Automated Application Code Obfuscation with Iterative Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for remote application code obfuscation require manual retesting and resubmission of applications, which is inefficient and may damage the application code, and do not effectively prevent reverse engineering.
Innovation Solution
A cloud-based service that instruments the application code, captures input/output data during testing, and automatically generates and tests obfuscated code to ensure functionality and transparency reduction, with iterative adjustments to achieve successful obfuscation without customer intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual retesting and resubmission is used for obfuscated code, then functionality verification is achieved, but time consumption and operational complexity increase significantly
Solution Approach 1:
The patent applies preliminary action by automatically generating test cases and executing them against obfuscated code before manual review. The system pre-prepares test inputs and expected outputs, then automatically runs them against the obfuscated code to verify functionality, eliminating the need for time-consuming manual retesting and resubmission cycles.
Solution Approach 2:
The system implements self-service by having the obfuscation tool automatically perform functionality verification through automated testing. The tool generates test cases, executes them against the obfuscated code, compares outputs, and determines whether the obfuscation preserved functionality without requiring external manual testing intervention.
2Reliability
If code obfuscation is applied to prevent reverse engineering, then security is improved, but code transparency and understandability deteriorate
Solution Approach 1:
The patent applies local quality by selectively obfuscating different portions of code with different levels of transformation. Critical security-sensitive sections receive aggressive obfuscation for maximum protection, while other sections maintain higher readability. This localized approach ensures tamper protection where needed while preserving necessary code transparency for maintenance and debugging.
Solution Approach 2:
The system implements parameter changes by adjusting obfuscation intensity and techniques based on code characteristics and security requirements. Different obfuscation parameters (transformation depth, renaming granularity, control flow manipulation) are applied to different code regions, allowing the system to optimize between security and transparency based on local requirements.
3Productivity
If automated testing is implemented for obfuscated code, then productivity is improved, but system complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the automated testing system into distinct modular components: test case generation module, code execution module, output comparison module, and verification result module. Each component handles a specific aspect of the testing process, making the overall complex system manageable through clear separation of concerns and independent module development.
Solution Approach 2:
The system implements universality by designing the automated testing framework to handle multiple obfuscation techniques and code types through a unified interface. The same core testing infrastructure supports different obfuscation methods (control flow obfuscation, data obfuscation, naming obfuscation) without requiring separate testing systems, reducing overall complexity while maintaining high productivity.
Data Source
AI summary
Techniques for application code obfuscation are disclosed. In one embodiment, the techniques may be realized as a method including receiving application code and testing data associated with the application; automatically generating obfuscated application code from the received application code; automatically testing the obfuscated application code by running the obfuscated application code and inputting at least the recorded inputs from the testing data while recording associated outputs; in response to determining that the associated outputs from automatically testing the obfuscation code do not match the testing data outputs, modifying the obfuscated application code and automatically testing the modified obfuscated application code against the testing data; and, in response to determining that outputs from automatically testing the modified obfuscated application code match the testing data outputs, transmitting the modified obfuscated application code as a successful obfuscation of the application.