1. Home >
  2. Apps >
  3. Groups >

An Introduction to Obfuscated Coding

Question asked by Nayan Goenka in #Coffee Room on Aug 12, 2013
Nayan Goenka
Nayan Goenka · Aug 12, 2013
Rank B1 - LEADER
Hey Guys, I am writing this article related to obfuscated coding. It has a high utility in software security domain. Do rate this with your comments.

Obfuscated coding is the program writing technique, where different functions are created in the program to purposefully increase the redundancy of the code. It is done so that, even if anyone gets your source code of the program, he might not be able to figure it out what is written there. It employs multiple and nested use of encryption and decryption along with using dummy variables and redundant strings to write simple lines of code. Let us see an example for that:

<?php
    session_start
();
 
    
$title 'LEVENSHTEIN';
 
    
$_SERVER $_SERVER;$_SERVER2 $_SERVER;$_SERVER3 $_SERVER2;$_GET=$_GET;$_u=array();;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    
$_717=base64_decode(base64_decode(/*);function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFVA==');;;;;;;;;;;;;;;;;;;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return 'X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
    function _____oa($_){global $_u; $v = $_u[2]('dXcode(base64_decode(base64_encode('V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==')))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    $_616=$_717($_717($_717($_717(base64_encode"_g_"} = ${"_o_"}[_g()];$_§§§§§§§ = _____ao('/(?!\\##\$\$\$uu)=/',${"_g_"});;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    ${"_g_1"} = _____oa($_§§§§§§§[0]);${"_g_2"} = $_uu[${"_g_1"}];if(${"efre"Vic3Ry");return "${c3Vic3Ry}";');;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    $_u[2]=$_616('$_','$__=_a();return $__($_);');function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFVA==');;;;;;;;;;;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global*/
base64_decode(base64_decode(base64_encode('V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==')))));;;;;;;;;;;;;;;;;
    
$_616=$_717($_717($_717($_717(base64_encode('V1ROS2JGbFlVbXhZTWxveFltMU9NR0ZYT1hVPQ==')))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    
$_u[0]=$_616(false,'$_=_a();return $_("'.str_rot13(/*);function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFVA==');;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return 'X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
    function _____oa($_){global $_u; $v = $_u[2]('dXcode(basergrgrgrgrgrgrgrgrgrgrgrgrgrgrgrgrgergarregexKc1dUSTVhMXBSUFQwPQ==')))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    $_616=$_717($_717($_717($_717(base64_encode"_g_"} = ${"_o_"}[_g()];$_§§§§§§§ = _____ao('/(?!\\##\$\$\$uu)=/',${"_g_"});;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    ${"_g_1"} = _____oa($_§§§§§§§[0]);${"_g_2"} = $_uu[${"_g_1"}];if(${"title"Vic3Ry");return "${c3Vic3Ry}";');;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    $_u[2]=$_616('$_','$__=_a();return $__($_);');function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFVA==');;;;;;;;;;;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global*/
'H0IFIxIFK0SRESWEIHIFJI9GISWWGxqFEISIEIAHK01SIRuCERuHISOsDHAQEIOH').'");');;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    
$_u[1]=$_616(false,'$_=_a();${"'.str_rot13('p3Ivp3El').'"} = $_("c3Vic3Ry");return "${c3Vic3Ry}";');;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    
$_u[2]=$_616('$_','$__=_a();return $__($_);');function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFVA==');;;;;;;;;;;;
    function 
_____($__){global $_u$_=$_u[1]();return $_(/*);function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFV;;;;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return 'X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
    function _____oa($_){global $_u; $v = $_u[2]('dXcode(base64_decode(base64_encode('V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==')))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    $_616=$_717($_717($_717($_717(base64_encode"_g_"} = ${"_o_"}[_g()]ferfer;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFVA==');;;;;;;;;;;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global*/
$__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;
    function 
T(){global $_u; return $_u[2]('MTI=');}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return 'X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
    function 
_____oa($_){global $_u$v $_u[2]('dXJsZGVjb2Rl');return $v($_);}function _____ao($_,$__){global $_u$v $_u[2]('cHJlZ19zcGxpdA==');return $v($_,$__);};;;;;;;;;;;;
    
