Abstract:Control flow obfuscation (CFO) alters the control flow path of a program without altering its semantics. Existing literature has proposed several techniques; however, a quick survey reveals a lack of clarity in the types of techniques proposed, and how many are unique. What is also unclear is whether there is a disparity in the theory and practice of CFO. In this paper, we systematically study CFO techniques proposed for Java programs, both from papers and commercially available tools. We evaluate 13 obfuscators using a dataset of 16 programs with varying software characteristics, and different obfuscator parameters. Each program is carefully reverse engineered to study the effect of obfuscation. Our study reveals that there are 36 unique techniques proposed in the literature and 7 from tools. Three of the most popular commercial obfuscators implement only 13 of the 36 techniques in the literature. Thus there appears to be a gap between the theory and practice of CFO. We propose a novel classification of the obfuscation techniques based on the underlying component of a program that is transformed. We identify the techniques that are potent against reverse engineering attacks, both from the perspective of a human analyst and an automated program decompiler. Our analysis reveals that majority of the tools do not implement these techniques, thus defeating the protection obfuscation offers. We furnish examples of select techniques and discuss our findings. To the best of our knowledge, we are the first to assemble such a research. This study will be useful to software designers to decide upon the best techniques to use based upon their needs, for researchers to understand the state-of-the-art and for commercial obfuscator developers to develop new techniques.

Securing SQLJ Source Codes from Business Logic Disclosure by Data Hiding Obfuscation

JConstHide: A Framework for Java Source Code Constant Hiding

JDATATRANS for Array Obfuscation in Java Source Code to Defeat Reverse Engineering from Decompiled Codes

Information Flows in Encrypted Databases

Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs.

A Taxonomy of Obfuscating Transformations

TableGuard -- Securing Structured & Unstructured Data

Breaking Abstractions And Unstructuring Data Structures

Threat Analysis And Security Protection For Malicious Dbms

SQL queries over encrypted databases: a survey

Secure Coding Practices in Java: Challenges and Vulnerabilities

Obfuscation using Encryption

A Java Data Security Framework (JDSF) and its Case Studies

Toward Privacy in Quantum Program Execution On Untrusted Quantum Cloud Computing Machines for Business-sensitive Quantum Needs

Array Based Java Source Code Obfuscation Using Classes with Restructured Arrays

On Secure and Usable Program Obfuscation: A Survey

A Systematic Study on Static Control Flow Obfuscation Techniques in Java

Secure Computation over Encrypted Databases

A type-safe embedding of SQL into Java using the extensible compiler framework J%

Sql-Based Fuzzy Query Mechanism Over Encrypted Database

SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java