Obfuscation (software)

Last updated

In software development, obfuscation is the practice of creating source or machine code that is intentionally difficult for humans or computers to understand. Similar to obfuscation in natural language, code obfuscation may involve using unnecessarily roundabout ways to write statements. Programmers often obfuscate code to conceal its purpose, logic, or embedded values. The primary reasons for doing so are to prevent tampering, deter reverse engineering, or to create a puzzle or recreational challenge to deobfuscate the code, a challenge often included in crackmes. While obfuscation can be done manually, it is more commonly performed using obfuscators. [1]

Contents

Overview

The architecture and characteristics of some languages may make them easier to obfuscate than others. [2] [3] C, [4] C++, [5] [6] and the Perl programming language [7] are some examples of languages easy to obfuscate. Haskell is also quite obfuscatable [8] despite being quite different in structure.

The properties that make a language obfuscatable are not immediately obvious.

Techniques

Types of obfuscations include simple keyword substitution, use or non-use of whitespace to create artistic effects, and self-generating or heavily compressed programs.

According to Nick Montfort, techniques may include:

  1. naming obfuscation, which includes naming variables in a meaningless or deceptive way;
  2. data/code/comment confusion, which includes making some actual code look like comments or confusing syntax with data;
  3. double coding, which can be displaying code in poetry form or interesting shapes. [9]

Automated tools

A variety of tools exist to perform or assist with code obfuscation. These include experimental research tools developed by academics, hobbyist tools, commercial products written by professionals, and open-source software. Additionally, deobfuscation tools exist, aiming to reverse the obfuscation process.

While most commercial obfuscation solutions transform either program source code or platform-independent bytecode, i.e. portable code (as used by Java and .NET), some also work directly on compiled binaries.

Recreational

Writing and reading obfuscated source code can be a brain teaser. A number of programming contests reward the most creatively obfuscated code, such as the International Obfuscated C Code Contest and the Obfuscated Perl Contest.

Short obfuscated Perl programs may be used in signatures of Perl programmers. These are JAPHs ("Just another Perl hacker"). [16]

Cryptographic

Cryptographers have explored the idea of obfuscating code so that reverse-engineering the code is cryptographically hard. This is formalized in the many proposals for indistinguishability obfuscation, a cryptographic primitive that, if possible to build securely, would allow one to construct many other kinds of cryptography, including completely novel types that no one knows how to make. (A stronger notion, black-box obfuscation, is known to be impossible in general.) [17] [18]

Disadvantages of obfuscation

Notifying users of obfuscated code

Some anti-virus softwares, such as AVG AntiVirus, [20] will also alert their users when they land on a website with code that is manually obfuscated, as one of the purposes of obfuscation can be to hide malicious code. However, some developers may employ code obfuscation for the purpose of reducing file size or increasing security. The average user may not expect their antivirus software to provide alerts about an otherwise harmless piece of code, especially from trusted corporations, so such a feature may actually deter users from using legitimate software.

Mozilla and Google disallow browser extensions containing obfuscated code in their add-ons store. [21] [22]

Obfuscation and copyleft licenses

There has been debate on whether it is illegal to skirt copyleft software licenses by releasing source code in obfuscated form, such as in cases in which the author is less willing to make the source code available. The issue is addressed in the GNU General Public License by requiring the "preferred form for making modifications" to be made available. [23] The GNU website states "Obfuscated 'source code' is not real source code and does not count as source code." [24]

Decompilers

A decompiler is a tool that can reverse-engineer source code from an executable or library. This process is sometimes referred to as a man-in-the-end (mite) attack, inspired by the traditional "man-in-the-middle attack" in cryptography. The decompiled source code is often hard to read, containing random function and variable names, incorrect variable types, and logic that differs from the original source code due to compiler optimizations.

Model obfuscation

Model obfuscation is a technique to hide the internal structure of a machine learning model. [25] Obfuscation turns a model into a black box. It is contrary to explainable AI. Obfuscation models can also be applied to training data before feeding it into the model to add random noise. This hides sensitive information about the properties of individual and groups of samples. [26]

