server-controlled settings

The worker enables bytecode verification, disables application smoke runs and signing, and uses a 90 second engine budget. A separate validation block and a local buildWorkspace are not accepted. Native protection and unsupported advanced options return an error rather than being silently ignored.

### Files and identifiers

Upload the Jar as file and the RR file as config. The returned id identifies that build only. The configHash identifies the uploaded file contents; it is not a configuration ID and is not sent in later uploads. To change protection, edit your RR file and submit both files again.

## The Lithium profile

`format 1;` selects the RR syntax version. `use "lithium";` loads the defaults bundled with your engine. Lithium is a base profile, not a separate configuration file you need to download.

Settings omitted from this file still inherit their values from Lithium. The bundled profile selects Java protection and disables native virtualization. Its defaults can differ between engine versions.

`engine ^` overrides inherited engine settings. The caret is required when replacing a value supplied by the profile. Command line overrides take precedence over the file.

## The extended catolog.rr preset

This extended example contains local engine settings. The API overrides its time budget and safety settings. Download the file or copy it below. For a local build, update `input` and `output` to your Jar paths. The seed is already supplied.

[Download catolog.rr](https://hashisoft.com/presets/catolog.rr)

```rr
format 1;
use "lithium";
project {
    input "hi.jar";
    output "hi-obf.jar";
    seed "96be4325b54ce68bb498693f97c42d82d78d7436e79501f5abd45ece9191befe";
}
engine ^ {
    dictionary "MORVAY_UNICODE";
    skipReflection false;
    skipConstructorIndy false;
    packageRoot "hashira";
    expressionSteps 0;
    expressionClasses 5;
    compactAppearance true;
    decimalAppearance true;
    linkedIndy true;
    chainedControlFlow true;
    aggressiveFlow true;
    bozarFlow true;
    bozarConst true;
    skipFlow false;
    skipString false;
    skipArithmetic false;
    stringProtectionProfile "strong";
    appearanceMethod "";
    appearanceText "اللَّهُ لَا إِلَٰهَ إِلَّا هُوَ الْحَيُّ الْقَيُّومُ ۚ لَا تَأْخُذُهُ سِنَةٌ وَلَا نَوْمٌ ۚ لَهُ مَا فِي السَّمَاوَاتِ وَمَا فِي الْأَرْضِ ۗ مَنْ ذَا الَّذِي يَشْفَعُ عِنْدَهُ إِلَّا بِإِذْنِهِ ۚ يَعْلَمُ مَا بَيْنَ أَيْدِيهِمْ وَمَا خَلْفَهُمْ ۖ وَلَا يُحِيطُونَ بِشَيْءٍ مِنْ عِلْمِهِ إِلَّا بِمَا شَاءَ ۚ وَسِعَ كُرْسِيُّهُ السَّمَاوَاتِ وَالْأَرْضَ ۖ وَلَا يَئُودُهُ حِفْظُهُمَا ۚ وَهُوَ الْعَلِيُّ الْعَظِيمُ";
    writeDiagnostics true;
    signOutput false;
    buildTimeBudgetSeconds 900;
}
```

## What this preset changes

### Project and naming

`input` is the source Jar and `output` is the protected Jar. `seed` supplies the build seed. `dictionary` selects MORVAY_UNICODE and `packageRoot` sets hashira as the renamed package root.

### Control flow and calls

`skipFlow false` enables flow protection. `chainedControlFlow`, `aggressiveFlow` and `bozarFlow` enable the additional flow passes. `linkedIndy true` enables linked dynamic calls. `skipReflection false` and `skipConstructorIndy false` allow their respective reference and constructor call passes.

### Strings and arithmetic

`skipString false` enables string encryption and `stringProtectionProfile "strong"` selects the Strong profile. `skipArithmetic false` enables arithmetic protection and `bozarConst true` enables constant transformation.

`expressionSteps 0` sets expression depth to zero. It does not disable every arithmetic pass. `expressionClasses 5` sets the expression family count independently.

### Appearance and build output

`compactAppearance`, `decimalAppearance`, `appearanceMethod` and `appearanceText` configure generated helper appearance. The text in this preset is a literal appearance value, not a secret or an encryption key.

`writeDiagnostics true` enables build diagnostics. `signOutput false` disables output signing. `buildTimeBudgetSeconds 900` sets the build time budget to 15 minutes.

## Adjusting protection

For skip controls, false enables the pass and true skips it. Positive controls such as linkedIndy use true to enable the feature. Keep these two conventions separate.

Hardening Level ranges from 0 to 5. Expression depth ranges from 0 to 8. These settings control different transformations and are not a single protection score. More aggressive settings can increase output size, build time and runtime cost.

Preserve names used by reflection, frameworks and external callers through exclusions. Native protection requires a matching runtime and toolchain; enabling it changes the deployment requirements.

The protection guides below list individual option names and supported panel values. Their panel defaults are not the resolved Lithium defaults.

