Assessment of Source Code Obfuscation Techniques

Abstract

Obfuscation techniques are a general category of software protections widely adopted to prevent malicious tampering of the code by making applications more difficult to understand and thus harder to modify. Obfuscation techniques are divided in code and data obfuscation, depending on the protected asset. While preliminary empirical studies have been conducted to determine the impact of code obfuscation, our work aims at assessing the effectiveness and efficiency in preventing attacks of a specific data obfuscation technique - VarMerge. We conducted an experiment with student participants performing two attack tasks on clear and obfuscated versions of two applications written in C. The experiment showed a significant effect of data obfuscation on both the time required to complete and the successful attack efficiency. An application with VarMerge reduces by six times the number of successful attacks per unit of time. This outcome provides a practical clue that can be used when applying software protections based on data obfuscation.Comment: Post-print, SCAM 201

GLObfus: An Enhanced Data Security Method to Protect Numerical Data in Public Cloud Storage

“…Alessio Viticchi et al [12] Obfuscation technique is normally used in software protection for hiding the software development codes. Dividing it into two major parts -code obfuscation and data obfuscation.…”

[Research Paper] Obfuscating Java Programs by Translating Selected Portions of Bytecode to Native Libraries

“…Other properties of translated/obfuscated code, such us how harder it is to understand and to attack, are out of the scope of the present paper. To investigate these properties, human studies and controlled experiment are required, and we are planning and conducting them as part of our research activity [5], [24], [6] A. Case Studies…”

How Professional Hackers Understand Protected Code while Performing Attack Tasks

“…There are two main research approaches for the assessment of obfuscation protection techniques, respectively based on internal software metrics [18], [19], [20], [21], [22], [23] and on experiments involving human subjects [24], [25], [26], [27].…”

“…Ceccato et al [25] measured the correctness and effectiveness achieved by subjects while understanding and modifying decompiled obfuscated Java code, in comparison with decompiled clear code. This work has been extended with a larger set of experiments and additional obfuscation techniques in successive works [26], [27].…”