Problem - Kevin Tafuro

Solution
Obfuscating compiled code requires understanding how the code will look at an
assembly-language level. The purpose of obfuscating C code is to create maintainable
source code that will run at close to the speed of the original, but that is difficult
to understand when represented in assembly language. This difficulty may arise
from an increase in the complexity of the algorithm, from an apparent increase in
complexity, or from a misrepresentation of the constants, data types, and conditional
expressions used in an algorithm.
The examples presented in the discussion for this recipe represent only a handful of
ways in which code can be obfuscated. More involved transformations include blurring
the boundaries between functions by interleaving the code of two or more functions
into a multipurpose function, using custom virtual machines or emulators to
execute a byte-code representation of a function, and spawning new threads or processes
to perform trivial or irrelevant tasks.
Discussion
Increased code obfuscation comes at the price of code maintainability.
In general, it is preferable to combine several simple techniques
along with data obfuscation than to dedicate development and debugging
time to perfecting a single, advanced obfuscation technique.
The most common idiom in C programs is “test-and-branch”: a value is tested, and
the result of the test determines the next statement to be executed. The test-andbranch
idiom is the underlying mechanism for conditional expressions (if, if-else,
switch) and loops (for, while, do-while), and it is usually implemented in assembly
language as:
cmp value, constant
jcc if_true_handler
where jcc is a conditional branch determined by the type of test being performed.
Table 12-1 lists the Intel conditional branch instructions and their corresponding C
comparison operators.
Table 12-1. Intel conditional branch instructions and their C comparison operators
C operator Asm mnemonic Flags tested
= = jz, je ZF = = 1
!= jnz, jne ZF = = 0
>= jge, jnlSF = = OF
jae, jnb, jnc CF = = 0
> jg, jnle ZF = = 0 && SF = = OF
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Obfuscating Code | 659