| FazBrowse Wikipedia Viewer | Main Page | | |
| Viewing: https://en.wikipedia.org/wiki/Obfuscated_code |
| Contents |
|---|
| Payload encoding for malware evasion |
| Recreational |
| Cryptographic |
| Disadvantages of obfuscation |
| Further reading |
In software development, obfuscation is the practice of creating source or machine code that is intentionally difficult for humans or computers to understand. Similar to obfuscation in natural language, code obfuscation may involve using unnecessarily roundabout ways to write statements. Programmers may obfuscate code to conceal its purpose, logic, or embedded values. The primary reasons for doing so are to prevent tampering, deter reverse engineering, or to create a puzzle or recreational challenge to deobfuscate the code, a challenge often included in crackmes. While obfuscation can be done manually, it is more commonly performed using obfuscators.
#include<stdio.h> intmain(void){ intx=5; inty=7; printf("%d\n",x+y); return0; }Obfuscated code:
In the obfuscated version, meaningful variable names are removed and arithmetic expressions are rewritten in a less readable form, while preserving the program’s behavior.
XOR encryption and Base64 encoding are two common methods used to hide malware from antivirus detection. Both work by changing how malicious code appears in its file form, which prevents security software from recognizing dangerous patterns.
In XOR obfuscation, an attacker chooses a secret key and applies the XOR bitwise operation to the malware binary. This transforms the executable into what looks like random data. Function names in the import table vanish, PE headers become corrupted, and the entire file loses its structure. The obfuscated payload then gets embedded into a dropper, which is a normal-looking executable that contains the hidden malware as a resource or data section. When a user runs the dropper, it performs the XOR operation again with the same key to reconstruct the original malware, then either executes it directly from memory or writes it to disk before running it.
This process removes several indicators that antivirus software relies on. The MZ headeri.e. portable code (as used by Java and .NET), some also work directly on compiled binaries.
Writing and reading obfuscated source code can be a brain teaser. A number of programming contests reward the most creatively obfuscated code, such as the International Obfuscated C Code Contest and the Obfuscated Perl Contest.
Short obfuscated Perl programs may be used in signatures of Perl programmers, known as JAPHs ("Just another Perl hacker").
Cryptographers have explored the idea of obfuscating code so that reverse-engineering the code is cryptographically hard. This is formalized in the many proposals for indistinguishability obfuscation, a cryptographic primitive that, if possible to build securely, would allow one to construct many other kinds of cryptography, including completely novel types that no one knows how to make. (A stronger notion, black-box obfuscation, is known to be impossible in general.)
| View original on Wikipedia | Back | FazBrowse Home |