Experimental Evaluation of the Obfuscation Techniques Against Reverse Engineering

Abstract

Source code obfuscation is one of the techniques used by software developers to protect their software. Obfuscation techniques transform the original code to a new protected version which is harder for the attackers to understand but have the same function as the original one. Most of obfuscation techniques are not based on well-defined measurements to clarify their effectiveness in protecting the source code from reveres engineering attacks. This paper presents an experimental study to investigate the effectiveness of specific control flows obfuscation technique—A parameterized flattening—in software protection against human attacks. We conduct an experiment, where software developers participate to perform an attack task on two applications written in C sharp programming language where one of the applications is clear and the other one is obfuscated with control flow obfuscation technique. As a result of the statistical analysis used in this paper, it is shown that only the obfuscation treatment significantly affects the correctness of the attacker to perform a successful attack, where the obfuscation reduced the correctness of the attacker by 50%. The complexity of the application has no significant effect on the correctness of the understanding tasks. Also, neither obfuscation treatment nor the complexity of the application has any effect on the correctness of the modification attack tasks.