Obfuscating Java: The Most Pain for the Least Gain

Batchelder, M.; Hendren, Laurie

doi:10.1007/978-3-540-71229-9_7

Cited by 23 publications

(23 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Deobfuscation attempts to reverse engineer obfuscated code (Udupa et al 2005). Because Java byte code is comparatively high-level and easy to decompile, obfuscation of Java bytecode has focused on preventing decompilation (Batchelder and Hendren 2007) whilst decompilers like Krakatoa (Proebsting and Watterson 1997), Krakatau (Grosse 2016) and Procyon (Strobel 2016) attempt to decompile even in the presence of obfuscation.…”

Section: Related Workmentioning

confidence: 99%

A comparison of code similarity analysers

2017

View full text Add to dashboard Cite

Copying and pasting of source code is a common activity in software engineering. Often, the code is not copied as it is and it may be modified for various purposes; e.g. refactoring, bug fixing, or even software plagiarism. These code modifications could affect the performance of code similarity analysers including code clone and plagiarism detectors to some certain degree. We are interested in two types of code modification in this study: pervasive modifications, i.e. transformations that may have a global effect, and local modifications, i.e. code changes that are contained in a single method or code block. We evaluate 30 code similarity detection techniques and tools using five experimental scenarios for Java source code. These are (1) pervasively modified code, created with tools for source code and bytecode obfuscation, and boiler-plate code, (2) source code normalisation through compilation and decompilation using different decompilers, (3) reuse of optimal configurations over different data sets, (4) tool evaluation using ranked-based measures, and (5) local + global code modifications. Our experimental results show that in the presence of pervasive modifications, some of the general textual similarity measures can offer similar performance to specialised code similarity tools, whilst in the presence of boiler-plate code, highly specialised source code similarity detection techniques and tools outperform textual similarity measures. Our study strongly validates the use of compilation/decompilation as a normalisation technique. Its use reduced false classifications to zero for three of the tools. Moreover, we demonstrate that optimal configurations are very sensitive to a specific data set. After directly applying optimal configurations derived from one data set to another, the tools perform poorly on the new data set. The code similarity analysers are thoroughly evaluated not only based on several well-known pair-based and query-based error measures but also on each specific type of pervasive code modification. This broad, thorough study is the largest in existence and potentially an invaluable guide for future users of similarity detection in source code.

show abstract

Section: Related Workmentioning

confidence: 99%

A comparison of code similarity analysers

2017

View full text Add to dashboard Cite

show abstract

“…Ledoux et al proposed an instruction embedding method to improve instruction overlapping obfuscation [24]. Batchelder et al presented layout obfuscation algorithm to make Java decompilers fail to produce legal source code or crash completely [25].…”

Section: Related Workmentioning

confidence: 99%

An Iteration Obfuscation Based on Instruction Fragment Diversification and Control Flow Randomization

Liu¹,

Xie²,

Lu³

et al. 2016

IJCTE

View full text Add to dashboard Cite

Abstract-As the control flow graph can reflect the logic structure of programs, static and dynamic reverse methods are used to analyze the logic structure and instruction sequence, and the existing methods of control flow obfuscation have low potency to resist reverse attacks. To solve this problem, we propose an obfuscation method based on instruction fragment diversification and control flow randomization, diversified instruction fragments are generated by various equivalent transformation rules, and random functions are used to select one execution path from the multi-way branches of programs, then programs are iteratively obfuscated. Experiments and analysis show that diversified instruction fragments and multi-way branches can increase the difficulty of static reverse analysis, random selection for multi-way branches will increase the difficulty of dynamic instruction tracing, and iterative transformation for many times enhances the complexity of control flow graph.Index Terms-Code obfuscation, iterative transformation, instruction fragment diversification, control flow randomization.

show abstract

“…Some dynamic dispatching methods inherently have this capability. Batchelder and Hendren (2007) proposed a number of prevention transformation techniques for Java program by exploiting the semantic gap between what is legal in source code and what is legal in bytecode. The methods include converting branches to jsr instructions, disobeying constructor conventions, and combining try blocks with their catch blocks etc., all which lead to the decompilers failing to decompile the bytecodes.…”

Section: Prevention Obfuscationmentioning

confidence: 99%