SQL Tamper Framework documentation
The Transformation Module System
1 min read
Transformations in the framework are modular and composed as rules, which is the design decision that lets the technique library grow quickly. The Transformer (tamper_framework/transformer.py) applies a set of TransformationRule objects, each declaring a name, a transform_func(token, context), the target_types it applies to (e.g. TokenType.OPERATOR), and the allowed_clauses it is permitted to fire in. Rules are added to a SQLTransformer with add_rule(...), and transform(sql) runs them with reapplication protection so a token is not transformed twice.
The core module set (v2.0.0) is keyword_wrap (MySQL version-comment wrapping), space_replace (spaces to /**/), case_alternate (alternating case), and value_encode (context-aware operator URL encoding). The advanced set (v2.1.0) adds homoglyph (Unicode lookalikes), function_wrap (IF()/CASE), numeric_obfuscation (hex/float/math numbers), comment_chaos (varied comment styles), logical_operator_swap (AND/OR to &&/||), hex_encode (strings to hex), and version_comment_vary (variable MySQL version numbers, deterministically). Because each is an independent module exposing a rule, adding a new evasion technique means writing one file and composing it, not modifying the engine, which is why v2.1.0 could nearly triple the transformation count in a single release.
