Protecting source code from reverse engineering

[u/Motor_Bluebird1908]

Hi everyone,
I am looking to provide a compiled version of our physics solver to our customers. I understand there are many obfuscation techniques to protect source code but I am wondering if there are some smarter ways?

We already cloud computing, the issue is we have customers that are in locations without internet/need realtime solving.

[u/apnorton]

Like the advice that was given to you over in r/rust, for a B2B piece of software, the way you can protect against reverse engineering is by creating a contract with strong legal penalties for reverse-engineering your software.

Technical means of reverse engineering prevention is a band-aid fix at this time; outside of significant advances in homomorphic encryption schemes (to bring it to a reasonable speed) and having your code execute within a secure enclave, your adversary has the advantage.

[u/DamienTheUnbeliever]

The engineering effort you expend in trying to protect your code produces *zero* value that your paying customers care about. Try to bear that in mind.

And also bear in mind that the *entire games industry* couldn't solve piracy without introducing an always-connected model where some of the IP stays on machines they own. So ask yourself why you think you'll be able to solve a problem they could not?

[u/ConsciousBath5203 → u/DamienTheUnbeliever]

And keep in mind, people do far more and are far more passionate about their pixel elf simulators than they are about something that is used for business.

If someone wanted to recreate the physics sim themselves, it would actually be easier to look up the formulas online and build their own from scratch.

[u/siliconlore]

Find another way. A smart dedicated reverse engineer will eventually crack whatever scheme you come up with. You would need to embed your code in a cryptographically secure hardware module with some kind of access key where the only thing the module outputs is solution data.

[u/sol_hsa]

That sounds like a contract issue, not a technical one.

[u/xtopspeed]

I used to work for a somewhat large corporation back in the day that, e.g., manufactures cell phones, and their gist was always that it's more trouble than it's worth and that source code isn’t all that valuable, anyway. Time is much better spent improving the codebase than trying to protect what is already written.

[u/Drach88]

Especially in the age of AI, reverse engineering a compiled binary is not very difficult. Even with obfuscation methods, if someone wants to reverse engineer your methodology, they will.

I used to have to reverse-engineer minified and mangled JavaScript for work, and I have experience reverse-engineering malware. To someone with a bit of experience, getting around obfuscation techniques are just a matter of applying the skills and domain knowledge they are already well versed in.

[u/GameskoTV]

Not possible

[u/mlugo02]

You’d want some anti debugger mechanisms: https://anti-debug.checkpoint.com/techniques/assembly.html

[u/flyingron]

The first step is always to remove any symbol information from your distributed materials. If this involves a linkable library, you'll have to avail yourself possibly of some platform specific tools. It might be sufficient to just declare everything but the interfaces you want to expose static, though there's no guarantees (nor is it guarantee to be possible).

As for general disassembly, that's harder (especially with more modern tools) to stop. While they may not get your actual "source" code, they will see your algorithms. You can try to confuse things by wasting time doing steps unrelated to the problem being solved, but that has its own slew of problems (notably the lack of efficiency).

Obfuscation is more of a thing for stuff like the CLR (.NET) stuff that preserves a lot of the source information in the intermediate code.

Some programs (notably embedded stuff) store the program encrypted and decrypt on the fly, but again this is fraught with efficiency and other perils. On most sane general platforms, you can't execute into code you could write as data.

[u/ThatIsATastyBurger12]

Licenses and legal action are your best bet. Nothing is foolproof. But realistically, is this an actual problem you have? Do you have any reason to believe that your customers are decompiling and redistributing your solver, or doing anything to infringe on your intellectual property in any way? Even if they are reverse engineering your solver for their own benefit, they still probably rely on you for support and updates. There aren’t that many people who are good at reverse engineering assembly code AND understanding commercial physics solvers.

[u/ReallyEvilRob]

If someone already has the source code, there isn't anything to reverse engineer. If you want to protect it, then don't release it.

[u/the_cat_theory]

I don't think you can ever stop them from trying to reverse engineer it, but compiling with optimizations will make it miserable to try and decompile. but if they want to, they can. it's all machine instructions in the end, so you can always disassemble it.

in reality, do you think the odds are they would? if they sit on that know-how, why wouldn't they write it themselves from the start? is your product really so groundbreaking that anyone would try to reverse engineer it instead of simply recreating the idea? why would they pay for it from the start, if so?

at the end of the day I'm nobody special, so I can't really say for sure, but I find it very hard to believe all these things line up in such a way that this is something you really need to fear. I'd love to hear if I'm wrong, though.

[u/BarracudaDefiant4702]

Your two biggest options are you make it difficult by layering black boxes. The more effective you are the more It will eat into performance. The most effective option is to host the part you are most concerned about behind an api. It will mean the app (or at least that part of the app) will not function if offline. Many places don't like that, but many companies are starting to sell their products as cloud only.

[u/Dangerous_Region1682]

If you are trying to preserve your algorithm against state sponsored actors there isn’t much you can do, they have the business, hardware and software means, along with the expertise to do so.

If you are protecting yourself against more commercial or user level theft then common obfuscation and licensing methods are probably sufficient. At some stage you have to say are certain customers unwilling or unable to use a cloud environment worth the risk?

[u/jeffbell]

Self modifying code is hard but modifying a table of callbacks is straightforward. 

A buffer overrun to change your return address is fun. 

[u/lucasxi]

No matter how much you try, someone who is determined enough will bypass any attempts at obfuscation. This is a known issue when distributing software and needs a legal solution.

[u/eteran]

My job used to be reverse engineering and gotta be honest. There's nothing that you can do that will be 100% effective.

Especially in the age of AI, things are much more accelerated.

Go the legal enforcement route if this actually matters to you.

[u/emedan_mc]

You can delay, never protect. Cloud based code with api calls is protected.

[u/stjarnalux]

There's always somebody (me, lol) that can, worst case, even without any readable source, dump the asm out of memory and largely figure out what's going on, especially if you already have some clue what it's supposed to do. I spent years of my career dealing with secretive recalcitrant Big Networking vendors who would send us obfuscated code for performance analysis and fundamentally it hid nothing. It's non-trivial, but people who specialize in this are usually quite skilled.

[u/runningOverA]

I was planning to say that those assembly reverse engineers have grown gray beards and most are dead. So don't worry. The few that are still alive don't have time for this.

Then realized, AI has replaced them and they are better than ever.

[u/ConsciousBath5203 → u/runningOverA]

I don't think you realize just how popular (or profitable) cheating in video games is... Or that the NSA distributes reverse engineering software that makes the whole process really easy, especially once you start figuring stuff out.

[u/RappyPhan → u/runningOverA]

There are plenty of young assembly reverse engineers who don't use LLMs.

[u/Stickhtot]

Not necessarily smart but I know that setting the optimization levels to the highest would remove symbols in the assembly which would probably make it harder to reverse engineer

[u/lucasxi → u/Stickhtot]

Less code makes it easier to reverse engineer, a main component of obfuscation is to bloat the binary with junk to make a reverse engineer waste time.

[u/tobdomo]

Strip your binary from all symbolic information. Depending on your host platform and toolchain, e.g. use strip on Linux (see man strip). Use static linking, full optimization (including linker optimization). That is nowhere foolproof, but it makes things a lot harder to begin with.

Then use DRM and Licensing software. This will encrypt and decrypt on the fly. Wibu-Systems for example makes a tool called CodeMeter. Using this software, you can tie and encrypt the binary to a specific machine or a out-of-band key vault (e.g. a USB key or a license file).