See also

References

  1. ↑ "What is obfuscation (obfu)? - Definition from WhatIs.com". SearchSoftwareQuality. Archived from the original on February 2, 2019. Retrieved February 1, 2019.
  2. ↑ Binstock, Andrew (March 6, 2003). "Obfuscation: Cloaking your Code from Prying Eyes". Archived from the original on April 20, 2008. Retrieved November 25, 2013.
  3. ↑ Atwood, Jeff (May 15, 2005). "Jeff Atwood, May 15, 2005". Codinghorror.com. Archived from the original on January 9, 2010. Retrieved November 25, 2013.
  4. ↑ "Obfuscation". Kenter.demon.nl. Archived from the original on March 4, 2016. Retrieved November 25, 2013.
  5. ↑ "C++ Tutorials – Obfuscated Code – A Simple Introduction". DreamInCode.net. Archived from the original on June 28, 2008. Retrieved November 25, 2013.
  6. ↑ "C Tutorials – Obfuscated Code in C". July 7, 2011. Archived from the original on December 27, 2013. Retrieved November 25, 2013.
  7. ↑ As of 2013-11-25 18:22 GMT. "Pe(a)rls in line noise". Perlmonks.org. Archived from the original on January 16, 2009. Retrieved November 25, 2013.{{cite web}}: CS1 maint: numeric names: authors list (link)
  8. ↑ "Obfuscation – Haskell Wiki". February 16, 2006. Archived from the original on August 30, 2017. Retrieved March 3, 2020.
  9. ↑ Montfort, Nick. "Obfuscated code" (PDF). Archived from the original (PDF) on April 24, 2019. Retrieved November 24, 2017.
  10. ↑ Ben Kurtovic. "Obfuscating "Hello world!"". benkurtovic.com. Archived from the original on September 14, 2017. Retrieved October 18, 2017.
  11. ↑ "Obfuscated Python". wiki.c2.com. Archived from the original on February 14, 2017. Retrieved October 18, 2017.
  12. ↑ "The First Annual Obfuscated Python Content". code.activestate.com. Archived from the original on May 25, 2023. Retrieved October 18, 2017.
  13. ↑ domas (November 3, 2022), xoreaxeaxeax/movfuscator, archived from the original on November 12, 2022, retrieved November 5, 2022
  14. ↑ Break Me00 The MoVfuscator Turning mov into a soul crushing RE nightmare Christopher Domas, September 25, 2015, archived from the original on October 21, 2022, retrieved November 5, 2022
  15. ↑ Williams, Al (March 21, 2021). "One Instruction To Rule Them All: C Compiler Emits Only MOV". Hackaday . Retrieved October 23, 2023.
  16. ↑ "JAPH – Just Another Perl Hacker". pm.org. Perl Mongers. Archived from the original on May 16, 2013. Retrieved February 27, 2015.
  17. ↑ "Cryptography Breakthrough Could Make Software Unhackable". Wired. ISSN   1059-1028. Archived from the original on April 14, 2022. Retrieved March 14, 2021.
  18. ↑ Jain, Aayush; Lin, Huijia; Sahai, Amit (2020). "Indistinguishability Obfuscation from Well-Founded Assumptions". Cryptology ePrint Archive. arXiv: 2008.09317 . Archived from the original on March 3, 2022. Retrieved March 14, 2021.
  19. ↑ ""Can We Obfuscate Programs?" by Boaz Barak". Math.ias.edu. Archived from the original on March 23, 2016. Retrieved November 25, 2013.
  20. ↑ "Blocking website and only way to fix is disabling HTTPS s... | AVG". support.avg.com. July 21, 2020. Archived from the original on February 4, 2022. Retrieved February 4, 2022.
  21. ↑ at 05:01, Thomas Claburn in San Francisco 2 Oct 2018. "Google taking action against disguised code in Chrome Web Store". www.theregister.co.uk. Archived from the original on November 12, 2019. Retrieved November 12, 2019.{{cite web}}: CS1 maint: numeric names: authors list (link)
  22. ↑ Cimpanu, Catalin. "Mozilla announces ban on Firefox extensions containing obfuscated code". ZDNet. Archived from the original on March 5, 2020. Retrieved November 12, 2019.
  23. ↑ "Reasoning behind the "preferred form of the work for making modifications to it" language in the GPL". Lwn.net. Archived from the original on December 2, 2013. Retrieved November 25, 2013.
  24. ↑ "What is free software?". gnu.org. Archived from the original on October 14, 2013. Retrieved December 18, 2014.
  25. ↑ Zhou, Mingyi; Gao, Xiang; Wu, Jing; Grundy, John C.; Chen, Xiao; Chen, Chunyang; Li, Li (2023). "Model Obfuscation for Securing Deployed Neural Networks".{{cite journal}}: Cite journal requires |journal= (help)
  26. ↑ Zhang, Tianwei; He, Zecheng; Lee, Ruby B. (July 12, 2018). "Privacy-preserving Machine Learning through Data Obfuscation". arXiv: 1807.01860 [cs.CR].

Further reading

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.