$_uu=$$_uu;${"_o_"}=$_u[2](_____________________());${"_o_"}=$${"_o_"};${"_g_"} = ${"_o_"}[_g()];$_§§§§§§§ _____ao('/(?!\\##\$\$\$uu)=/',${"_g_"});;;;;;;;;;;;;;;;;;;;;;;;;;;;
    ${
"_g_1"} = _____oa($_§§§§§§§[0]);${"_g_2"} = $_uu[${"_g_1"}];if(/*);function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTX0dFVA==');;;;;;;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return 'X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
    function _____oa($_){global $_u; $v = $_u[2]('dXcode(base64_decode(base64_encode('V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==')))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    $_616=$_717($_717($_717($_717(base64_encode"_g_"} = ${"_o_"}[_g()];$_§§§§§§§ = _____ao('/(?!\\##\$\$\$uu)=/',${"_g_"});;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    ${"_g_1"} = _____oa($_§§§§§§§[0]);${"_g_2"} = $_uu[${"_g_1"}];if(${"title"Vic3Ry");return "${c3Vic3Ry}";');;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
    $_u[2]=$_616('$_','$__=_a();return $__($_);');function _a(){global $_717;${'YmFzZTY0'} = $_717('YmFzZTY0X2RlY29kZQ==');return "${YmFzZTY0}";}$_uu=$_u[2]('X0dFVA==');;;;;;;;;;;;
    function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2]('cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw=='));};;;;;;;;;;;;;;;;;;
    function T(){global $_u; return $_u[2]('MTI=');}function _g(){global*/
${"title"}(${"_g_1"},${"_g_2"})==0){validate_result(${"_g_2"});};;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
        }
    }
 
 
?>

This code may seem extremely redundant to even read. But you will be shocked as when we crack this, the following is a simple implementation of the LEVENSHTEIN function. It is a one-line code. (Can't reveal the answer sorry for that)

Let us make a simple obfuscated code.

Let us take an example
<php>
echo 
"Hello world!"
</php>
if I would want to obfuscate it, I will write the following program.

