Obfuscation Aparna Belhe CS795 What is Obfuscation u

Obfuscation Aparna Belhe CS-795

What is Obfuscation? u Dictionary Meaning: To confuse, to make obscure a problem with extraneous information, to darken. -www. dictionary. com u Obfuscation in. Net: - Technology of shrouding the facts. - Removes context from compiled code that humans (and reverse-engineering tools) would use to decipher the code's meaning.

. NET Software Development Lifecycle 2 1 4 Design Develop and Build Deploy Test 3 Protect

Why Obfuscation? u u . Net Programs compiled in MSIL, which is at a higher level than binary machine code. So. Net Programs are easy to reverse engineer using decompilation. MSIL Disassembler (ILDasm) installed in the. Net Framework SDK can be used. Anyone can peruse the details of the software.

Why Obfuscation ctd…. u u Obfuscation uses various methods to foil decompilers Obfuscation is different from Encryption.

Goal – Create Confusion!! u u u Not only will the output confuse a human interpreter, it was also break a decomliper. Forward logic is preserved, reverse semantics are rendered non-deterministic. Creates decompilation possibilities which produce incorrect logic if recompiled.

Dotfuscator u u Acts obfuscator, pruner, linker, and watermarker for. NET applications. Obfuscation is applied to MSIL and not source code. Obfuscated code is functionally equivalent to traditional MSIL. It executes on CLR with similar results.

Dotfuscator features 1. Renaming : - Uses a patented Overload-Induction renaming system. - Renames as many methods as possible to a same name. - Effective than renaming to unprintable characters. - Saves space as short names used for renaming.

Renaming Example Original Source Code Before Obfuscation private void Calc. Payroll(Special. List employee. Group) { while (employee. Group. Has. More()) { employee = employee. Group. Get. Next(true); employee. Update. Salary(); Distribute. Check(employee); } } Reverse-Engineered Source Code After Overload Induction Dotfuscation private void a(a b) { while (b. a()) { a = b. a(true); a. a(); a(a); } }

Dotfuscator Features ctd… 2. String Encryption: Strings in sensitive part of the code are encrypted. 3. Control Flow Obfuscation: - Introduces false conditions and misleading constructs in decompiled code. Example: Before Control Flow Obfuscation public int Compare. To(Object o) { int n = occurrences – ((Word. Occurrence)o). occurrences; if (n == 0) { n = String. Compare(word, ((Word. Occurrence)o). word); } return(n); }

Reverse Engineered Source Code after Control Flow Obfuscation public virtual int _a(Object A_0) { int local 0, local 1; local 0 = this. a – (c) A_0. a; if (local 0 != 0) goto i 0; goto i 1; while (true) { return local 1; i 0: local 1 = local 0; } i 1: local 0 = System. String. Compare(this. b, (c) A_0. b); goto i 0; }

4. Pruning: - Determines unused types, methods and fields. - Uses “triggers” for this determination. - Helps reduce size of the assembly. 5. Assembly Linking: - Links multiple assemblies into one or more output assemblies. 6. Watermarking: - Embeds data (copyright info/unique nos. ) into applications, making them unique.

7. Incremental Obfuscation: - Useful when a bug is found in the code, but it is obfuscated. - Confidential Map file created to inform how renaming was done. - Match the mapfile against the stack trace. - Mapfile can be used as input to Dotfuscator on subsequent runs to dictate that renames used previously should be used again wherever possible. - Use the re-created patched modules.

Demonstration

Drawbacks u u u Maintaining and Troubleshooting becomes difficult. Bug Reports are rendered useless. Hampers the debugging process, as obfuscation alters MSIL.

Conclusion Obfuscation is not 100 percent protection. u If a hacker is perseverant enough, they can find the meaning of your code. u The goal of obfuscation is to make the reverse engineering process extremely time consuming and painful so that it not worth the effort. u The goal is to stop all casual hackers and as many serious hackers as possible. u

References Professional Visual Studio 2005 – Andrew Parsons and Nick Randolph. u http: //aspnet. 4 guysfromrolla. com u http: //www. preemptive. com u http: //msdn 2. microsoft. com/enus/library/ms 227295(VS. 80). aspx u

THANK YOU !!