<p>From comments ...</p>

<p>Do you mean <em>relation between code obfuscation and code maintenance</em>?</p>

<p>Obviously good obfuscation means poor maintainability, so an alternate question is: how can a small part of the source code be reobfuscated without having to obfuscate the whole source code again? This leads to: "<em>how can I build an efficient incremental obfuscator</em>?" ... unfortunately obfuscators heavily depend on the target programming languages, so I don't think there are many academic papers on that subject.</p>

<p>However, if you need a more theoretical approach then you can start with a survey on the subject: for example: <a href="http://pages.cs.wisc.edu/~arinib/writeup.pdf" rel="nofollow">Code Obfuscation Literature Survey</a> (with good references at the end). Or look for papers which cite the negative result of Barak et al.: <a href="http://www.iacr.org/archive/crypto2001/21390001.pdf" rel="nofollow">On the (Im)possibility of Obfuscating Programs</a> . </p>

<p>Otherwise - if you are more "code-oriented" - you can search for information (and source code) on how real incremental obfuscators work (.NET obfuscator, ProGuard obfuscator, ...). Some years ago I used ProGuard to obfuscate a Java application (in Netbeans environment); it is an open source project, so you can download the full source code (<a href="http://proguard.sourceforge.net/" rel="nofollow">http://proguard.sourceforge.net/</a>). Incremental obfuscation is obtained keeping a mapping file that allows to mantain classes/variables/methods/etc.etc. names consistent across subsequent builds.</p>

CC BY-SA 3.0
2011-04-19T20:19:29.773Z
The best way to understand the program is to debug it. Do obfuscation tools offer any resilience against debugging?
Tegiri Nenashi
CC BY-SA 3.0
2011-04-19T20:59:37.537Z
@Tegiri ... professional obfuscation tools embed algorithms for runtime decryption of the code (while executing it), usually in combination with an hardware key that contains a microcontroller for "dynamically" serving the decryption key. They also contains stuff to make hard even launching the application with an underlying debugger. But even if you have the (assembler or bytecode) source, understanding and modifying it is VERY hard.
Marzio De Biasi
CC BY-SA 3.0
2011-04-19T21:01:15.123Z
//(continue)...<br>    
#include <stdio.h><br>
#include <math.h><br>
double l;main(_,o,O){return putchar((_--+22&&_+44&&main(_,-43,_),_&&o)?(main(-43,++o,O),((l=(o+21)/sqrt(3-O*22-O*O),l*l<4&&(fabs(((time(0)-607728)%2551443)/405859.-4.7+acos(l/2))<1.57))[" #"])):10);}
//this prints the phase of the moon, can you make it work on the south part of the globe? (<br>=newline)
Marzio De Biasi
CC BY-SA 3.0
2011-04-19T18:27:11.793Z
2011-04-19T18:27:11.793Z
Marzio De Biasi
<p>This is more a software engineering question, but my interest is in the mathematical modeling of the problem. </p>

<p>While there seems to be some literature on the modeling of obfuscation transformation, I'm finding it difficult to locate papers that relates it to code maintenance - guess because they are inherently orthogonal. But its hard to imagine no study has been done by modeling this as an optimization problem. Can anybody point me to any thing that is helpful to get some insight into this?</p>

CC BY-SA 3.0
2011-04-19T16:03:04.747Z
Do you mean relation between code obfuscation and code maintenance? Obviously good obfuscation means poor maintainability, so an alternate question is: how can a small part of the source code be reobfuscated without having to obfuscate the whole source code again? This leads to: "how can I build an efficient incremental obfuscator?" ... unfortunately obfuscators heavily depend on the target programming languages, so I don't think there is many academic papers on it.
Marzio De Biasi
CC BY-SA 3.0
2011-04-19T16:31:38.840Z
@Vor: Thanks for the explanation. So the only way o approach this problem would be to narrow it down to a specific programming language and/or a specific obfuscation transformation?
Tathagata
CC BY-SA 3.0
2011-04-19T16:53:38.427Z
It depends on your objectives. If you need a more theoretical approach the you can start with a survey on the subject: for example: pages.cs.wisc.edu/~arinib/writeup.pdf (with good references at the end). Or look for papers which cite the negative result of Barak et al. (www.iacr.org/archive/crypto2001/21390001.pdf). Otherwise - if you are more "code-oriented" - you can search for information (and source code) on how real incremental obfuscators work (.NET obfuscator, ProGuard obfuscator, ...)
Marzio De Biasi
CC BY-SA 3.0
2011-04-19T17:21:08.890Z
Awesome ... thanks for the references. As far as the "code oriented" aspect of it - are you aware of any open source obfuscation framework? you really should have posted these in the answers ..
Tathagata
CC BY-SA 3.0
2011-04-19T17:53:07.527Z
@Vor, make this an answer ?
Suresh Venkat
CC BY-SA 3.0
2011-04-19T21:21:18.397Z
Is this on-topic? The *maintainability* of software sounds like a topic that is definitely outside the scope of TCS.
Jukka Suomela
<cr.crypto-security><obfuscation>
Obfuscation transformation and code maintainability
Tathagata
# Obfuscation transformation and code maintainability

(Asked by: username_0 on 2011-04-19)

This is more a software engineering question, but my interest is in the mathematical modeling of the problem.

