Tutorials to .com

Tutorials to .com » Asp » Optimization » Ambiguity: the code allows you to stay away from the eyes peeping

Ambiguity: the code allows you to stay away from the eyes peeping

Print View , by: iSee ,Total views: 7 ,Word Count: 1756 ,Date: Fri, 17 Apr 2009 Time: 2:34 AM

We know, java source code compiler byte-code is received, VS.NET compiler source code is available MSIL (Microsoft Intermediate Language), which means the compiler as "not fully compiled," are particularly vulnerable to anti-decompile or to the project. With different code, not the intermediate code has been compiled to preserve the integrity of the variables, the process name, so that the procedure decompile be almost exactly the same as the original procedure, only the lack of the original program notes, the rest almost intact restore them.

For commercial software developers, high-quality anti-compiled code is a big risk: algorithm may be stolen, and transformation of program code may be copied and changed. (Even if the internal software used by non-commodity, as a result of anti-compile the source code leak has also brought a great threat. For example, users will be very easy to see the password for access to the database or procedures embedded SQL command. Similarly, the use of outside website hosting server unit also faces the risk that once on the ASP.NET application containing the code, the person hosting unit may freely view and change the program code).

Even more worrying is that hackers or curious users to easy access to a variety of reverse engineering tools. Microsoft itself offers a free anti-MSIL assembler, called ILDASM; There is a open source code. NET tools decompile Anakrino; course, there are also many other manufacturers provided commercialization of reverse engineering tools.

First, modify the variable name

In order to prevent the threat of this kind of reverse engineering, the most effective way is ambiguous. (According to "American Heritage Dictionary," "fuzzy" means "so that confusion and muddle-headed confusion, so too confusing or vague, making it difficult feeling or understanding"). Using various means of fuzzy tools to achieve this goal, but the main way is to allow variable names are no longer indicative of its role in the ability to encrypt the string and text, insert commands to enable a variety of deception decompile the code can not be compiled.

An upcoming release of Visual Studio versions (known as VS.NET 2003, code name Everett) will integrate a fuzzy tool, Microsoft recommends that use this tool. NET intermediate code for final processing. This ambiguity is another tool Lite version of the so-called Dotfuscator. Preemptive Solutions produced by the company's more powerful Dotfuscator, which is located in the northeastern United States in Cleveland, Ohio, the company developed the first java code fuzzy technology. Dotfuscator fuzzy device using a series of excellent reverse engineering technology to no avail, or at least that makes reverse engineering difficult.

Preemptive Solutions Company to modify its code in the middle of the variable name from a patented technology called "overload induction" (Overload induction) the name, VS.NET 2003 brought only a Lite version of this fuzzy function. (Fuzzy browser will never change the original source code, or even do not need to use the source code as a reference.) Make full use of the technology features of the VS.NET code: the same identifier can be used with different types of features and method; in different namespaces, the variables have the same name can not conflict.

Make full use of Dotfuscator semeiology VS.NET on these characteristics, the symbol as much as possible into the letters "A". According to the company said some of the code about 33% of the quote can be changed to "A", there are 10% can be changed to "B". After the fuzzy device processing, reverse engineering the code will be difficult to understand. Look at an example below.

Without ambiguity to deal with the implementation of reverse engineering the code:

private void CalcPayroll (SpecialList employeeGroup) (
while (employeeGroup.HasMore ()) (
employee = employeeGroup.GetNext (true);
employee.updateSalary ();
DistributeCheck (employee);

The same code, after the implementation of fuzzy processing and then reverse engineering:

private void a (ab) (
while (ba ()) (
a = ba (true);
aa ();
a (a);

It is clear that two of the processing logic is the same code. However, in the end to make it clear in the second paragraph of the code extremely difficult to do, or even to determine what method it is visited, and which variables it is very difficult.

This change of function of the variable name can be configured, for example, suppose you are to create a DLL, may require changing the API. It is interesting to note that this process is obviously simply a large number of variables to the name of Janea single character, but was very good fuzzy effect.

Second, encryption string

String encryption security issues to deal with another, in fact, the security issues in the machine code is also there - extract characters from the binary code and the text is a very simple matter. For example, the strings used Unix tools to deal with any binary file, you can quickly get the binary file contains a list of ASCII text.

In the simplest case, this list will only divulge information and copyright binaries which quoted the Treasury. However, if the procedures to access the database, this list will contain all of the SQL command; if the code module in the embedded password, the password will not be secret.

For the intermediate code, not encrypted string will also bring an additional layer of risk. Hackers string through the analysis of specific reference, you can determine where to start from the code is password protected, and then add a patch so that part of the code to bypass the password authentication.

In order to solve a string of safety problems caused specifically, the majority of devices using fuzzy string encryption technology. As the decryption operation requires a certain degree of overhead, so visit the string of run-time performance would certainly have been lower. It is interesting to note in this regard the code not to take advantage of it, because if we achieve the same effect, for the development of the local code must be manually encrypt and decrypt each string, and the intermediate code for these devices can do the job by the fuzzy .

Third, to hide the implementation process

Fuzzy control is a process used to mislead the anti-compiler technology, which in the original code to insert a number of goto instructions, although the procedures for the implementation of the instruction sequence ultimately remains the same as the original, but too many of the "indirect action" to make analytical procedures the logic of the actual process is very difficult. Look at an example below.

Of the fuzzy control process without the intermediate code to deal with the implementation of reverse engineering:

public int CompareTo (Object o) (
int n = occurrences - ((WordOccurrence) o). occurrences;
if (n == 0) (
n = String.Compare (word, ((WordOccurrence) o). word;
return (n);

The same code, after a process of fuzzy control to deal with after the implementation of reverse engineering:

public virtual int a (object A_0) (
int local0;
int local1;

local0 = this.a - (c) A_0.a;
if (local0! = 0)
goto i0;
goto i1;
while (true) (
return local1;
i0: local1 = local0;
i1: local0 = System.String.Compare (this.b, (c) A_0.b);
goto i0;

Can see that the fuzzy control process after treatment, the code was inserted into the conditions of detection of a pseudo-statement, then the implementation of a goto instruction. Goto destination in the original statement (to read the fuzzy form of treatment) has been implemented, and then goto statement is a control logic to process the original branch. Pay attention to while () cycle has not been implemented, it is just to play a role in misleading. This code fragment is very small, even in the absence of the original code for comparison and reference, identify procedures for the actual process is still the possibility. However, a larger process, if there is no source code available for reference, those designed to muddy up the normal procedures for the implementation of the directive process analysis code will be exhausted and finally had to give up.

In other words, this fuzzy thinking to deal with the fundamental is to restore the original code becomes extremely difficult, forcing the hackers to change his mind, may be easily changed so that, for example, "I just write code."

Fuzzy control process for dealing with binary files to insert some code, thus increasing the number of run-time overhead. If the code for run-time requirements are very harsh, especially those who can only add this important part of the additional layer of protection. [AutoPage]

█ fuzzy and large broadcasting Decompiler:

▲ fuzzy browser:

LSW dotnet IL Obfuscator

Demeanor for. NET

Salamander. NET Obfuscator



. NET IL-Obfuscator

Deploy. NET

Salamander. NET Protector



▲ Decompiler:

Salamander. NET Decompiler

Exemplar / Anakrino

1:18 | Comments (1)

Asp Optimization Articles

Can't Find What You're Looking For?

Rating: Not yet rated


No comments posted.