[Control Flow](https://hashisoft.com/docs/dashboard/controlflow/introduction)[String Encryption](https://hashisoft.com/docs/dashboard/strings/introduction)[Calls and Arithmetic](https://hashisoft.com/docs/dashboard/calls-and-arithmetic/introduction)[Native Virtualization](https://hashisoft.com/docs/dashboard/native/introduction)[Renaming and Metadata](https://hashisoft.com/docs/dashboard/renaming/introduction)[Runtime Protection](https://hashisoft.com/docs/dashboard/runtime/introduction)[Build Options](https://hashisoft.com/docs/dashboard/build/introduction)

## Using the file with the API

### Prepare your configuration

Save your protection settings in an RR file such as release.rr. The filename is your choice. The supplied catolog.rr is an example you can rename.

### Upload both files

Send your Jar in the file field and your RR file in the config field. No saved configuration ID is required.

### Track the build

Use the returned job ID to check progress and download the protected Jar.

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations" \
  --header "Authorization: Bearer $hashirapikey" \
  --form "file=@hi.jar" \
  --form "config=@release.rr"
```

Each job keeps the uploaded settings. The configHash response field is a SHA256 digest of the uploaded configuration. Editing your local file does not change an existing job.

The remote Java worker accepts UTF8 RR files up to 64 KiB using the Lithium profile. Native protection and unsupported advanced options are rejected. Input and output paths are assigned per job. Verification is enabled and smoke runs and signing are disabled. The engine time budget is 90 seconds.


# Introduction

Source: https://hashisoft.com/docs/introduction

Submit a compiled Jar with your RR configuration file, then download the protected output from your build tools.

## Before you start

You need an approved account, an API key and an RR configuration file.

## Get started

[Create an API keyAuthenticate requests from your server](https://hashisoft.com/docs/create-an-api-key)[Submit your first buildUpload hi.jar and collect the output](https://hashisoft.com/docs/quickstart)[Choose a configurationPrepare an RR file for your build](https://hashisoft.com/docs/configurations)[Handle errorsCheck request limits and build availability](https://hashisoft.com/docs/errors)


---

# Create API key

Source: https://hashisoft.com/docs/create-an-api-key

Create a key to authenticate requests from your build tools

## Hashira API keys

API keys authenticate requests to Hashira. Store each key in your server environment and keep it private.

Create a separate key for each integration. You can then disable one integration without interrupting the others. Your account must be approved before you can create keys.

## Create an API key

Create your key from the [API keys page](https://hashisoft.com/king/api-keys) in your Hashira account

### Open API keys in your account

Sign in and select API keys from the sidebar

### Select Create API key

The Add API Key dialog opens without leaving the page

### Enter a name for your key

Choose a name you will recognize later, such as Release builds.

### Review the permission and expiration

Review the access permission and choose when the key expires.

### Select Add

The key appears once the request completes.

### Copy and save the key

Copy the key before closing the dialog. You cannot retrieve the full key later.

## Use the API key in your code

Set the key in your server environment then include it as a Bearer token in the Authorization header

```bash
export hashirapikey="your-api-key"
```

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/account" \
  --header "Authorization: Bearer $hashirapikey"
```

## Manage your keys

Disable a key to stop requests from an integration. Delete it when you no longer need it. If a key is exposed, replace it and update the affected tools.

## Next steps

[Submit your first build](https://hashisoft.com/docs/quickstart)


---

# Authentication

Source: https://hashisoft.com/docs/authentication

Create an API key and store it in your server environment or CI secret store.

```bash
export hashirapikey="your-api-key"
```

## Bearer authentication

Include the key in the Authorization header on every request, including status checks and downloads.

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/account" \
  --header "Authorization: Bearer $hashirapikey"
```

## Keep keys private

Keep keys out of browser code and public repositories. New keys are shown once. Disable or delete a key when it should no longer be used.


---

# Your first build

Source: https://hashisoft.com/docs/quickstart

Submit hi.jar with your RR file and download the protected build.

Have your API key and local RR file ready. You can use any filename such as release.rr.

### Prepare your configuration

Save your settings as release.rr or choose another filename. Update the config file path in the upload command.

### Upload your Jar

Send the Jar and RR files together. Hashira returns HTTP 202 with the new build record.

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations" \
  --header "Authorization: Bearer $hashirapikey" \
  --form "file=@hi.jar" \
  --form "config=@release.rr"
```

### Check build status

Set jobId to the id returned by the upload request, not a configuration ID. Check the status until it is completed or failed.

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations/$jobId" \
  --header "Authorization: Bearer $hashirapikey"
```

### Download the result

When the build is completed, save the output as hi-obf.jar.

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations/$jobId/output" \
  --header "Authorization: Bearer $hashirapikey" \
  --output hi-obf.jar
```


---

# Configurations

Source: https://hashisoft.com/docs/configurations

Keep your settings in an RR file and upload it with each build.

The API takes two files: your compiled Jar and a UTF8 RR configuration. There is no configuration ID to create or select. Name the configuration cat.rr, release.rr or any other filename.

## An API configuration

Download this example and edit the engine block. Keep format 1 and the Lithium profile declaration. The API assigns input, output and workspace paths inside each job, so local Windows paths are unnecessary.

