Obfuscating software
|
|
Obfuscating software (also known as obfuscators) is software designed to inhibit reverse engineering of software even when source code is available, by converting it to obfuscated code, making the source code far less readable and almost impossible to understand by a human being. Although reverse engineering always existed in computer software, in recent times has it become a significant problem. The exposure is far greater in newer computing environments such as Java and Microsoft's .NET.
Older programs written in C++ or Pascal are compiled into the machine language of a given computer before they become a program. Programmers write "source code", computers run "machine code" so this conversion is necessary. There is (generally) a one way transformation from source code to machine code. Machine code is not encrypted and is easy for anyone to see, but the format is so tedious for humans that reverse-engineering efforts are slow and painful.
Java and .NET languages (C#, Visual Basic, etc) take a different approach to compilation. These languages are highly powerful, flexible and understandable. Unfortunately, the inherent flexibility and understandability present in these languages makes them far easier to reverse engineer because they do not compile to machine code, they compile into intermediate code.
Microsoft recommends using the Script Encoder to obfuscate the ASP files, so in case the web server is compromised, the hacker (or cracker) would be unable to find out how your ASP applications work. The Script Encoder works also on JScript and VBScript files. Note that the encoded JScript is only functional in Internet Explorer. However, in the documentation, it states that "Note that this encoding only prevents casual viewing of your code; it will not prevent the determined hacker from seeing what you've done and how.". In fact, it is indeed possible, as shown by the Windows Script Decoder, created on August 1,2000 by Mr Brownstone.
External links
- Windows Script Encoder (http://www.microsoft.com/downloads/details.aspx?FamilyId=E7877F67-C447-4873-B1B0-21F0626A6329)
- Windows Script Decoder (http://www.virtualconspiracy.com/index.php?page=scrdec/intro)
- Breaking the Windows Script Encoder (http://www.klaphek.nl/nr6/scrdec.html) — The story of breaking the encoder.
- Cracking the Enigma (http://www.preemptive.com/documentation/CrackingtheEnigma.html) — Protecting Intermediate Compiled Applications.