Are there any metrics for code obfuscation?

Question

Is source code obfuscation quantifiable ?

Are there any metrics that measure the degree of obfuscation in a source file ?

Answer 1

For source code, one possibility is McCabe Cyclomatic Complexity. Some source code analysis tools (McCabe IQ) will use this as a measure of "crappy" code that you should investigate and re-write. Cyclomatic complexity generally indicates excessively convoluted or complicated program logic, and code that will be hard to understand. It might not reflect actual difficulty to reverse engineer though, and also doesn't take into account other types of obfuscations such as constant variable encryption and code encryption, etc.

I think it would be very difficult to objectively quantify all types of obfuscations, because you are trying to measure their ability to withstand attack by an adversary. If you can reduce your program protection problems to cryptographically complex problems (as the authors of Gauss were able to) then I think that is a useful obfuscation metric as it represents work the attacker must perform to un-do your obfuscation. Otherwise, the work level is so variable from obfuscation to obfuscation across one reverse engineer to another that I'm not sure it can be meaningfully measured...

Answer 2

There is a purely theoretical metric for code obfuscation based on abstract interpretation which is delightful. It relies upon the fact that abstract interpretations are comparable with respect to their precision. In particular, in the upper closure operator formulation of abstract interpretation -- where an upper closure operator is created by composing the abstraction and concretization functions, forming a map from the concrete domain to itself -- we can compare the potency of two abstract interpretations by partially-ordering the set of fixedpoints of a given closure map. An operator with strictly more fixedpoints is more precise than, say, one that maps everything to top.

In order to compare obfuscations, we consider the set of abstract interpretations over the original version of the program, and then also over the obfuscated version. Now we can use the same construction described above to compare the potency of obfuscating transformations. Given some observable property a, as encoded by an abstract interpretation, we say that the obfuscator is potent for a if, when preserving abstract interpretation with respect to that property, the fixedpoint is different for the original version versus the transformed version.

Read more here: http://profs.sci.univr.it/~dallapre/ICALP05.pdf

Answer 3

To be more practical in the question of code obfuscation, there are several metrics that can be used:

• The percentage of optimized and non-optimized obfuscated code after the compiler optimization pass and the overall effectiveness of the obfuscation.
• The percentage of changed bytes at the binary level for two obfuscated binaries, as well as the percentage of similarity between them.
• Statistics for opcodes in the original binary and the binary with obfuscated source code, including the number of movs, leas, jumps, calls, pushes, and other opcodes that were added.
• The percentage of changes in the control flow of the code in the IDA code graph for the original binary and the binary with obfuscated source code. The use of automatic tools to simplify, optimize, and deobfuscate the code, and a comparison of the original binary with the optimized one.

By using these metrics, it is possible to get a more practical and quantitative understanding of the effectiveness of code obfuscation techniques. This can help organizations make informed decisions about how to protect their code and intellectual property.