[Download api.rr](https://hashisoft.com/presets/api.rr)

```rr
format 1;
use "lithium";
engine ^ {
    skipFlow false;
    skipString false;
    skipArithmetic false;
    linkedIndy true;
    chainedControlFlow true;
    stringProtectionProfile "strong";
}
```

Use false for skipFlow, skipString and skipArithmetic to enable those passes. Set a skip option to true to leave that part unchanged. Positive controls such as linkedIndy and chainedControlFlow use true to enable the feature.

### Server-controlled settings

The worker enables bytecode verification, disables application smoke runs and signing, and uses a 90 second engine budget. A separate validation block and a local buildWorkspace are not accepted. Native protection and unsupported advanced options return an error rather than being silently ignored.

### Files and identifiers

Upload the Jar as file and the RR file as config. The returned id identifies that build only. The configHash identifies the uploaded file contents; it is not a configuration ID and is not sent in later uploads. To change protection, edit your RR file and submit both files again.

## The Lithium profile

`format 1;` selects the RR syntax version. `use "lithium";` loads the defaults bundled with your engine. Lithium is a base profile, not a separate configuration file you need to download.

Settings omitted from this file still inherit their values from Lithium. The bundled profile selects Java protection and disables native virtualization. Its defaults can differ between engine versions.

`engine ^` overrides inherited engine settings. The caret is required when replacing a value supplied by the profile. Command line overrides take precedence over the file.

## The extended catolog.rr preset

This extended example contains local engine settings. The API overrides its time budget and safety settings. Download the file or copy it below. For a local build, update `input` and `output` to your Jar paths. The seed is already supplied.

[Download catolog.rr](https://hashisoft.com/presets/catolog.rr)

```rr
format 1;
use "lithium";
project {
    input "hi.jar";
    output "hi-obf.jar";
    seed "96be4325b54ce68bb498693f97c42d82d78d7436e79501f5abd45ece9191befe";
}
engine ^ {
    dictionary "MORVAY_UNICODE";
    skipReflection false;
    skipConstructorIndy false;
    packageRoot "hashira";
    expressionSteps 0;
    expressionClasses 5;
    compactAppearance true;
    decimalAppearance true;
    linkedIndy true;
    chainedControlFlow true;
    aggressiveFlow true;
    bozarFlow true;
    bozarConst true;
    skipFlow false;
    skipString false;
    skipArithmetic false;
    stringProtectionProfile "strong";
    appearanceMethod "";
    appearanceText "اللَّهُ لَا إِلَٰهَ إِلَّا هُوَ الْحَيُّ الْقَيُّومُ ۚ لَا تَأْخُذُهُ سِنَةٌ وَلَا نَوْمٌ ۚ لَهُ مَا فِي السَّمَاوَاتِ وَمَا فِي الْأَرْضِ ۗ مَنْ ذَا الَّذِي يَشْفَعُ عِنْدَهُ إِلَّا بِإِذْنِهِ ۚ يَعْلَمُ مَا بَيْنَ أَيْدِيهِمْ وَمَا خَلْفَهُمْ ۖ وَلَا يُحِيطُونَ بِشَيْءٍ مِنْ عِلْمِهِ إِلَّا بِمَا شَاءَ ۚ وَسِعَ كُرْسِيُّهُ السَّمَاوَاتِ وَالْأَرْضَ ۖ وَلَا يَئُودُهُ حِفْظُهُمَا ۚ وَهُوَ الْعَلِيُّ الْعَظِيمُ";
    writeDiagnostics true;
    signOutput false;
    buildTimeBudgetSeconds 900;
}
```

## What this preset changes

### Project and naming

`input` is the source Jar and `output` is the protected Jar. `seed` supplies the build seed. `dictionary` selects MORVAY_UNICODE and `packageRoot` sets hashira as the renamed package root.

### Control flow and calls

`skipFlow false` enables flow protection. `chainedControlFlow`, `aggressiveFlow` and `bozarFlow` enable the additional flow passes. `linkedIndy true` enables linked dynamic calls. `skipReflection false` and `skipConstructorIndy false` allow their respective reference and constructor call passes.

### Strings and arithmetic

`skipString false` enables string encryption and `stringProtectionProfile "strong"` selects the Strong profile. `skipArithmetic false` enables arithmetic protection and `bozarConst true` enables constant transformation.

`expressionSteps 0` sets expression depth to zero. It does not disable every arithmetic pass. `expressionClasses 5` sets the expression family count independently.

### Appearance and build output

`compactAppearance`, `decimalAppearance`, `appearanceMethod` and `appearanceText` configure generated helper appearance. The text in this preset is a literal appearance value, not a secret or an encryption key.

`writeDiagnostics true` enables build diagnostics. `signOutput false` disables output signing. `buildTimeBudgetSeconds 900` sets the build time budget to 15 minutes.

## Adjusting protection

For skip controls, false enables the pass and true skips it. Positive controls such as linkedIndy use true to enable the feature. Keep these two conventions separate.

Hardening Level ranges from 0 to 5. Expression depth ranges from 0 to 8. These settings control different transformations and are not a single protection score. More aggressive settings can increase output size, build time and runtime cost.

