Hybrid Obfuscation Technique to Protect Source Code From Prohibited Software Reverse Engineering

Abstract

In this research, a new Hybrid Obfuscation Technique was proposed to prevent prohibited Reverse Engineering. The proposed hybrid technique contains three approaches; first approach is string encryption. The string encryption is about adding a mathematical equation with arrays and loops to the strings in the code to hide the meaning. Second approach is renaming system keywords to Unicode to increase the difficulty and complexity of the code. Third approach is transforming identifiers to junk code to hide the meaning and increase the complexity of the code. An experiment was conducted to evaluate the proposed Hybrid Obfuscation Technique. The experiment contains two phases; the first phase was conducting reverse engineering against java applications that do not use any protection to determine the ability of reversing tools to read the compiled code. The second phase was conducting reverse engineering against the proposed technique to evaluate the effectiveness of it. The experiment of the hybrid obfuscation technique was to test output correctness, syntax, reversed code errors, flow test, identifiers names test, methods, and classes correctness test. With these parameters, it was possible to determine the ability of the proposed technique to defend the attack. The experiment has presented good and promising results, where it was nearly impossible for the reversing tool to read the obfuscated code. Even the revealed code did not perform as well as original and obfuscated code.

Hybrid Obfuscation of Encryption

“…String obfuscation is very effective in protecting the code from theft. When the string is obfuscated, only the compiler can read and output it, while it becomes unreadable to humans [7].…”

Internet of Things Security Requirements, Threats, Attacks, and Countermeasures

“…The practice of contaminating web applications with malevolent software is termed malware. In Recent Times, a massive number of malwares has been devised for attacking IoT systems [75,76] Control flow side-channel assessment [77], software integrity validation, malware detector [78], Security updates [79] (continued) Reverse Engineering All An attempt to analyze the firmware of IoT devices to reach sensitive data i.e., users' credentials [93] Self-destruction and Tamper proofing, IC/IP Obfuscation and encryption [94,95] (continued) Identity and access management, authentication, multi-factor authentication guidance, dynamic credentials [100] Brute-force attacks S4, S6 An active attack hinges on a trial-and-error strategy to obtain some data such as passwords, finance, identifiers. It employs automatic software to engender a massive amount of successive suppositions to decrypt the ciphertext [85,86] Locking out IP address, discovery tools, brute force site scanning tools [101] Data exposure attacks…”

A Framework to Quantify the Quality of Source Code Obfuscation

“…Both commercial [5,6] and open-source [7,8] obfuscation tools offer a variety of obfuscation techniques. Moreover, the category of researcher-developed obfuscation techniques and tools exhibits a diverse range of characteristics as well [9][10][11][12][13]. However, there are insufficient accurate analysis results regarding the effectiveness of source code obfuscation techniques for each tool; there is also a lack of proven measurement indicators that can quantitatively measure the strength of protection [14,15].…”