Analysis of obfuscated CIL code

Abstract

Abstract This thesis focuses on a technique known as obfuscation. The area has been given much attention in recent years as a low cost technique for software protection. There are already numerous papers concerned with techniques for both obfuscation and deobfuscation, but there are still many untouched issues, and little have been done in practice. The use of obfuscators in practice is one of the issues explored in this thesis, on the .NET platform. Most of today’s obfuscation research is designed and tested on the Java platform. It is therefore interesting to see which techniques that are implemented in the .NET obfuscators. The used .NET language in this thesis is C#. Obfuscation is especially used on high level languages to increase the resilient towards reverse engineering. Reverse engineering is a big problem for software written in Java or .NET languages, because of their bytecode nature. Another issue in this thesis is therefore to look at the techniques used by the obfuscators and investigate if there are techniques which are vulnerable to reverse engineering. A classification of the different obfuscation techniques is therefore given to sort out which techniques that can be viewed as reversible and which are one-way. One thing that is lacking in numerous papers about obfuscation is the actual process of reversing obfuscation techniques. Many papers propose techniques that can be used in reverse engineering, but none show the actual methods. This thesis will therefore try to reverse engineer the obfuscation techniques that are defined as reversible.