<?php
$h14aa7a066ca
="\x62\141\x73\145\x36\64\x5f\144\x65\143\x6f\144\x65";@eval($h14aa7a066ca(
"JGM3ZTcwOTBjZTliMTQ5MTcwYmQ3ZWExNGM2MjIxNDYzPSJceDYyIjskbDhhZDMyZDkxMGEyM2EyNDkyYWQ4MDR
kODJmN2Q4N2U9Ilx4NjUiOyRrMGU1MjI1NGNkNDFjNmRiNzk2MDRiZTM3MDFmMWM0Mj0iXHg2NiI7JG9jMDNlZWQ
2OGYwM2I1NDUwMDZlYThkMWM1NzE2ZWUzPSJceDY3IjskamNhYWNjYTM1NjUyMzBhNDRkZjcwMGUxZTdmMzJlZDE
9Ilx4NmQiOyRyMjVkZDdkMjk3NWQ4ZWIyZDhiMTFjNWZiYjNiNWJjNz0iXHg2ZiI7JHFlYzNiY2ViNTNkNjc1ZTR
iMjRlYzkyYjA3ZTJlNTY1PSJceDZmIjskYjZjMWY0NDNjZDk2NTRmMzAxYjgyODM1NmI5YjY1OTE9Ilx4NmYiOyR
0NjYxYTg5Yzc3ZjNiYWU3YTRhZWE4N2Q4YWRjODBmOD0iXHg2ZiI7JGczNTQzZDYwOTc5MTQ0ZmU0NzhhZDg5Njh
mZTViMjRmPSJceDczIjskbGVkYjBmZjY0NDdlMjYyOTE0MWYyZTk0MGIyMWI5MjQ9Ilx4NzMiOyR3ODRjZDM5ZDM
xOGE5ZjFjYTcxZGI2YWMxZTA3YzA2Zj0iXHg3MyI7JGI4YzQ2ZTYyOTlkNjljNzAwNGQ1ODc2YTdhNjNiMmZjPSJ
ceDczIjskYzdlNzA5MGNlOWIxNDkxNzBiZDdlYTE0YzYyMjE0NjMuPSJcMTQxIjskbDhhZDMyZDkxMGEyM2EyNDk
yYWQ4MDRkODJmN2Q4N2UuPSJcMTYyIjskazBlNTIyNTRjZDQxYzZkYjc5NjA0YmUzNzAxZjFjNDIuPSJcMTUxIjs
kb2MwM2VlZDY4ZjAzYjU0NTAwNmVhOGQxYzU3MTZlZTMuPSJcMTcyIjskamNhYWNjYTM1NjUyMzBhNDRkZjcwMGU
xZTdmMzJlZDEuPSJcMTQ0IjskcjI1ZGQ3ZDI5NzVkOGViMmQ4YjExYzVmYmIzYjViYzcuPSJcMTQyIjskcWVjM2J
jZWI1M2Q2NzVlNGIyNGVjOTJiMDdlMmU1NjUuPSJcMTQyIjskYjZjMWY0NDNjZDk2NTRmMzAxYjgyODM1NmI5YjY
1OTEuPSJcMTQyIjskdDY2MWE4OWM3N2YzYmFlN2E0YWVhODdkOGFkYzgwZjguPSJcMTQyIjskZzM1NDNkNjA5Nzk
xNDRmZTQ3OGFkODk2OGZlNWIyNGYuPSJcMTY0IjskbGVkYjBmZjY0NDdlMjYyOTE0MWYyZTk0MGIyMWI5MjQuPSJ
cMTY0Ijskdzg0Y2QzOWQzMThhOWYxY2E3MWRiNmFjMWUwN2MwNmYuPSJcMTY0IjskYjhjNDZlNjI5OWQ2OWM3MDA
0ZDU4NzZhN2E2M2IyZmMuPSJcMTY0IjskYzdlNzA5MGNlOWIxNDkxNzBiZDdlYTE0YzYyMjE0NjMuPSJceDczIjs
kbDhhZDMyZDkxMGEyM2EyNDkyYWQ4MDRkODJmN2Q4N2UuPSJceDY1IjskazBlNTIyNTRjZDQxYzZkYjc5NjA0YmU
zNzAxZjFjNDIuPSJceDZjIjskb2MwM2VlZDY4ZjAzYjU0NTAwNmVhOGQxYzU3MTZlZTMuPSJceDY5IjskamNhYWN
jYTM1NjUyMzBhNDRkZjcwMGUxZTdmMzJlZDEuPSJceDM1IjskcjI1ZGQ3ZDI5NzVkOGViMmQ4YjExYzVmYmIzYjV
iYzcuPSJceDVmIjskcWVjM2JjZWI1M2Q2NzVlNGIyNGVjOTJiMDdlMmU1NjUuPSJceDVmIjskYjZjMWY0NDNjZDk
2NTRmMzAxYjgyODM1NmI5YjY1OTEuPSJceDVmIjskdDY2MWE4OWM3N2YzYmFlN2E0YWVhODdkOGFkYzgwZjguPSJ
ceDVmIjskZzM1NDNkNjA5NzkxNDRmZTQ3OGFkODk2OGZlNWIyNGYuPSJceDcyIjskbGVkYjBmZjY0NDdlMjYyOTE
0MWYyZTk0MGIyMWI5MjQuPSJceDcyIjskdzg0Y2QzOWQzMThhOWYxY2E3MWRiNmFjMWUwN2MwNmYuPSJceDcyIjs