Preserve names used by reflection, frameworks and external callers through exclusions. Native protection requires a matching runtime and toolchain; enabling it changes the deployment requirements.

The protection guides below list individual option names and supported panel values. Their panel defaults are not the resolved Lithium defaults.

[Control Flow](https://hashisoft.com/docs/dashboard/controlflow/introduction)[String Encryption](https://hashisoft.com/docs/dashboard/strings/introduction)[Calls and Arithmetic](https://hashisoft.com/docs/dashboard/calls-and-arithmetic/introduction)[Native Virtualization](https://hashisoft.com/docs/dashboard/native/introduction)[Renaming and Metadata](https://hashisoft.com/docs/dashboard/renaming/introduction)[Runtime Protection](https://hashisoft.com/docs/dashboard/runtime/introduction)[Build Options](https://hashisoft.com/docs/dashboard/build/introduction)

## Using the file with the API

### Prepare your configuration

Save your protection settings in an RR file such as release.rr. The filename is your choice. The supplied catolog.rr is an example you can rename.

### Upload both files

Send your Jar in the file field and your RR file in the config field. No saved configuration ID is required.

### Track the build

Use the returned job ID to check progress and download the protected Jar.

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations" \
  --header "Authorization: Bearer $hashirapikey" \
  --form "file=@hi.jar" \
  --form "config=@release.rr"
```

Each job keeps the uploaded settings. The configHash response field is a SHA256 digest of the uploaded configuration. Editing your local file does not change an existing job.

The remote Java worker accepts UTF8 RR files up to 64 KiB using the Lithium profile. Native protection and unsupported advanced options are rejected. Input and output paths are assigned per job. Verification is enabled and smoke runs and signing are disabled. The engine time budget is 90 seconds.


---

# Build status

Source: https://hashisoft.com/docs/build-status

Look up a build with the job ID returned during submission. Only the account that created the build can access it.

GET`/v1/obfuscations/:id`

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations/$jobId" \
  --header "Authorization: Bearer $hashirapikey"
```

## Build states

`queued`: waiting for a worker

`processing`: the worker is protecting the jar

`completed`: the output is ready to download

`failed`: the build did not complete check the error field

## Response fields

The response includes id, configHash, status, createdAt, completedAt and error. Fields that are not yet available may be omitted.


---

# Download

Source: https://hashisoft.com/docs/download

Download the completed build using the same account credentials used to submit it

GET`/v1/obfuscations/:id/output`

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations/$jobId/output" \
  --header "Authorization: Bearer $hashirapikey" \
  --output hi-obf.jar
```

## Output availability

The response contains the Jar file. An unfinished build returns HTTP 409. Completed jobs expire after about one hour, so download the output before it is removed.


---

# Control flow

Source: https://hashisoft.com/docs/dashboard/controlflow/introduction

Change how branches and loops connect

Eligible methods are rewritten around encoded dispatchers. Use the settings below to select the flow passes and control how much state they generate.

## Configuration

These entries belong in the `engine` block of your RR configuration.

```rr
engine ^ {
  skipFlow false;
  chainedControlFlow true;
  aggressiveFlow true;
}
```

## Start with the default level

Hardening levels range from 0 to 5. A higher level can increase bytecode size and processing cost. Dispatcher state cells control generated state and do not represent a protection score.

## Option reference

For options beginning with `skip`, `false` enables the pass.

### Control Flow Flattening

boolean

`skipFlow`

Rewrites eligible branches and loops around encoded dispatchers. Enabled exports skipFlow false. Methods that exceed size or frame limits may be skipped.

Panel default `false`

### Chained Control Flow

boolean

`chainedControlFlow`

Carries encoded state between transformed blocks. Keep verification enabled and test the resulting application.

Panel default `true`

### Aggressive Control Flow

boolean

`aggressiveFlow`

Uses denser control flow transformations. This can increase build time, output size and runtime overhead.

Panel default `true`

### Opaque Predicates

boolean

`bozarFlow`

Applies the branch transformation pass alongside the selected flow settings.

Panel default `true`

### Encoded Dispatchers

boolean

`skipEncodedDispatcher`

Includes the encoded dispatcher pass. Enabled exports skipEncodedDispatcher false.

Panel default `false`

### Analysis Maze

boolean

`skipAnalysisMaze`

Includes analysis maze transformations where the method passes compatibility checks.

Panel default `false`

### Frame Hardening

boolean

`skipBoundedFrameHardening`

Includes bounded frame hardening. This setting is separate from JVM bytecode verification.

Panel default `false`

### Application Method Flow

boolean

`hashiraHelperAppearance`

Applies the application method appearance pass. Decompiled formatting depends on the tool used.

Panel default `true`

### Dispatcher State Cells

enum

`hashiraStateCells`

Sets the dispatcher state cell count. Larger values can increase generated state and bytecode.

Panel default `64`Values `32 · 64 · 128 · 256 · 512`

### Hardening Level

enum

`decompileHardeningLevel`

Selects a hardening level from 0 to 5. Higher levels can increase output size and processing cost.

Panel default `3`Values `0 · 1 · 2 · 3 · 4 · 5`

## Related guides

[RR configurations ](https://hashisoft.com/docs/configurations)[Submit a build ](https://hashisoft.com/docs/quickstart)


---

# String encryption

Source: https://hashisoft.com/docs/dashboard/strings/introduction

Protect string constants

Select a decoder backend and a protection profile for strings in your application. String protection is independent of call routing and arithmetic mutation.

## Configuration

These entries belong in the `engine` block of your RR configuration.

