Obfuscation (software)

For the term as used in natural language, seeobfuscation.

Insoftware development,obfuscationis the act of creatingsourceormachine codethat is difficult for humans or computers to understand. Likeobfuscationinnatural language,it may use needlessly roundabout expressions to compose statements. Programmers may deliberately obfuscate code to conceal its purpose (security through obscurity) or its logic or implicit values embedded in it, primarily, in order to prevent tampering, deterreverse engineering,or even to create apuzzleor recreational challenge for someone reading the source code. This can be done manually or by using an automated tool, the latter being the preferred technique in industry.

Overview

The architecture and characteristics of some languages may make them easier to obfuscate than others.C,C++,and thePerlprogramming languageare some examples of languages easy to obfuscate.Haskellis also quite obfuscatabledespite being quite different in structure.

The properties that make a language obfuscatable are not immediately obvious.

Techniques

Types of obfuscations include simple keyword substitution, use or non-use of whitespace to create artistic effects, and self-generating or heavily compressed programs.

According toNick Montfort,techniques may include:

1. naming obfuscation, which includes naming variables in a meaningless or deceptive way;
2. data/code/comment confusion, which includes making some actual code look like comments or confusing syntax with data;
3. double coding, which can be displaying code in poetry form or interesting shapes.

Automated tools

A variety of tools exist to perform or assist with code obfuscation. These include experimental research tools created by academics, hobbyist tools, commercial products written by professionals, andopen-source software.Deobfuscation tools also exist that attempt to perform the reverse transformation.

Although the majority of commercial obfuscation solutions work by transforming either program source code, or platform-independent bytecode as used byJavaand.NET,there are also some that work directly on compiled binaries.

• SomePythonexamples can be found in theofficial Python programming FAQand elsewhere.
• ThemovfuscatorCcompilerfor thex86_32 ISAuses only themovinstruction in order to obfuscate.

Recreational

Writing and reading obfuscated source code can be abrain teaser.A number of programming contests reward the most creatively obfuscated code, such as theInternational Obfuscated C Code Contestand theObfuscated Perl Contest.

Short obfuscatedPerlprograms may be used insignaturesof Perl programmers. These are JAPHs ( "Just another Perl hacker").

Cryptographic

Further information:Indistinguishability obfuscationandBlack-box obfuscation

Cryptographers have explored the idea of obfuscating code so that reverse-engineering the code iscryptographicallyhard. This is formalized in the many proposals forindistinguishability obfuscation,a cryptographic primitive that, if possible to build securely, would allow one to construct many other kinds of cryptography, including completely novel types that no one knows how to make. (A stronger notion,black-box obfuscation,is known to be impossible in general.)

Disadvantages of obfuscation

• While obfuscation can make reading, writing, and reverse-engineering a program difficult and time-consuming, it will not necessarily make it impossible.
• It adds time and complexity to the build process for the developers.
• It can make debugging issues after the software has been obfuscated extremely difficult.
• Once code is no longer maintained, hobbyists may want to maintain the program, add mods, or understand it better. Obfuscation makes it hard for end users to do useful things with the code.
• Certain kinds of obfuscation (i.e. code that isn't just a local binary and downloads mini binaries from a web server as needed) can degrade performance and/or require Internet.

Notifying users of obfuscated code

Some anti-virus softwares, such asAVG AntiVirus,will also alert their users when they land on a website with code that is manually obfuscated, as one of the purposes of obfuscation can be to hide malicious code. However, some developers may employ code obfuscation for the purpose of reducing file size or increasing security. The average user may not expect their antivirus software to provide alerts about an otherwise harmless piece of code, especially from trusted corporations, so such a feature may actually deter users from using legitimate software.

Mozilla and Google disallow browser extensions containing obfuscated code in their add-ons store.

Obfuscation and copyleft licenses

There has been debate on whether it is illegal to skirtcopyleftsoftware licensesby releasing source code in obfuscated form, such as in cases in which the author is less willing to make the source code available. The issue is addressed in theGNU General Public Licenseby requiring the "preferred form for making modifications" to be made available.The GNU website states "Obfuscated 'source code' is not real source code and does not count as source code."

Decompilers

Adecompilercan reverse-engineer source code from an executable or library. Decompilation is sometimes called a man-in-the-end (mite) attack, based on the traditional cryptographic attack known as "man-in-the-middle".It puts source code in the hands of the user, although this source code is often difficult to read. The source code is likely to have random function and variable names, incorrect variable types, and use different logic than the original source code (due to compiler optimizations).

Model obfuscation

Model obfuscationis a technique to hide the internal structure of amachine learningmodel.Obfuscation turns a model into a black box. It is contrary toexplainable AI.Obfuscation models can also be applied to training data before feeding it into the model to add random noise. This hides sensitive information about the properties of individual and groups of samples.

See also

• AARD code
• Spaghetti code
• Decompilation
• Esoteric programming language
• Quine
• Overlapping instructions
• Polymorphic code
• Hardware obfuscation
• Underhanded C Contest
• Source-to-source compiler
• ProGuard (Java Obfuscator)
• Dotfuscator (.Net Obfuscator)
• Digital rights management
• Indistinguishability obfuscation
• Source code beautification

Further reading

• Seyyedhamzeh, Javad,ABCME: A Novel Metamorphic Engine,17th National Computer Conference, Sharif University of Technology, Tehran, Iran, 2012.
• B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan and K. Yang."On the (Im)possibility of Obfuscating Programs".21st Annual International Cryptology Conference,Santa Barbara, California, USA. Springer Verlag LNCS Volume 2139, 2001.
• Mateas, Michael; Nick Montfort."A Box, Darkly: Obfuscation, Weird Languages, and Code Aesthetics"(PDF).Proceedings of the 6th Digital Arts and Culture Conference, IT University of Copenhagen, 1–3 December 2005.pp. 144–153.Archived(PDF)from the original on June 23, 2008.RetrievedJune 28,2008.

External links

• The International Obfuscated C Code Contest
• Protecting Java Code Via Code Obfuscation,ACM Crossroads, Spring 1998 issue
• Can we obfuscate programs?
• Yury Lifshits. Lecture Notes on Program Obfuscation (Spring'2005)
• Java obfuscatorsatCurlie
• c2:BlackBoxComputation