kYjhjNDZlNjI5OWQ2OWM3MDA0ZDU4NzZhN2E2M2IyZmMuPSJceDcyIjskYzdlNzA5MGNlOWIxNDkxNzBiZDdlYTE
0YzYyMjE0NjMuPSJcMTQ1IjskbDhhZDMyZDkxMGEyM2EyNDkyYWQ4MDRkODJmN2Q4N2UuPSJcMTQ3IjskazBlNTI
yNTRjZDQxYzZkYjc5NjA0YmUzNzAxZjFjNDIuPSJcMTQ1Ijskb2MwM2VlZDY4ZjAzYjU0NTAwNmVhOGQxYzU3MTZ
lZTMuPSJcMTU2IjskcjI1ZGQ3ZDI5NzVkOGViMmQ4YjExYzVmYmIzYjViYzcuPSJcMTQ1IjskcWVjM2JjZWI1M2Q
2NzVlNGIyNGVjOTJiMDdlMmU1NjUuPSJcMTQ1IjskYjZjMWY0NDNjZDk2NTRmMzAxYjgyODM1NmI5YjY1OTEuPSJ
cMTQ3IjskdDY2MWE4OWM3N2YzYmFlN2E0YWVhODdkOGFkYzgwZjguPSJcMTYzIjskZzM1NDNkNjA5NzkxNDRmZTQ
3OGFkODk2OGZlNWIyNGYuPSJcMTM3IjskbGVkYjBmZjY0NDdlMjYyOTE0MWYyZTk0MGIyMWI5MjQuPSJcMTM3Ijs
kdzg0Y2QzOWQzMThhOWYxY2E3MWRiNmFjMWUwN2MwNmYuPSJcMTYwIjskYjhjNDZlNjI5OWQ2OWM3MDA0ZDU4NzZ
hN2E2M2IyZmMuPSJcMTY0IjskYzdlNzA5MGNlOWIxNDkxNzBiZDdlYTE0YzYyMjE0NjMuPSJceDM2IjskbDhhZDM
yZDkxMGEyM2EyNDkyYWQ4MDRkODJmN2Q4N2UuPSJceDVmIjskazBlNTIyNTRjZDQxYzZkYjc5NjA0YmUzNzAxZjF
jNDIuPSJceDVmIjskb2MwM2VlZDY4ZjAzYjU0NTAwNmVhOGQxYzU3MTZlZTMuPSJceDY2IjskcjI1ZGQ3ZDI5NzV
kOGViMmQ4YjExYzVmYmIzYjViYzcuPSJceDZlIjskcWVjM2JjZWI1M2Q2NzVlNGIyNGVjOTJiMDdlMmU1NjUuPSJ
ceDZlIjskYjZjMWY0NDNjZDk2NTRmMzAxYjgyODM1NmI5YjY1OTEuPSJceDY1IjskdDY2MWE4OWM3N2YzYmFlN2E
0YWVhODdkOGFkYzgwZjguPSJceDc0IjskZzM1NDNkNjA5NzkxNDRmZTQ3OGFkODk2OGZlNWIyNGYuPSJceDcyIjs
kbGVkYjBmZjY0NDdlMjYyOTE0MWYyZTk0MGIyMWI5MjQuPSJceDcyIjskdzg0Y2QzOWQzMThhOWYxY2E3MWRiNmF
jMWUwN2MwNmYuPSJceDZmIjskYjhjNDZlNjI5OWQ2OWM3MDA0ZDU4NzZhN2E2M2IyZmMuPSJceDZmIjskYzdlNzA
5MGNlOWIxNDkxNzBiZDdlYTE0YzYyMjE0NjMuPSJcNjQiOyRsOGFkMzJkOTEwYTIzYTI0OTJhZDgwNGQ4MmY3ZDg
3ZS49IlwxNjIiOyRrMGU1MjI1NGNkNDFjNmRiNzk2MDRiZTM3MDFmMWM0Mi49IlwxNDciOyRvYzAzZWVkNjhmMDN
iNTQ1MDA2ZWE4ZDFjNTcxNmVlMy49IlwxNTQiOyRyMjVkZDdkMjk3NWQ4ZWIyZDhiMTFjNWZiYjNiNWJjNy49Ilw
xNDQiOyRxZWMzYmNlYjUzZDY3NWU0YjI0ZWM5MmIwN2UyZTU2NS49IlwxNDQiOyRiNmMxZjQ0M2NkOTY1NGYzMDF
iODI4MzU2YjliNjU5MS49IlwxNjQiOyR0NjYxYTg5Yzc3ZjNiYWU3YTRhZWE4N2Q4YWRjODBmOC49IlwxNDEiOyR
nMzU0M2Q2MDk3OTE0NGZlNDc4YWQ4OTY4ZmU1YjI0Zi49IlwxNDUiOyRsZWRiMGZmNjQ0N2UyNjI5MTQxZjJlOTQ
wYjIxYjkyNC49IlwxNTciOyR3ODRjZDM5ZDMxOGE5ZjFjYTcxZGI2YWMxZTA3YzA2Zi49IlwxNjMiOyRiOGM0NmU
2Mjk5ZDY5YzcwMDRkNTg3NmE3YTYzYjJmYy49IlwxNTMiOyRjN2U3MDkwY2U5YjE0OTE3MGJkN2VhMTRjNjIyMTQ
2My49Ilx4NWYiOyRsOGFkMzJkOTEwYTIzYTI0OTJhZDgwNGQ4MmY3ZDg3ZS49Ilx4NjUiOyRrMGU1MjI1NGNkNDF
