Is source code obfuscation quantifiable ?

Are there any metrics that measure the degree of obfuscation in a source file ?


For source code, one possibility is McCabe Cyclomatic Complexity. Some source code analysis tools (McCabe IQ) will use this as a measure of "crappy" code that you should investigate and re-write. Cyclomatic complexity generally indicates excessively convoluted or complicated program logic, and code that will be hard to understand. It might not reflect actual difficulty to reverse engineer though, and also doesn't take into account other types of obfuscations such as constant variable encryption and code encryption, etc.

I think it would be very difficult to objectively quantify all types of obfuscations, because you are trying to measure their ability to withstand attack by an adversary. If you can reduce your program protection problems to cryptographically complex problems (as the authors of Gauss were able to) then I think that is a useful obfuscation metric as it represents work the attacker must perform to un-do your obfuscation. Otherwise, the work level is so variable from obfuscation to obfuscation across one reverse engineer to another that I'm not sure it can be meaningfully measured...


There is a purely theoretical metric for code obfuscation based on abstract interpretation which is delightful. It relies upon the fact that abstract interpretations are comparable with respect to their precision. In particular, in the upper closure operator formulation of abstract interpretation -- where an upper closure operator is created by composing the abstraction and concretization functions, forming a map from the concrete domain to itself -- we can compare the potency of two abstract interpretations by partially-ordering the set of fixedpoints of a given closure map. An operator with strictly more fixedpoints is more precise than, say, one that maps everything to top.

In order to compare obfuscations, we consider the set of abstract interpretations over the original version of the program, and then also over the obfuscated version. Now we can use the same construction described above to compare the potency of obfuscating transformations. Given some observable property a, as encoded by an abstract interpretation, we say that the obfuscator is potent for a if, when preserving abstract interpretation with respect to that property, the fixedpoint is different for the original version versus the transformed version.

Read more here: http://profs.sci.univr.it/~dallapre/ICALP05.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.