While there seems to be some literature on the modeling of obfuscation transformation, I'm finding it difficult to locate papers that relates it to code maintenance - guess because they are inherently orthogonal. But its hard to imagine no study has been done by modeling this as an optimization problem. Can anybody point me to any thing that is helpful to get some insight into this?

**Tags:** cr.crypto-security, obfuscation
> **Comments:**
> **username_1**: Do you mean relation between code obfuscation and code maintenance? Obviously good obfuscation means poor maintainability, so an alternate question is: how can a small part of the source code be reobfuscated without having to obfuscate the whole source code again? This leads to: "how can I build an efficient incremental obfuscator?" ... unfortunately obfuscators heavily depend on the target programming languages, so I don't think there is many academic papers on it.  
> **username_0**: @Vor: Thanks for the explanation. So the only way o approach this problem would be to narrow it down to a specific programming language and/or a specific obfuscation transformation?  
> **username_1**: It depends on your objectives. If you need a more theoretical approach the you can start with a survey on the subject: for example: pages.cs.wisc.edu/~arinib/writeup.pdf (with good references at the end). Or look for papers which cite the negative result of Barak et al. (www.iacr.org/archive/crypto2001/21390001.pdf). Otherwise - if you are more "code-oriented" - you can search for information (and source code) on how real incremental obfuscators work (.NET obfuscator, ProGuard obfuscator, ...)  
> **username_0**: Awesome ... thanks for the references. As far as the "code oriented" aspect of it - are you aware of any open source obfuscation framework? you really should have posted these in the answers ..  
> **username_2**: @Vor, make this an answer ?  
> **username_3**: Is this on-topic? The *maintainability* of software sounds like a topic that is definitely outside the scope of TCS.  

---

## 1 answers

### Answer by username_1 on 2011-04-19. Score: 5 | Accepted answer

From comments ...

Do you mean *relation between code obfuscation and code maintenance*?

Obviously good obfuscation means poor maintainability, so an alternate question is: how can a small part of the source code be reobfuscated without having to obfuscate the whole source code again? This leads to: "*how can I build an efficient incremental obfuscator*?" ... unfortunately obfuscators heavily depend on the target programming languages, so I don't think there are many academic papers on that subject.

However, if you need a more theoretical approach then you can start with a survey on the subject: for example: [Code Obfuscation Literature Survey](http://pages.cs.wisc.edu/~arinib/writeup.pdf) (with good references at the end). Or look for papers which cite the negative result of Barak et al.: [On the (Im)possibility of Obfuscating Programs](http://www.iacr.org/archive/crypto2001/21390001.pdf) .

Otherwise - if you are more "code-oriented" - you can search for information (and source code) on how real incremental obfuscators work (.NET obfuscator, ProGuard obfuscator, ...). Some years ago I used ProGuard to obfuscate a Java application (in Netbeans environment); it is an open source project, so you can download the full source code (<http://proguard.sourceforge.net/>). Incremental obfuscation is obtained keeping a mapping file that allows to mantain classes/variables/methods/etc.etc. names consistent across subsequent builds.

> **Comments:**
> **username_4**: The best way to understand the program is to debug it. Do obfuscation tools offer any resilience against debugging?  
> **username_1**: @Tegiri ... professional obfuscation tools embed algorithms for runtime decryption of the code (while executing it), usually in combination with an hardware key that contains a microcontroller for "dynamically" serving the decryption key. They also contains stuff to make hard even launching the application with an underlying debugger. But even if you have the (assembler or bytecode) source, understanding and modifying it is VERY hard.  
> **username_1**: //(continue)...<br>     #include <stdio.h><br> #include <math.h><br> double l;main(_,o,O){return putchar((_--+22&&_+44&&main(_,-43,_),_&&o)?(main(-43,++o,O),((l=(o+21)/sqrt(3-O*22-O*O),l*l<4&&(fabs(((time(0)-607728)%2551443)/405859.-4.7+acos(l/2))<1.57))[" #"])):10);} //this prints the phase of the moon, can you make it work on the south part of the globe? (<br>=newline)  

---