```rr
engine ^ {
  skipString false;
  nativeStringVault false;
  stringProtectionBackend "java-heterogeneous";
}
```

## Choose a backend and profile

Use java-heterogeneous for Java decoders or legacy for the older backend. Normal, Strong and Critical select different protection profiles. Higher settings can add work during startup and string decoding.

Native profiles are not supported by the remote Java worker.

## Option reference

For options beginning with `skip`, `false` enables the pass.

### String Encryption

boolean

`skipString`

Protects string constants. Enabled exports skipString false. Disabling it also disables enhanced string protection.

Panel default `false`

### Enhanced String Encryption

boolean

`nativeStringVault`

Selects the native string vault and enables Native VM. A matching native target and runtime are required.

Panel default `false`

### Encryption Backend

enum

`stringProtectionBackend`

Java uses heterogeneous Java decoders. Legacy selects the older backend. Native requires Native VM and the string vault.

Panel default `java-heterogeneous`Values `java-heterogeneous · legacy · native`

### Encryption Level

enum

`stringProtectionProfile`

Selects Normal, Strong or Critical string protection. Test startup time and string-heavy code with the selected profile.

Panel default `strong`Values `normal · strong · critical`

### Preserved class strings

boolean

`encryptPreservedClassStrings`

Allows string transformations in classes whose names are preserved. Check reflection and framework integrations.

Panel default `false`

## Related guides

[RR configurations ](https://hashisoft.com/docs/configurations)[Submit a build ](https://hashisoft.com/docs/quickstart)


---

# Calls and arithmetic

Source: https://hashisoft.com/docs/dashboard/calls-and-arithmetic/introduction

Protect calls and calculations

Configure InvokeDynamic routing, reference protection and instruction mutation. Each pass has its own control so you can enable only the transformations your application needs.

## Configuration

These entries belong in the `engine` block of your RR configuration.

```rr
engine ^ {
  linkedIndy true;
  skipReflection false;
  skipConstructorIndy false;
}
```

## Keep the JVM target in mind

The condy backend requires ConstantDynamic support on the target JVM. Expression depth and expression families control different parts of arithmetic generation. Increasing either can add bytecode and execution cost.

## Option reference

For options beginning with `skip`, `false` enables the pass.

### InvokeDynamic Obfuscation

boolean

`linkedIndy`

Enables linked InvokeDynamic protection. Constants, references and constructors have separate controls.

Panel default `true`

### Reference Encryption

boolean

`skipReflection`

Protects supported method and field references. Enabled exports skipReflection false.

Panel default `false`

### Constructor calls

boolean

`skipConstructorIndy`

Transforms supported constructor calls through InvokeDynamic. JVM initialization rules can exclude individual call sites.

Panel default `false`

### Distributed bootstrap

boolean

`skipDistributedReferenceBootstrap`

Includes distributed bootstrap generation for supported references.

Panel default `false`

### Reference protocols

boolean

`referenceProtocols`

Enables the reference protocol option. Constant backend selection remains independent.

Panel default `true`

### Caller metadata flow

boolean

`callerMetadataFlow`

Includes caller metadata in supported call transformations. Coverage depends on the selected engine profile.

Panel default `true`

### Constant backend

enum

`constantBackend`

Selects InvokeDynamic compatibility mode or ConstantDynamic. The target JVM must support the chosen backend.

Panel default `indyCompat`Values `indyCompat · condy`

### Constant transformation

boolean

`bozarConst`

Transforms numeric constants. Constant-only expressions may still be simplified by analysis tools.

Panel default `true`

### Instruction Mutation

boolean

`skipArithmetic`

Replaces supported arithmetic instructions with equivalent bytecode sequences.

Panel default `false`

### Chained MBA

boolean

`chainedMba`

Enables chained mixed Boolean arithmetic. Flow and InvokeDynamic are configured separately.

Panel default `true`

### Expression depth

enum

`expressionSteps`

Sets expression depth from 0 to 8. Increasing depth can increase bytecode size and execution cost.

Panel default `0`Values `0 · 1 · 2 · 3 · 4 · 5 · 6 · 7 · 8`

### Expression families

enum

`expressionClasses`

Sets the number of expression families from 0 to 6. This is separate from expression depth.

Panel default `5`Values `0 · 1 · 2 · 3 · 4 · 5 · 6`

### Selective inlining

boolean

`skipSelectiveInlining`

Includes selective inlining at supported call sites.

Panel default `false`

## Related guides

[RR configurations ](https://hashisoft.com/docs/configurations)[Submit a build ](https://hashisoft.com/docs/quickstart)


---

# Native virtualization

Source: https://hashisoft.com/docs/dashboard/native/introduction

Configure native protection

Select the native backend, runtime target and method coverage for a local build. Native protection requires a matching runtime for the platform that runs your application.

## Configuration

These entries belong in the `engine` block of your RR configuration.

