0

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables.

Are there any resources that target specifically shared and static libraries?

If not, are the techniques for executables mainly applicable for static/dynamic libraries?

Thanks!

closed as too broad by perror, NirIzr, peter ferrie, jvoisin, Vitaly Osipov Jan 19 '17 at 2:24

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • It should be pretty straight forward to adjust anti-debugging techniques from executables to libraries. Which parts are you having difficulties with? – NirIzr Jan 13 '17 at 17:30
  • Apparently I can use the tutorials for executable. I have (now) no difficulties. I needed to assess the feasibility before embarking in this effort. – senseiwa Jan 15 '17 at 10:36
2

To the best of my knowledge theoretically most obfuscation techniques are also applicable to libraries, but there are considerable downsides: Slowdown and increased support-difficulties. Please note if a program does something, there is always a way to find out how it archived it when you control the execution environment.

I'd advise you to keep any business logic you want to protect out of libraries by keeping the libraries generic. If your business model concerns the distribution of logic you want to keep a secret - its a pretty bad situation.

If you really want to offer some confidential functionality and performance is not an issue, think about offering it on the server side.

  • I agree, but what if I need in my business to offer secret functionalities on a client? I know this is bad, but are there additional recommendations? – senseiwa Jan 15 '17 at 10:38
  • 1
    When performance isn't of utmost importance, you can still apply anti-reversing obfuscation. These may slow down, but experienced reversers will always be able to find out what is happening. – Nordwald Jan 15 '17 at 12:24
1

I think all anti-debug and anti-reversing techniques are also applicable to shared and static libraries. Shared libraries are still code, just placed in a different file format. I guess people don't talk much about anti-reversing techniques in library codes since the techniques are the same.

  • I tend to disagree, since symbols are important and most obfuscation has influence on the performance which is unfavorably in case of shared libraries which do heavy lifting. – Nordwald Jan 12 '17 at 8:44
  • 1
    I see. Good point. – yellowbyte Jan 17 '17 at 6:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.