r/C_Programming • u/Motor_Bluebird1908 • 1d ago
Protecting source code from reverse engineering
Hi everyone,
I am looking to provide a compiled version of our physics solver to our customers. I understand there are many obfuscation techniques to protect source code but I am wondering if there are some smarter ways?
We already cloud computing, the issue is we have customers that are in locations without internet/need realtime solving.
13
u/DamienTheUnbeliever 1d ago
The engineering effort you expend in trying to protect your code produces *zero* value that your paying customers care about. Try to bear that in mind.
And also bear in mind that the *entire games industry* couldn't solve piracy without introducing an always-connected model where some of the IP stays on machines they own. So ask yourself why you think you'll be able to solve a problem they could not?
1
u/ConsciousBath5203 1d ago
And keep in mind, people do far more and are far more passionate about their pixel elf simulators than they are about something that is used for business.
If someone wanted to recreate the physics sim themselves, it would actually be easier to look up the formulas online and build their own from scratch.
18
u/siliconlore 1d ago
Find another way. A smart dedicated reverse engineer will eventually crack whatever scheme you come up with. You would need to embed your code in a cryptographically secure hardware module with some kind of access key where the only thing the module outputs is solution data.
6
u/xtopspeed 1d ago edited 1d ago
I used to work for a somewhat large corporation back in the day that, e.g., manufactures cell phones, and their gist was always that it's more trouble than it's worth and that source code isn’t all that valuable, anyway. Time is much better spent improving the codebase than trying to protect what is already written.
3
3
u/stjarnalux 1d ago
There's always somebody (me, lol) that can, worst case, even without any readable source, dump the asm out of memory and largely figure out what's going on, especially if you already have some clue what it's supposed to do. I spent years of my career dealing with secretive recalcitrant Big Networking vendors who would send us obfuscated code for performance analysis and fundamentally it hid nothing. It's non-trivial, but people who specialize in this are usually quite skilled.
4
u/ReallyEvilRob 1d ago
If someone already has the source code, there isn't anything to reverse engineer. If you want to protect it, then don't release it.
2
u/flyingron 1d ago
The first step is always to remove any symbol information from your distributed materials. If this involves a linkable library, you'll have to avail yourself possibly of some platform specific tools. It might be sufficient to just declare everything but the interfaces you want to expose static, though there's no guarantees (nor is it guarantee to be possible).
As for general disassembly, that's harder (especially with more modern tools) to stop. While they may not get your actual "source" code, they will see your algorithms. You can try to confuse things by wasting time doing steps unrelated to the problem being solved, but that has its own slew of problems (notably the lack of efficiency).
Obfuscation is more of a thing for stuff like the CLR (.NET) stuff that preserves a lot of the source information in the intermediate code.
Some programs (notably embedded stuff) store the program encrypted and decrypt on the fly, but again this is fraught with efficiency and other perils. On most sane general platforms, you can't execute into code you could write as data.
3
u/mlugo02 1d ago
You’d want some anti debugger mechanisms: https://anti-debug.checkpoint.com/techniques/assembly.html
1
u/musbur 6h ago
If this is a B2B situation, you might as well give the entire source code to your customer. The reason they're buying your product is that you deliver good value at a good price. As long as you keep providing that, they have no incentive to spend resources of their own to work on your code. I work in a large company that buys bespoke software from contractors, and nobody would ever look at a single line of code even if they could. There's no business case.
1
u/ThatIsATastyBurger12 1d ago
Licenses and legal action are your best bet. Nothing is foolproof. But realistically, is this an actual problem you have? Do you have any reason to believe that your customers are decompiling and redistributing your solver, or doing anything to infringe on your intellectual property in any way? Even if they are reverse engineering your solver for their own benefit, they still probably rely on you for support and updates. There aren’t that many people who are good at reverse engineering assembly code AND understanding commercial physics solvers.
1
u/Drach88 1d ago
Especially in the age of AI, reverse engineering a compiled binary is not very difficult. Even with obfuscation methods, if someone wants to reverse engineer your methodology, they will.
I used to have to reverse-engineer minified and mangled JavaScript for work, and I have experience reverse-engineering malware. To someone with a bit of experience, getting around obfuscation techniques are just a matter of applying the skills and domain knowledge they are already well versed in.
0
u/runningOverA 1d ago
I was planning to say that those assembly reverse engineers have grown gray beards and most are dead. So don't worry. The few that are still alive don't have time for this.
Then realized, AI has replaced them and they are better than ever.
2
u/ConsciousBath5203 1d ago
I don't think you realize just how popular (or profitable) cheating in video games is... Or that the NSA distributes reverse engineering software that makes the whole process really easy, especially once you start figuring stuff out.
2
0
u/BarracudaDefiant4702 1d ago
Your two biggest options are you make it difficult by layering black boxes. The more effective you are the more It will eat into performance. The most effective option is to host the part you are most concerned about behind an api. It will mean the app (or at least that part of the app) will not function if offline. Many places don't like that, but many companies are starting to sell their products as cloud only.
0
u/Dangerous_Region1682 1d ago
If you are trying to preserve your algorithm against state sponsored actors there isn’t much you can do, they have the business, hardware and software means, along with the expertise to do so.
If you are protecting yourself against more commercial or user level theft then common obfuscation and licensing methods are probably sufficient. At some stage you have to say are certain customers unwilling or unable to use a cloud environment worth the risk?
0
u/jeffbell 1d ago
Self modifying code is hard but modifying a table of callbacks is straightforward.
A buffer overrun to change your return address is fun.
0
0
u/sciencekm 1d ago
As long as the binary is there, anyone can reverse engineer that. You can however make it more difficult with self-modifying code and assembly tricks. Don't bother with high level languages as the output is predictable.
0
u/Daveinatx 1d ago
All code can be decompiled with IDA pro or ghidra. That said, there are ways to try to hide it. Usually you would want to use encryption over essential code, whether it's the application, libraries, or sections of runtime code. Even then, good hackers know what they're looking for at run time even within cache.
Your absolute best way though, is to use keys that are hidden either behind an fpga, USB fob, or possibly within a TPM for key wrapping. Once pages are needed, force it within the cache before decryption. Zero out keys after usage.
I used to get paid a lot for doing this, it's complex to do right. So, it all depends on what level you or your customer wants. But the rest of the details are for you to research.
-1
u/Stickhtot 1d ago
Not necessarily smart but I know that setting the optimization levels to the highest would remove symbols in the assembly which would probably make it harder to reverse engineer
-1
u/tobdomo 1d ago
Strip your binary from all symbolic information. Depending on your host platform and toolchain, e.g. use strip on Linux (see man strip). Use static linking, full optimization (including linker optimization). That is nowhere foolproof, but it makes things a lot harder to begin with.
Then use DRM and Licensing software. This will encrypt and decrypt on the fly. Wibu-Systems for example makes a tool called CodeMeter. Using this software, you can tie and encrypt the binary to a specific machine or a out-of-band key vault (e.g. a USB key or a license file).
54
u/apnorton 1d ago
Like the advice that was given to you over in r/rust, for a B2B piece of software, the way you can protect against reverse engineering is by creating a contract with strong legal penalties for reverse-engineering your software.
Technical means of reverse engineering prevention is a band-aid fix at this time; outside of significant advances in homomorphic encryption schemes (to bring it to a reasonable speed) and having your code execute within a secure enclave, your adversary has the advantage.