```rr
engine ^ {
  nativeVm.enabled false;
  nativeVm.backend "legacy";
  nativeTarget "windows-x86_64";
}
```

## Select the runtime first

Native options take effect when Native VM is enabled. Prebuilt mode uses an existing runtime. Per-build compilation requires a compatible native compiler toolchain.

Native profiles are not supported by the remote Java worker.

## Option reference

### Native VM

boolean

`nativeVm.enabled`

Enables native virtualization. Other native settings remain inactive until this is enabled. Remote Java builds do not support native profiles.

Panel default `false`

### VM backend

enum

`nativeVm.backend`

Selects Legacy, C or C++ virtualization. The C and C++ selections export as vm.c and vm.cpp.

Panel default `legacy`Values `legacy · vm.c · vm.cpp`

### Target

string

`nativeTarget`

Sets the platform on which the protected application will run. Native runtimes must match this target.

Panel default `windows-x86_64`

### Compile mode

enum

`nativeCompileMode`

Prebuilt uses an existing runtime. Per build requires a compatible native compiler toolchain.

Panel default `prebuilt`Values `prebuilt · per-build-minimal`

### Automatic method selection

boolean

`autoVmProtect`

Enables automatic native method selection. Method compatibility checks still apply.

Panel default `true`

### Full native dispatch

boolean

`nativeFullDispatch`

Enables full dispatch for the selected native backend.

Panel default `true`

### Native control flow

boolean

`nativeControlFlow`

Enables native control flow transformations independently of Java control flow.

Panel default `true`

### Native flow level

enum

`nativeControlFlowLevel`

Sets the native flow level from 0 to 3. Requires Native VM.

Panel default `2`Values `0 · 1 · 2 · 3`

### Per method opcode domains

boolean

`nativeOpcodeRekey`

Uses per-method opcode domains in supported native virtualization paths.

Panel default `true`

### Polymorphic helpers

boolean

`nativePolymorphicHelpers`

Enables polymorphic generation of supported native helpers.

Panel default `true`

### Inline static closure

boolean

`nativeVm.inlineStaticClosure`

Includes static closure inlining in the native selection process. Review actual coverage in the build report.

Panel default `false`

### Public methods

boolean

`vmProtectPublic`

Allows public methods to be considered for native protection. Test public API compatibility.

Panel default `false`

### Private methods

boolean

`vmProtectPrivate`

Allows private methods to be considered for native protection. Other eligibility checks still apply.

Panel default `false`

### Object allocation

boolean

`vmAllowObjectAllocation`

Allows supported object allocation operations during native method selection.

Panel default `false`

### Constructor calls

boolean

`vmAllowConstructorCalls`

Allows supported constructor calls during native method selection.

Panel default `false`

### Instance fields

boolean

`vmAllowInstanceFields`

Allows supported instance field operations during native method selection.

Panel default `false`

### VM string vault

boolean

`nativeVmStringVault`

Enables the VM string vault option. This is distinct from Enhanced String Encryption.

Panel default `false`

### Native critical operations

boolean

`nativeCriticalOperations`

Enables supported native protection for critical operations.

Panel default `false`

### Require selected coverage

boolean

`hybridRequireNativeCoverage`

Requires the selected native coverage policy. The build can fail when that coverage cannot be achieved.

Panel default `false`

### Fail closed

boolean

`privateFailClosed`

Stops the build when the required private protection cannot be completed.

Panel default `true`

### Randomize runtime names

boolean

`randomizeVmRuntimeNames`

Randomizes generated VM runtime names. Keep the runtime and classes from the same build together.

Panel default `true`

### Overhead budget

number

`nativeOverheadBudget`

Sets the native overhead budget from 0 to 1000. It is a selection budget, not a runtime performance guarantee.

Panel default `40`Range `0–1000`

### Minimum protected methods

number

`nativeRequiredMinMethods`

Requires at least the specified number of protected methods. Review the build report for actual coverage.

Panel default `0`Range `0–100000`

## Related guides

[RR configurations ](https://hashisoft.com/docs/configurations)[Submit a build ](https://hashisoft.com/docs/quickstart)


---

# Renaming and metadata

Source: https://hashisoft.com/docs/dashboard/renaming/introduction

Control names and retained metadata

Choose which identifiers and metadata Hashira changes. Preserve names that external code, reflection or framework configuration relies on.

## Configuration

These entries belong in the `engine` block of your RR configuration.