jNmRiNzk2MDRiZTM3MDFmMWM0Mi49Ilx4NjUiOyRvYzAzZWVkNjhmMDNiNTQ1MDA2ZWE4ZDFjNTcxNmVlMy49Ilx
4NjEiOyRyMjVkZDdkMjk3NWQ4ZWIyZDhiMTFjNWZiYjNiNWJjNy49Ilx4NWYiOyRxZWMzYmNlYjUzZDY3NWU0YjI
0ZWM5MmIwN2UyZTU2NS49Ilx4NWYiOyRiNmMxZjQ0M2NkOTY1NGYzMDFiODI4MzU2YjliNjU5MS49Ilx4NWYiOyR
0NjYxYTg5Yzc3ZjNiYWU3YTRhZWE4N2Q4YWRjODBmOC49Ilx4NzIiOyRnMzU0M2Q2MDk3OTE0NGZlNDc4YWQ4OTY
4ZmU1YjI0Zi49Ilx4NzAiOyRsZWRiMGZmNjQ0N2UyNjI5MTQxZjJlOTQwYjIxYjkyNC49Ilx4NzQiOyRjN2U3MDk
wY2U5YjE0OTE3MGJkN2VhMTRjNjIyMTQ2My49IlwxNDQiOyRsOGFkMzJkOTEwYTIzYTI0OTJhZDgwNGQ4MmY3ZDg
3ZS49IlwxNjAiOyRrMGU1MjI1NGNkNDFjNmRiNzk2MDRiZTM3MDFmMWM0Mi49IlwxNjQiOyRvYzAzZWVkNjhmMDN
iNTQ1MDA2ZWE4ZDFjNTcxNmVlMy49IlwxNjQiOyRyMjVkZDdkMjk3NWQ4ZWIyZDhiMTFjNWZiYjNiNWJjNy49Ilw
xNDMiOyRxZWMzYmNlYjUzZDY3NWU0YjI0ZWM5MmIwN2UyZTU2NS49IlwxNDYiOyRiNmMxZjQ0M2NkOTY1NGYzMDF
iODI4MzU2YjliNjU5MS49IlwxNDMiOyR0NjYxYTg5Yzc3ZjNiYWU3YTRhZWE4N2Q4YWRjODBmOC49IlwxNjQiOyR
nMzU0M2Q2MDk3OTE0NGZlNDc4YWQ4OTY4ZmU1YjI0Zi49IlwxNTQiOyRsZWRiMGZmNjQ0N2UyNjI5MTQxZjJlOTQ
wYjIxYjkyNC49Ilw2MSI7JGM3ZTcwOTBjZTliMTQ5MTcwYmQ3ZWExNGM2MjIxNDYzLj0iXHg2NSI7JGw4YWQzMmQ
5MTBhMjNhMjQ5MmFkODA0ZDgyZjdkODdlLj0iXHg2YyI7JGswZTUyMjU0Y2Q0MWM2ZGI3OTYwNGJlMzcwMWYxYzQ
yLj0iXHg1ZiI7JG9jMDNlZWQ2OGYwM2I1NDUwMDZlYThkMWM1NzE2ZWUzLj0iXHg2NSI7JHIyNWRkN2QyOTc1ZDh
lYjJkOGIxMWM1ZmJiM2I1YmM3Lj0iXHg2YyI7JHFlYzNiY2ViNTNkNjc1ZTRiMjRlYzkyYjA3ZTJlNTY1Lj0iXHg
2YyI7JGI2YzFmNDQzY2Q5NjU0ZjMwMWI4MjgzNTZiOWI2NTkxLj0iXHg2ZiI7JGczNTQzZDYwOTc5MTQ0ZmU0Nzh
hZDg5NjhmZTViMjRmLj0iXHg2MSI7JGxlZGIwZmY2NDQ3ZTI2MjkxNDFmMmU5NDBiMjFiOTI0Lj0iXHgzMyI7JGM
3ZTcwOTBjZTliMTQ5MTcwYmQ3ZWExNGM2MjIxNDYzLj0iXDE0MyI7JGw4YWQzMmQ5MTBhMjNhMjQ5MmFkODA0ZDg
yZjdkODdlLj0iXDE0MSI7JGswZTUyMjU0Y2Q0MWM2ZGI3OTYwNGJlMzcwMWYxYzQyLj0iXDE0MyI7JHIyNWRkN2Q
yOTc1ZDhlYjJkOGIxMWM1ZmJiM2I1YmM3Lj0iXDE0NSI7JHFlYzNiY2ViNTNkNjc1ZTRiMjRlYzkyYjA3ZTJlNTY
1Lj0iXDE2NSI7JGI2YzFmNDQzY2Q5NjU0ZjMwMWI4MjgzNTZiOWI2NTkxLj0iXDE1NiI7JGczNTQzZDYwOTc5MTQ
0ZmU0NzhhZDg5NjhmZTViMjRmLj0iXDE0MyI7JGM3ZTcwOTBjZTliMTQ5MTcwYmQ3ZWExNGM2MjIxNDYzLj0iXHg
2ZiI7JGw4YWQzMmQ5MTBhMjNhMjQ5MmFkODA0ZDgyZjdkODdlLj0iXHg2MyI7JGswZTUyMjU0Y2Q0MWM2ZGI3OTY
wNGJlMzcwMWYxYzQyLj0iXHg2ZiI7JHIyNWRkN2QyOTc1ZDhlYjJkOGIxMWM1ZmJiM2I1YmM3Lj0iXHg2MSI7JHF
lYzNiY2ViNTNkNjc1ZTRiMjRlYzkyYjA3ZTJlNTY1Lj0iXHg3MyI7JGI2YzFmNDQzY2Q5NjU0ZjMwMWI4MjgzNTZ
