1

I'm new to information security but I'm learning about reverse engineering.

I read here about countermeasures to make reverse engineering hard. Does code signing protect the code from reverse engineering?

EDIT: about obfuscation I think fellow have responded. Thanks!

5
  • 1
    As the answerer below says too, signing some data doesn't prevent reading. Signed programs can be dissected as well as unsigned ones. What you can't do with properly signed programs: Change them and make it look like it's the original one. Ie. the user can check if the exe file was changed or not. – deviantfan Feb 26 '16 at 23:53
  • eightShirt - you have some fundamental misunderstandings about the terms you are referencing. We're typically willing to help unconfuse people, but you have so many terms in one question that it is very hard to know where to start. I tried to give a very brief overview in my answer. I hope it helps. If you were to ask specific questions such as "Does code signing protect the code from reverse engineering?", we could probably help you better. Good luck! – Neil Smithline Feb 27 '16 at 3:06
  • Oh. Protection of intellectual property such as source code is only marginally on-topic in this site. Stackoverflow has an obfuscation tag - perhaps you want to look at that to determine if that is a better place to ask? – Neil Smithline Feb 27 '16 at 3:11
  • Some would argue that assembly is already unreadable and requires no obfuscation :) – iAdjunct Feb 27 '16 at 4:40
  • You should open a new question, changing a question so drastically, especially once it has answers, makes it very hard for readers. – Neil Smithline Feb 28 '16 at 0:45
4

You are confusing many terms here. Perhaps I can help.

  • Code signing is the process of cryptographically signing a file so that a user of the file can tell who signed the file and whether it has been modified since signing. It generally doesn't make the file unreadable, though, depending on how the signature is attached to the file, you may need a special tool to examine it. It has no effect on the source code or reverse engineering. Windows has a code signing process called Authenticode that is well documented. You may wish to read about it for general background information.
  • Obfuscatation attempts to make the executable code more difficult to read. This is generally reserved for translated languages like JavaScript and byte-code compiled languages like Java and C#/.NET because it is much easier to view the source of these programs. Obfuscation is unrelated to code signing. You need to search for obfuscation systems for your specific platform (eg: .NET).
  • Nothing will make your assembly code unreadable. After all, the CPU needs to read it to execute your program so it must be readable. That said, obfuscation techniques can make it more difficult to read, though optimized assembler code is already pretty difficult to reverse engineer.

I think that you need to do some more research at this point and come back when you have a better understanding of the basics.

4
  • Ok, but Code signing has no effect to reverse engineering? The right answer here¹ said: "Fortunately we can make reverse engineering harder by: Code signing; Obfuscation of strings, resources, entry points and memory" [1]: security.stackexchange.com/questions/11270/… – eightShirt Feb 27 '16 at 22:46
  • @eightShirt that's wrong. No question about it. – Neil Smithline Feb 27 '16 at 22:55
  • Thanks a lot. You helped me. I'm sorry about the confusing question. – eightShirt Feb 27 '16 at 23:00
  • @eightShirt no worries. Glad we could help. Providing the link to the other question explained a lot. – Neil Smithline Feb 27 '16 at 23:07
0

I'm not sure how code signing could protect your code from being reverse engineered.

However, it could protect your right as a code author (that's one way software providers uses to make sure that the app you have has not been tampered with) .

Obfuscation is simply writing the code in a way that makes it hard to understand. you apply this technique while you're writing your source code. It wont make your assembly "unreadable". The cracker would still be able to see the assembly instructions once he attaches your exe (which you got after compiling your obfuscated code) to a dissembler. However, he will have hard time understanding what it does and translating it to the original code. Here is an example of an obfuscated C code :

#include <stdio.h>
main(t,_,a)
char
*
a;
{
    return!

0<t?
t<3?

main(-79,-13,a+
main(-87,1-_,
main(-86, 0, a+1 )

+a)):

1,
t<_?
main(t+1, _, a )
:3,

main ( -94, -27+t, a )
&&t == 2 ?_
<13 ?

main ( 2, _+1, "%s %d %d\n" )

:9:16:
t<0?
t<-72?
main( _, t,
"@n'+,#'/*{}w+/w#cdnr/+,{}r/*de}+,/*{*+,/w{%+,/w#q#n+,/#{l,+,/n{n+,/+#n+,/#;\
#q#n+,/+k#;*+,/'r :'d*'3,}{w+K w'K:'+}e#';dq#'l q#'+d'K#!/+k#;\
q#'r}eKK#}w'r}eKK{nl]'/#;#q#n'){)#}w'){){nl]'/+#n';d}rw' i;# ){nl]!/n{n#'; \
r{#w'r nc{nl]'/#{l,+'K {rw' iK{;[{nl]'/w#q#\
\
n'wk nw' iwk{KK{nl]!/w{%'l##w#' i; :{nl]'/*{q#'ld;r'}{nlwb!/*de}'c ;;\
{nl'-{}rw]'/+,}##'*}#nc,',#nw]'/+kd'+e}+;\
#'rdq#w! nr'/ ') }+}{rl#'{n' ')# }'+}##(!!/")
:
t<-50?
_==*a ?
putchar(31[a]):

main(-65,_,a+1)
:
main((*a == '/') + t, _, a + 1 )
:

0<t?

main ( 2, 2 , "%s")
:*a=='/'||

main(0,

main(-61,*a, "!ek;dc i@bK'(q)-[w]*%n+r3#l,{}:\nuwloca-O;m .vpbks,fxntdCeghiry")

,a+1);}  
3
  • How does code signing protect a code author's rights? – Neil Smithline Feb 27 '16 at 2:54
  • 1
    "Obfuscation is simply writing the code in a way that makes it hard to understand" - there also exists obfuscation tools that work at the source code, byte code, or even assembly code levels. I think that is what the OP is talking about. – Neil Smithline Feb 27 '16 at 2:57
  • BTW, it is hard to give a good answer to such a confusing question. This question will definitely be closed because it is really too hard to answer in the format of this site. – Neil Smithline Feb 27 '16 at 2:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.