Code Obfuscation
When it comes to security of an application, Source code piracy is one of the major concerns. If your source code is available to hackers, it means you are totally screwed. Hackers can then easily bypass your applied security controls, re-build application with malicious code snippets and also misuse the business logic used in the application.
Obfuscation is the process of renaming the meta-data in an Assembly so that it is no longer useful to a hacker, but remains usable to the machine for executing the intended operations. It does not modify the actual instructions or mask them from observation by a hacker. Reverse engineering of your proprietary applications by unfair competition or malicious hackers may result in highly undesirable exposure of your algorithms and ideas, proprietary data formats, licensing and security mechanisms, and, most importantly, your customers' data.
Getting into more details about Code Obfuscation as given below.
Name Obfuscation:
Name obfuscation changes the name of your classes and methods to unreadable characters, making your code harder to understand. Name obfuscation makes the decompiled source harder to understand but the overall flow of the code is not obscured.
String Encryption:
Managed software stores all the strings in one place and in a clear structure. This makes it easy to find the strings in a decompiled assembly. By following the references to these strings, it may be possible to understand the purpose of your code, even after obfuscation. String encryption works by moving all user strings to an encrypted block of storage. When needed, the runtime executive decrypts the string in memory.
Control Flow Obfuscation:
Control flow obfuscation is about modifying the program so that it yields the same result when run, but is impossible to decompile into a well-structured source code and is more difficult to understand. Most code obfuscators would replace MSIL instructions produced by a .NET compiler with gotos and other instructions that may not be decompiled into valid source code.
Code Encryption:
Code encryption protects the MSIL instructions by encrypting them and stripping the original instructions from the assembly, encrypted instructions are kept in a secure storage. When the assembly is loaded a native runtime executive assumes control of portions of the .NET runtime and manages decrypting the MSIL as needed.
Code Virtualization:
Code virtualization converts your MSIL code into Virtual Op-codes that will only be understood by a secure Virtual machine. As opposed to protecting MSIL code through encryption where the encrypted code must be decrypted back into MSIL before it can be executed by the CLR, Code Virtualization use a virtual machine which directly processes the protected code in the form of a virtual machine language. Code virtualization feature is by far the strongest protection method available in code protection arena today as it implements a one-way code transformation, code is never translated back to its original form, and instead the virtual machine emulates the original code behavior. Code Virtualization can significantly degrade performance if used unwisely and make debugging very difficult.
Debug info obfuscation:
By default, the javac compiler writes source file names and, optionally, line number information (with -g option) to the resulting class files. Those are required to get meaningful stack traces. An obfuscator may remove that information altogether, or change file names to meaningless strings. If you rely on stack traces when resolving customer issues, make sure your obfuscator comes with a reverse mapping utility that can reconstruct the original stack trace with un-obfuscated names of classes and source files.
Note also that certain third-party libraries and frameworks require stack trace information to function properly. One example is Apache log4j.
Watermarking:
Some obfuscators may embed a hidden customer or distributor ID into your class files, just like in digital media, enabling you to track down software pirates.
Source: https://en.wikipedia.org/
Comments
Post a Comment