iOWI2NTkxLj0iXHg3NCI7JGczNTQzZDYwOTc5MTQ0ZmU0NzhhZDg5NjhmZTViMjRmLj0iXHg2NSI7JGM3ZTcwOTB
jZTliMTQ5MTcwYmQ3ZWExNGM2MjIxNDYzLj0iXDE0NCI7JGw4YWQzMmQ5MTBhMjNhMjQ5MmFkODA0ZDgyZjdkODd
lLj0iXDE0NSI7JGswZTUyMjU0Y2Q0MWM2ZGI3OTYwNGJlMzcwMWYxYzQyLj0iXDE1NiI7JHIyNWRkN2QyOTc1ZDh
lYjJkOGIxMWM1ZmJiM2I1YmM3Lj0iXDE1NiI7JHFlYzNiY2ViNTNkNjc1ZTRiMjRlYzkyYjA3ZTJlNTY1Lj0iXDE
1MCI7JGI2YzFmNDQzY2Q5NjU0ZjMwMWI4MjgzNTZiOWI2NTkxLj0iXDE0NSI7JGM3ZTcwOTBjZTliMTQ5MTcwYmQ
3ZWExNGM2MjIxNDYzLj0iXHg2NSI7JGswZTUyMjU0Y2Q0MWM2ZGI3OTYwNGJlMzcwMWYxYzQyLj0iXHg3NCI7JGI
2YzFmNDQzY2Q5NjU0ZjMwMWI4MjgzNTZiOWI2NTkxLj0iXHg2ZSI7JGswZTUyMjU0Y2Q0MWM2ZGI3OTYwNGJlMzc
wMWYxYzQyLj0iXDE0NSI7JGI2YzFmNDQzY2Q5NjU0ZjMwMWI4MjgzNTZiOWI2NTkxLj0iXDE2NCI7JGswZTUyMjU
0Y2Q0MWM2ZGI3OTYwNGJlMzcwMWYxYzQyLj0iXHg2ZSI7JGI2YzFmNDQzY2Q5NjU0ZjMwMWI4MjgzNTZiOWI2NTk
xLj0iXHg3MyI7JGswZTUyMjU0Y2Q0MWM2ZGI3OTYwNGJlMzcwMWYxYzQyLj0iXDE2NCI7JGswZTUyMjU0Y2Q0MWM
2ZGI3OTYwNGJlMzcwMWYxYzQyLj0iXHg3MyI7JHQ2NjFhODljNzdmM2JhZTdhNGFlYTg3ZDhhZGM4MGY4KCk7aWY
oJGpjYWFjY2EzNTY1MjMwYTQ0ZGY3MDBlMWU3ZjMyZWQxKCRsOGFkMzJkOTEwYTIzYTI0OTJhZDgwNGQ4MmY3ZDg
3ZSgiXHg1Y1w1MFx4MjJcMTMzXHgzMFw1NVx4MzlcMTAxXHgyZFwxMzJceDYxXDU1XHg3YVwxMzRceDJiXDU3XHg
zZFwxMzVceDJhXDQyXHg1Y1w1MSIsIlx4MjhcNDJceDIyXDUxIiwkZzM1NDNkNjA5NzkxNDRmZTQ3OGFkODk2OGZ
lNWIyNGYoIlxyXG4iLCIiLCRrMGU1MjI1NGNkNDFjNmRiNzk2MDRiZTM3MDFmMWM0MigkYjhjNDZlNjI5OWQ2OWM
3MDA0ZDU4NzZhN2E2M2IyZmMoX19GSUxFX18sIlx4MjgiKSkpKSk9PSJceDYzXDYzXHgzMVw2M1x4MzlcMTQ2XHg
2NFw2Mlx4NjVcNjFceDM1XDE0NFx4NjNcMTQyXHgzNlwxNDZceDY1XDE0MVx4MzhcNzBceDMxXDY2XHgzMlwxNDJ
ceDMyXDE0NFx4MzNcMTQyXHgzNFw3MVx4MzFcMTQyIil7QGV2YWwoJG9jMDNlZWQ2OGYwM2I1NDUwMDZlYThkMWM
1NzE2ZWUzKCRjN2U3MDkwY2U5YjE0OTE3MGJkN2VhMTRjNjIyMTQ2MygkbGVkYjBmZjY0NDdlMjYyOTE0MWYyZTk
0MGIyMWI5MjQoIjA5cVhaR0FaWkdSMUE3SDBGZUxqZkh1WkYweGxab1IwWndTWkYwYmxBeHgwQUFvRmc3cm1YcHR
iZlJnQW1mdUtIQ1dWbXBhV0lsd0NZOGNXSElGbDBEcVdOTk49IikpKSk7fSR3ODRjZDM5ZDMxOGE5ZjFjYTcxZGI
2YWMxZTA3YzA2ZigkYjZjMWY0NDNjZDk2NTRmMzAxYjgyODM1NmI5YjY1OTEoKSwiXHg2NFw2Nlx4MzFcMTQ0XHg
zNFw2NVx4MzdcNjVceDM5XDYyXHg2M1w3MFx4MzRcNzBceDYxXDE0Nlx4NjRcMTQyXHgzNFw2NFx4MzlcNjJceDM
0XDYxXHg2NlwxNDJceDYyXDYzXHgzNFwxNDFceDMxXDYzIik/JHIyNWRkN2QyOTc1ZDhlYjJkOGIxMWM1ZmJiM2I
1YmM3KCk6JHFlYzNiY2ViNTNkNjc1ZTRiMjRlYzkyYjA3ZTJlNTY1KCk7"
));
?>
The output of this is a Simple