```rr
engine ^ {
  skipNaming false;
  dictionary "MORVAY_UNICODE";
  packageRoot "hashira";
}
```

## Preserve your integration points

Annotations, generic signatures and META-INF resources can be used at runtime. Keep the metadata your application needs and use exclusions for names that must remain stable.

## Option reference

For options beginning with `skip`, `false` enables the pass.

### Identifier renaming

boolean

`skipNaming`

Renames classes and members. Exclude names used by external code, reflection or framework configuration.

Panel default `false`

### Dictionary

string

`dictionary`

The naming dictionary is fixed to MORVAY_UNICODE in this panel.

Panel default `MORVAY_UNICODE`

### Package root

string

`packageRoot`

The generated package root is fixed to hashira in this panel.

Panel default `hashira`

### Compact appearance

boolean

`compactAppearance`

Enables compact appearance processing. Different decompilers can render the same bytecode differently.

Panel default `true`

### Decimal appearance

boolean

`decimalAppearance`

Enables decimal appearance processing. Decompilers may still choose their own numeric formatting.

Panel default `true`

### Polymorphic Metadata

boolean

`skipPolymorphicMetadata`

Includes polymorphic metadata generation. Enabled exports the skip option as false.

Panel default `false`

### Remove annotations

boolean

`stripAnnotations`

Removes supported annotations. Preserve classes that require runtime annotations.

Panel default `false`

### Keep generics

boolean

`keepGenerics`

Preserves generic signature information where supported. Reflection and serializers may depend on it.

Panel default `false`

### Preserve META INF

boolean

`preserveMetaInf`

Preserves META-INF content. Test manifest entries, service providers and resource loading.

Panel default `true`

## Related guides

[RR configurations ](https://hashisoft.com/docs/configurations)[Submit a build ](https://hashisoft.com/docs/quickstart)


---

# Runtime protection

Source: https://hashisoft.com/docs/dashboard/runtime/introduction

Add runtime checks

Configure debugger guards, integrity checks and class protection. These controls affect the protected application at runtime and remain separate from build-time bytecode verification.

## Configuration

These entries belong in the `engine` block of your RR configuration.

```rr
engine ^ {
  antiDebug false;
  selfVerify true;
  runtimeIntegrity false;
}
```

## Choose checks for your environment

Debugger guards can affect diagnostics and development tools. Integrity checks can reject changes made after protection. Enable the checks that match how you distribute and run your application.

## Option reference

### Anti Debug Injection

boolean

`antiDebug`

Injects runtime debugger checks. Test compatibility with diagnostics and the intended release environment.

Panel default `false`

### Integrity Verification

boolean

`selfVerify`

Enables engine self-verification. Repacking protected output can affect integrity checks.

Panel default `true`

### Runtime integrity

boolean

`runtimeIntegrity`

Enables runtime integrity checks independently of self-verification.

Panel default `false`

### Runtime anti analysis

boolean

`runtimeAntiAnalysis`

Enables runtime analysis guards. Test compatibility with monitoring and diagnostic tools.

Panel default `false`

### Native guard

boolean

`nativeGuard`

Enables the native guard. A matching native runtime is required.

Panel default `false`

### Class Encryption

boolean

`classEncryption`

Enables class encryption in supported profiles. Test class loading with the packaged runtime.

Panel default `false`

## Related guides

[RR configurations ](https://hashisoft.com/docs/configurations)[Submit a build ](https://hashisoft.com/docs/quickstart)


---

# Build options

Source: https://hashisoft.com/docs/dashboard/build/introduction

Control build output

Configure diagnostics, verification and optional post-build tasks. The build report records the transformations applied and any methods the engine skips.

## Configuration

These entries belong in the `engine` block of your RR configuration.

