Is it possible to create an object file using
gcc that cannot be reverse engineered to its source code ?
AFAIK that is not possible. There are other things you can keep in mind however:
Use of the GCC optimization flags will help make the code look much less readable to a human. When you compile with the highest level of optimization
gcc -O3 the compiler will move things around such that the "flow" might not be at all what you expect.
You can also use the flag
-static which will force gcc to take small functions and make them inline. This will embed them into your code instead of showing as function calls.. it will make them harder to distinguish.
One thing to keep in mind is too it's important to get rid of any unneeded symbols. Gcc offers
-fvisibility-inlines-hidden to help with this. You can also pass the
-s flag to gcc to strip symbols away.
I think that's about all you can do with gcc to help prevent reverse engineering. Additionally you can use code obfuscation, but there are issues there as well unless you implement it yourself, if you use a readily available method or tool to prevent reverse engineering, there is probably already a tool to counter it.
Keep in mind that the final executable will have information in it as well such as what version of gcc it was compiled with. This too can be removed with the
If I have an executable (
myprog) I can run
objdump on it to check some information:
mike@mike-VirtualBox:~/C$ objdump --full-contents --section=.comment myprog | head myprog: file format elf64-x86-64 Contents of section .comment: 0000 4743433a 20285562 756e7475 2f4c696e GCC: (Ubuntu/Lin 0010 61726f20 342e362e 332d3175 62756e74 aro 4.6.3-1ubunt 0020 75352920 342e362e 3300 u5) 4.6.3.
Oops, you can see what version/compiler I used. Well, we can fix that:
mike@mike-VirtualBox:~/C$ strip -R .comment -R .note myprog mike@mike-VirtualBox:~/C$ objdump --full-contents --section=.comment myprog | head objdump: section '.comment' mentioned in a -j option, but not found in any input file myprog: file format elf64-x86-64
There are other portions you can strip as well, such as
.note.ABI-tag but you do lose portability
Short answer: No.
Long answer: On the (Im)possibility of Obfuscating Programs by Boaz Barak, Oded Goldreich, Rusell Impagliazzo, Steven Rudich, Amit Sahai, Salil Vadhan, and Ke Yang.
Medium answer: If you give your program to a user that control the platform where your program will be executed, there is no way to prevent the reverse-engineering of it. The only thing you can hope for is to force the user to have a black-box analysis approach of your software (meaning that the user will only be able to observe the output of your program on chosen input).
But, even this black-box analysis is extremely difficult to enforce without an additional piece of hardware (eg smartcard) as the user is supposed to be able to take intermediate snapshots of the memory during the execution of your program.
Well, it might be impossible to RE the file to the exact original source code (e.g. there's no way to recover comments or preprocessor macros), but that's probably not what you meant to ask.
It's definitely always possible (though sometimes difficult) to produce an equivalent source code, which behaves the same as the compiled code. With some extra work it might be even possible to produce code which compiles to exactly the same bytecode (as long as there was no additional post-processing of compiled binary). This presentation described some of the approaches for this, but I can't find the slides.