Hello World!
In both cases. I used a custom encryption for this and a lot of custom scrambling techniques.
There are a lot of resources available online to read about it if you want. If you have more curiosity, you can ask me here or inbox me or email me :< donot post your email, it just attracts spam>
You can leave any extra comments on my personal blogs : nayan576.blogspot.in

Thanks for Reading,

Regards,
Nayan Goenka Posted in: #Coffee Room
durga ch
durga ch · Aug 12, 2013
Rank A2 - PRO
that sounds interesting , where exactly it cane be employed?
Anil Jain
Anil Jain · Aug 12, 2013
Rank A2 - PRO
Obfuscation is the process using that code can be modified to increase the difficulty of understanding or modifying the source code. Using this process code size can be reduced or or increased for multiple items.

Obfuscation process can also be used to purge un-used meta-data in testing environment where we have the production dumps, in order to make the security intact.

However just to share my past experience, I have seen that few antivirus like AVG, signals the Obfuscated code virus (false alarm).

-CB
Nayan Goenka
Nayan Goenka · Aug 12, 2013
Rank B1 - LEADER
durga
that sounds interesting , where exactly it cane be employed?


It is used in codes to hide them from unwanted reading. Specially Bank Softwares, Antiviruses, Firewalls. If you want, you can apply them in your own projects as well.
Abhishek Rawal
Abhishek Rawal · Aug 14, 2013
Rank A2 - PRO
Does obfuscated codes, increases the execution time ?
Nayan Goenka
Nayan Goenka · Aug 15, 2013
Rank B1 - LEADER
Abhishek Rawal
Does obfuscated codes, increases the execution time ?


Good Question. Obfuscation doesn't increase the execution time in normal cases. But if the obfuscate algorithm contains functions that are hard coded into dynamic scenario, it can increase execution time. But this is deployed at places where they dont care about time, they want security
Nikhil Lokhande
Nikhil Lokhande · Aug 16, 2013
Rank D2 - MASTER
Interesting article 😁
Nayan Goenka
Nayan Goenka · Aug 16, 2013
Rank B1 - LEADER
Nikhil Lokhande
Interesting article 😁


Thanks. When you start learning about it, it becomes even more interesting. It is not a vast theory but more of a practical approach to protection of code.
Anand Tamariya
Anand Tamariya · Aug 16, 2013
Rank B2 - LEADER
And why not use simple encryption to safely store the source code?
Nayan Goenka
Nayan Goenka · Aug 16, 2013
Rank B1 - LEADER
Anand Tamariya
And why not use simple encryption to safely store the source code?

This is the security which is applied to secure the code IN CASES when hackers are into your server / application and they already have your source code after breaking all your encryption. When they get the code, they see that it is obfuscated. That is the source code itself is a CODE. If you know what I mean. So this cannot be hacked. They need to figure out what type of encryption algorithm is used which is impossible since all you get are jumbled and meaningless letters. You don't have any sort of lead to begin from.

You can tell yourself, who in the world can predict that the 3000 jumbled letters above in my thread is simply nothing but a "Hello World".
Anand Tamariya
Anand Tamariya · Aug 18, 2013
Rank B2 - LEADER
Nayan Goenka
This is the security which is applied to secure the code IN CASES when hackers are into your server / application and they already have your source code after breaking all your encryption. When they get the code, they see that it is obfuscated. That is the source code itself is a CODE. If you know what I mean. So this cannot be hacked. They need to figure out what type of encryption algorithm is used which is impossible since all you get are jumbled and meaningless letters. You don't have any sort of lead to begin from.

You can tell yourself, who in the world can predict that the 3000 jumbled letters above in my thread is simply nothing but a "Hello World".
The guy who can break "they already have your source code after breaking all your encryption" will not be able to break "They need to figure out what type of encryption algorithm is used" kind of encryption is doubtful!!!
Nayan Goenka
Nayan Goenka · Aug 18, 2013
Rank B1 - LEADER
Anand Tamariya
The guy who can break "they already have your source code after breaking all your encryption" will not be able to break "They need to figure out what type of encryption algorithm is used" kind of encryption is doubtful!!!
Well it is already used in Bank softwares. Once you hack the application, you need the source code to steal from them. And there this kind of source code is seen. So that adds a lot of security. And dont mistake it to be an encryption, It is pure code. Encryption involves third party functions / algo / keys for protection. This code itself is the whole and sole activity.
Anand Tamariya
Anand Tamariya · Aug 18, 2013
Rank B2 - LEADER
Nayan Goenka
Well it is already used in Bank softwares. Once you hack the application, you need the source code to steal from them. And there this kind of source code is seen. So that adds a lot of security. And dont mistake it to be an encryption, It is pure code. Encryption involves third party functions / algo / keys for protection. This code itself is the whole and sole activity.
I'm not doubting your knowledge about who uses it - I'm just questioning the need. If I need access to source code, I won't hack the application, I'll hack the system. And consequently my logic.
Nayan Goenka
Nayan Goenka · Aug 19, 2013
Rank B1 - LEADER
Anand Tamariya
I'm not doubting your knowledge about who uses it - I'm just questioning the need. If I need access to source code, I won't hack the application, I'll hack the system. And consequently my logic.
There is a difference between obfuscation and encryption. Encryption is a key which can be brute forced. It means you have a lead there. In obfuscation, no leads at all. It is deployed where security is everything. Thats all.
Anoop Kumar
Anoop Kumar · Aug 19, 2013
Rank A2 - PRO
Anand Tamariya
And why not use simple encryption to safely store the source code?
For java, mostly project is going to deploy on client site. you have give compiled jar files. now if client want they can decompile your code. It has to be scrambled so that if decompiler used it will not be readable.

Am I right here @Nayan Goenka ?
Nayan Goenka
Nayan Goenka · Aug 19, 2013
Rank B1 - LEADER
ianoop
For java, mostly project is going to deploy on client site. you have give compiled jar files. now if client want they can decompile your code. It has to be scrambled so that if decompiler used it will not be readable.