```rr
engine ^ {
  writeDiagnostics true;
  skipVerify false;
  smokeRun false;
}
```

## Local and remote builds

The remote Java worker enables bytecode verification and disables smoke runs and output signing. Local builds use the settings supported by your engine distribution.

## Option reference

For options beginning with `skip`, `false` enables the pass.

### Build reports

boolean

`writeDiagnostics`

Writes transformation counts, skipped sites and failure details to the build report.

Panel default `true`

### Verify bytecode

boolean

`skipVerify`

Controls bytecode verification. Keep verification enabled. Application behavior still requires runtime testing.

Panel default `false`

### Smoke test

boolean

`smokeRun`

Runs the output application as a smoke test. Requires an entry point and dependencies. Remote builds always disable this option.

Panel default `false`

### Sign output

boolean

`signOutput`

Requests output signing. Signing material must be provided separately. Remote builds disable signing.

Panel default `false`

### Time budget in seconds

number

`buildTimeBudgetSeconds`

Sets the engine time budget in seconds. Remote builds enforce a separate processing limit.

Panel default `900`Range `1–86400`

## Related guides

[RR configurations ](https://hashisoft.com/docs/configurations)[Submit a build ](https://hashisoft.com/docs/quickstart)


---

# Advanced options

Source: https://hashisoft.com/docs/advanced

These additional identifiers are recognized by the bundled RR schema. Availability depends on the selected backend.

`accessTransformer``adversarialReleaseGate``arenaDecoyBudgetBytes``arenaDecoySurface``arenaPackage``arenaPoison``arenaPoisonBudgetBytes``artifactSignature``autoRepairOnSmokeFail``autoRepairOnVerifyFail``bogusVmName``bootstrapDiskExtraction``bootstrapMode``bootstrapStageAead``bootstrapVisibleStages``bozarCrasher``brandDecoyDensity``brandDecoys``buildChannel``buildTimeBudget``buildWorkspace``carrierKeyPolicy``carrierMode``carrierOnlineUnsealEnabled``carrierTempExtraction``changeLog``classFolder``closedDomain``constPoolClassName``constPoolResource``controlFlow``crashAllClasses``crashRelocatePackage``customTransformerJar``decompileHardening``decoyClass``decoyPackage``destroyCrashedBytecode``distributionOutput``dynamicConstants``fabricEntrypointNamesOnly``fieldReferenceEncryption``flowLevel``hardCrashAllClasses``helperlessJava``hybridMaxMethodsPerClass``hybridMinInstructions``hybridProtectExplicitOnly``hybridProtection``hybridSelection``innerClassRemover``integrityVerifierName``javaHardening``javaHardeningArithmetic``javaHardeningFlowLevel``javashroudEngine``layers``legacyShellBozar``lineNumberTransformer``liveOperandMba``localVariableTransformer``lockHwid``lookalikeIlWeight``lookalikeO0Weight``manualPeMapping``mbaIntensity``nativeCompiler``nativeDomainBackend``nativeExportPolicy``nativeLiftOnly``nativeMaxBinaryBytes``nativeOpcodeDomain``nativePayloadMaxRatio``nativeProgramStorage``nativeRecordLayout``nativeSignerThumbprint``nativeStringVaultOnly``nativeSuperOps``nativeTimestampUrl``nativeVmBackendPolicy``nativeVmRequireNativeResolver``nativeVmRequireProgramRecords``nativeVmResource``hashiraHelperName``nopRemover``numberObfuscation``opaquePredicates``oracleSensitive``parserPoisonBudgetBytes``payloadSeal``preferredClassNames``preserveClass``preserveFieldNames``primaryVmPackage``privateArtifactId``privateContextStrings``privateLicensePublicKey``privateNativeGuard``privateVmFactory``privateVmFactorySeed``ramWorkspaceRoot``referenceEncryption``referenceImportanceClassifier``renameClassMaxLength``renameClassMinLength``renameDictionaryFile``renameMemberMaxLength``renameMemberMinLength``renamer``resourceEncryption``runtimeAutoRepair``runtimeDecoyPackage``runtimePayloadStage2``runtimeSilentSabotage``runtimeWritePolicy``seedDictionaryLayout``shuffleMembers``sidecarBootstrapClassName``skipStringObfuscation``skipToolTargetedCrasher``smokeArgs``smokeExpectExit``smokeInput``smokeJavaArgs``smokePassOutputContains``smokeTimeoutSeconds``sourceTransformer``strengthMode``stringCallOptimizer``stringEncryption``stringFamily``stringPolicy``stringProtection.backend``stringProtection.profile``surfaceMode``visualAsciiJunk``vmBlockInfoName``vmChunkReaderName``vmInterpreterName``vmProgramResource``vmExtension``vmProtection``workspacePolicy``appearanceMethod``appearanceText`


---

# Create a build

Source: https://hashisoft.com/docs/create-job

Upload a compiled Jar using multipart form data. A successful request returns HTTP 202 with the new build record.

POST`/v1/obfuscations`

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations" \
  --header "Authorization: Bearer $hashirapikey" \
  --form "file=@hi.jar" \
  --form "config=@release.rr"
```

## Request body

`file`: Required Jar file, up to 32 MiB

`config`: Required UTF8 RR file up to 64 KiB with the Lithium profile

Include each field once. Additional fields are rejected. Let your multipart client set the Content-Type header and boundary.


---

# Get a build

Source: https://hashisoft.com/docs/get-job

Look up a build with the job ID returned during submission. Only the account that created the build can access it.

GET`/v1/obfuscations/:id`

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations/$jobId" \
  --header "Authorization: Bearer $hashirapikey"
```

## Build states

`queued`: waiting for a worker

`processing`: the worker is protecting the jar

`completed`: the output is ready to download

`failed`: the build did not complete check the error field

## Response fields

The response includes id, configHash, status, createdAt, completedAt and error. Fields that are not yet available may be omitted.


---

# Download output

Source: https://hashisoft.com/docs/get-output

Download the completed build using the same account credentials used to submit it

GET`/v1/obfuscations/:id/output`

```bash
curl --fail-with-body "https://api.hashisoft.com/v1/obfuscations/$jobId/output" \
  --header "Authorization: Bearer $hashirapikey" \
  --output hi-obf.jar
```

## Output availability

The response contains the Jar file. An unfinished build returns HTTP 409. Completed jobs expire after about one hour, so download the output before it is removed.


---

# Errors and limits

Source: https://hashisoft.com/docs/errors

Check the HTTP status and error field before retrying a request.

## Limits

Jar uploads are limited to 32 MiB and RR files to 64 KiB. Output files are limited to 512 MiB. Each account can have one queued or processing build at a time.

## Common responses

`400`: invalid request body jar or configuration

`404`: the job is not available to your account

`409`: the output is not ready

`413`: the upload exceeds the request limit

`429`: the build queue is full wait before submitting again

`503`: the build worker is unavailable