Bytecode obfuscation

This Page has been flagged for review. Please help OWASP and review this Page to FixME.

Status

Released: 14/1/2008
Updated: 7/3/2018

Author

Pierre Parrend

Principles

Java source code is typically compiled into Java bytecode -- the instruction set of the Java virtual machine. The compiled Java bytecode can be easily reversed engineered back into source code by a freely available decompilers. Bytecode Obfuscation is the process of modifying Java bytecode (executable or library) so that it is much harder to read and understand for a hacker but remains fully functional. Almost all code can be reverse-engineered with enough skill, time and effort. However, for some platforms such as Java, Android, or.NET, free decompilers can easily reverse-engineer source code from an executable or library with no real time or effort. Automated bytecode obfuscation makes reverse-engineering a program difficult and economically unfeasible. Other advantages could include helping to protect licensing mechanisms and unauthorized access, hiding vulnerabilities and shrinking the size of the executable.

How to recover Source Code from Bytecode?

There are a number of freely available Java decompilers that can recreate source code from Java bytecode (executables or libraries). Popular decompilers include:

• Bytecode Viewer - A Java 8 Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
• CFR - Another Java decompiler
• JDGui - Yet another fast Java decompiler
• Fernflower - An analytical decompiler for Java

How to help prevent Java source code from being Reverse-Engineered?

Java bytecode obfuscation consists of multiple complementary techniques that can help create a layered defense against reverse engineering and tampering. Some typical examples of obfuscation techniques include:

• Renaming to alter the name of methods and variables to make the decompiled source much harder for a human to understand.
• Control Flow Obfuscationcreates conditional, branching, and iterative constructs that produce valid executable logic, but yield non-deterministic semantic results when decompiled.
• String Encryption hides strings in the executable and only restores their original value when needed
• Instruction Pattern Transformation converts common instructions to other, less obvious constructs potential confusing decompliers.
• Dummy Code Insertion inserts code that does not affect the program’s logic, but breaks decompilers or makes reverse-engineered code harder to analyze.
• Unused Code and Metadata Removal prunes out debug, non-essential metadata and used code from applications to reduce the information available to an attacker.
• Class file encryption requires the JVM to decrypt the java executable before running confusing decompilers. Unlike some of the other transforms, this one is easy to circumvent by modifing the local JVM to simply write the executable to disk in its unencrypted form. See: Javaworld article).
  

What obfuscation tools are available?

You can find popular tools for Java bytecode obfuscation below, or simply type 'java obfuscator' in your favorite search engine.

• ProGuard Java Optimizer is a very popular open source Java class file shrinker, optimizer, obfuscator, and preverifier.
• DashO Android & Java Obfuscator a Java, Kotlin and Android application hardening and obfuscation tool that provides passive and active protection.
• KlassMaster Heavy Duty Protection, shrinks and obfuscates both code and string constants. It can also translate stack traces back to readable form if you save the obfuscation log.
• Javaguard, a simple obfuscator without a lot of documentation.

Using Proguard

The following section provides a short tutorial for using Proguard. First, download the code under following url and unzip it.

For this tutorial, we use the fr.inria.ares.sfelixutils-0.1.jar package.

Go to the main directory of Proguard. To launch it, use following script and parameters:

      java -jar lib/proguard.jar @config-genericFrame.pro

config-genericFrame.pro is the option file (do not forget to adapt the libraryjars parameter to your own system) :

-obfuscationdictionary ./examples/dictionaries/compact.txt
-libraryjars /usr/java/j2sdk1.4.2_10/jre/lib/rt.jar
-injars fr.inria.ares.sfelixutils-0.1.jar
-outjar fr.inria.ares.sfelixutils-0.1-obs.jar
-dontshrink
-dontoptimize
-keep public class proguard.ProGuard {
public static void main(java.lang.String[]);
}

Remark that the 'keep' option is mandatory, we use this default class for not keep anything out.

The example dictionary (here compact.txt) is given with the code.

The output is stored in the package 'genericFrameOut.jar'.

You can observe the modifications implied by obfuscation with following commands:

jar xvf genericFrameOut.jar
cd genericFrame/pub/gui/
jad c.class
more c.jad more c.jad

Links

• Proguard
• Javaguard
• Elements of Java Obfuscation
• Software Obfuscation