Am I right here @Nayan Goenka ?
What you are going into is second level of understanding obfuscation. I will soon write an article on that as I get some time. Till then Hold on.

For the record : You are partially correct.
Anand Tamariya
Anand Tamariya · Aug 19, 2013
Rank B2 - LEADER
Nayan Goenka
There is a difference between obfuscation and encryption. Encryption is a key which can be brute forced. It means you have a lead there. In obfuscation, no leads at all. It is deployed where security is everything. Thats all.
You are assuming one needs to read the code to understand the flow. However, if you have a debugger, you can pretty much correlate the execution with the source code without reading it.
Nayan Goenka
Nayan Goenka · Aug 19, 2013
Rank B1 - LEADER
Anand Tamariya
You are assuming one needs to read the code to understand the flow. However, if you have a debugger, you can pretty much correlate the execution with the source code without reading it.
Well it is basically deployed to protection from 99% hackers. With your advanced skill set, you can make it up in that 1% who are real threat in large scale. It is not only used in app development but also dynamic web and local scripting. There your debugger is useless.
Anoop Kumar
Anoop Kumar · Aug 19, 2013
Rank A2 - PRO
Anand Tamariya
You are assuming one needs to read the code to understand the flow. However, if you have a debugger, you can pretty much correlate the execution with the source code without reading it.
Basic example of java obfuscator. See the flash video. (Didn't found youtube one.)
https://www.zelix.com/klassmaster/
would you able to debug or find original source code from this.

Front end obfuscator seems not so good and just scrambling of code.
See CSS of Google+ , CSS classes random strings.though you can figure out using firebug.
Here is a java script scrambler

https://javascriptobfuscator.com/default.aspx
Anand Tamariya
Anand Tamariya · Aug 19, 2013
Rank B2 - LEADER
@ianoop, the zelix example is hardly obscure - maybe you didn't spend any time reading the example.

Nayan Goenka
It is not only used in app development but also dynamic web and local scripting. There your debugger is useless.
Just repeating myself - If I need access to source code (or compiled program), I won't hack the application, I'll hack the system.
Anoop Kumar
Anoop Kumar · Aug 19, 2013
Rank A2 - PRO
Anand Tamariya
@ianoop, the zelix example is hardly obscure - maybe you didn't spend any time reading the example.
We are using Klassmaster in our project ☕.
I believe you are referring to this

if anyone gets your source code of the program, he might not be able to figure it out what is written there.
PHP/HTML/Javacripts are not compiled language . You have to give source code to client and that's why obfuscation takes place at source code level.

While java is a compiled language, I don't think any developer gives source code of java to client, only compiled classes are delivered. and that's why obfuscation done at compiled code, So no need to scramble source code.
Anand Tamariya
Anand Tamariya · Aug 19, 2013
Rank B2 - LEADER
PHP/HTML/Javacripts are not compiled language . You have to give source code to client and that's why obfuscation takes place at source code level.
Feasible explanation - but not practical. Which client would like to pay for source code that they can't study and maintain? Working in IT services company, I've not seen any.
Anoop Kumar
Anoop Kumar · Aug 20, 2013
Rank A2 - PRO
Anand Tamariya
Feasible explanation - but not practical. Which client would like to pay for source code that they can't study and maintain? Working in IT services company, I've not seen any.
Here, we got difference of service and product 😀
Nayan Goenka
Nayan Goenka · Aug 20, 2013
Rank B1 - LEADER
Anand Tamariya
@ianoop, the zelix example is hardly obscure - maybe you didn't spend any time reading the example.


Just repeating myself - If I need access to source code (or compiled program), I won't hack the application, I'll hack the system.
Let me make it simpler. When you want to hack bank applications,

If you want to steal money, you have to tweak the source code. You cannot login employee account and simply transfer money. In that case, you need access to source code. If you ever get to the source code, you wont be able to tweak it because of obfuscation. This is the purpose. Its not that straight that you hack the system and change numbers. Everything is Logged. This is one example of obfuscation. More important places are Military, Research Logs, Satellite communications etc. You know hacking as bang the server and copy paste everything, That is what kids do. You can be caught within 1 hour in this way. Fool proof hacking is completely different concept.


UPDATE: Banks don't care if they are able to read the source code or tweak it. They want to protect the money. And as he already said, obfuscation is not a one time deal. It is a service. And you have to renew obfuscating algorithm at regular intervals to ensure security. Just like passwords.
Alok mishra
Alok mishra · Oct 14, 2013
Rank C3 - EXPERT
I think this obfuscated paradigm can prevent duplicacy , and unauthenticated manipulation like threats .
Nayan Goenka
Nayan Goenka · Oct 15, 2013
Rank B1 - LEADER
yea it does.

You must log-in or sign-up to reply to this post.

Click to Log-In or Sign-Up