I have seen the following macro definitions in a coding book.

    #define TRUE  &#39;/&#39;/&#39;/&#39;
    #define FALSE &#39;-&#39;-&#39;-&#39;

There was no explanation there.

Please explain to me how these will work as `TRUE` and `FALSE`.

Strange definitions of TRUE and FALSE macros

I&#39;m looking for a free open source tool-set that will compile various &quot;classic&quot; scripting languages, e.g. Korn Shell, ksh, csh, bash etc. as an executable -- and if the script calls other programs or executables, for them to be included in the single executable.

Reasons:

1. To obfuscate the code for delivery to a customer so as not to reveal our Intellectual Property - for delivery onto a *customer&#39;s* own machine/systems for which I have no control over what permissions I can set regarding access, so the program file has to be binary whereby the workings cannot be easily seen by viewing in a text editor or `hexdump` viewer.

2. To make a single, simply deployed program for the customer without/or a minimal amount of any external dependencies.

I would prefer something simple without the need for package manager since:

1. I can&#39;t rely on the customer&#39;s knowledge to carry out (un) packaging instructions and

2. I can&#39;t rely on the policies governing their machines regarding installing packages (and indeed from third parties). 

The simplest preferred approach is to be able to compile to proper machine code a single executable that will run out of the box without any dependencies.

How to compile a linux shell script to be a standalone executable *binary* (i.e. not just e.g. chmod 755)?

Given by a colleague as a puzzle, I cannot figure out how this C program actually compiles and runs. What is this `&gt;&gt;&gt;=` operator and the strange `1P1` literal? I have tested in Clang and GCC. There are no warnings and the output is &quot;???&quot;

    #include &lt;stdio.h&gt;

    int main()
    {
        int a[2]={ 10, 1 };
	
        while( a[ 0xFULL?&#39;\0&#39;:-1:&gt;&gt;&gt;=a&lt;:!!0X.1P1 ] )
            printf(&quot;?&quot;);
	
	    return 0;
    }

What is the &gt;&gt;&gt;= operator in C?

I&#39;m looking for a way to obfuscate and deobfuscate a string in JavaScript; by which I mean encryption and decryption when security is not an issue. Ideally something native to JS (like `base64_encode()` and `base64_decode()` in PHP) to &quot;turn a string into something else and back again&quot; without having to write a function.

Any suggestions welcome!

Simplest way to obfuscate and deobfuscate a string in JavaScript

I wonder if anyone uses commercial/free java obfuscators on his own commercial product. I know only about one project that actually had an obfuscating step in the ant build step for releases.

Do you obfuscate? And if so, why do you obfuscate?

Is it really a way to protect the code or is it just a better feeling for the developers/managers?

**edit:** Ok, I to be exact about my point: Do you obfuscate to protect your IP (your algorithms, the work you&#39;ve put into your product)? I won&#39;t obfuscate for security reasons, that doesn&#39;t feel right. So I&#39;m only talking about protecting your applications code against competitors.

[@staffan][1] has a good point:

&gt; The reason to stay away from chaining code flow is that some of those changes makes it impossible for the JVM to efficiently optimize the code. In effect it will actually degrade the performance of your application.


  [1]: https://stackoverflow.com/users/988/staffan

Do you obfuscate your commercial Java code?

I&#39;ve wondered for some time how some software hides secret keys in such a way that they can&#39;t be trivially discovered. Just a few examples:

- DVD Player Software hides CSS keys
- Software with serial numbers/registration codes hides keys/hashes used to validate the serial numbers

Obviously, these programs do something more than just have the key in a byte[], as that would make it easy to steal their keys and generate your own serial numbers, etc.

What sorts of strategies are used to hide these keys so that they can&#39;t be found easily?


How do you hide secret keys in code?

I&#39;m trying to figure out whether I can build a static library that hides all of its internal objects and functions, etc, except for the interfaces I want to export. I&#39;m experimenting with Xcode (gcc 4.2).

I&#39;ve used the `__attribute__((visibility(&quot;hidden&quot;)))` attribute on some C++ classes per [this documentation][1]. I&#39;ve also defined little helper C functions as being file-local (static), etc.

However, when I run `strings` on the resulting .a library file, even when compiled in Release configuration, I still see the names of my ostensibly-hidden classes, with their method names, and even the names of file-local functions strewn around in there as well. 

I&#39;ve added the `-fvisibility=hidden` and even `-fno-rtti` to the gcc flags. While this reduces some of the strings, the class names, method names, and static functions names are all still in there in plain or mangled-but-readable form. 

Is there a reliable way to get the compiler to build this stuff without having the string names of all the internal stuff emitted into the binary? It shouldn&#39;t be necessary to have for any external clients linking in.

(To clarify: I&#39;m asking about obfuscation of internal naming, versus literal export binding needs. I&#39;m disconcerted that all the internal workings are visible via the `strings` command, regardless of whether these symbols are formally exported or not.)

Thanks.

  [1]: http://developer.apple.com/mac/library/documentation/DeveloperTools/Conceptual/CppRuntimeEnv/Articles/SymbolVisibility.html

Symbol hiding in static libraries built with Xcode

I got this warning message:

&gt; This App Bundle contains Java/Kotlin code, which might be obfuscated. We recommend you upload a deobfuscation file to make your crashes and ANRs easier to analyze and debug

what does it mean? what is the shortest solution for this?

Android version release warning message: This App Bundle contains Java/Kotlin code, which might be obfuscated

How does this C program work?

    main(_){_^448&amp;&amp;main(-~_);putchar(--_%64?32|-~7[__TIME__-_/8%8][&quot;&gt;&#39;txiZ^(~z?&quot;-48]&gt;&gt;&quot;;;;====~$::199&quot;[_*2&amp;8|_/64]/(_&amp;2?1:8)%8&amp;1:10);}

It compiles as it is (tested on `gcc 4.6.3`). It prints the time when compiled. On my system:

        !!  !!!!!!              !!  !!!!!!              !!  !!!!!! 
        !!  !!  !!              !!      !!              !!  !!  !! 
        !!  !!  !!              !!      !!              !!  !!  !! 
        !!  !!!!!!    !!        !!      !!    !!        !!  !!!!!! 
        !!      !!              !!      !!              !!  !!  !! 
        !!      !!              !!      !!              !!  !!  !! 
        !!  !!!!!!              !!      !!              !!  !!!!!!

Source: [sykes2 - A clock in one line](http://www.ioccc.org/years-spoiler.html#2006), [sykes2 author hints](http://www.ioccc.org/2006/sykes2/hint.text)

Some hints: No compile warnings per default. Compiled with `-Wall`, the following warnings are emitted:

    sykes2.c:1:1: warning: return type defaults to ‘int’ [-Wreturn-type]
    sykes2.c: In function ‘main’:
    sykes2.c:1:14: warning: value computed is not used [-Wunused-value]
    sykes2.c:1:1: warning: implicit declaration of function ‘putchar’ [-Wimplicit-function-declaration]
    sykes2.c:1:1: warning: suggest parentheses around arithmetic in operand of ‘|’ [-Wparentheses]
    sykes2.c:1:1: warning: suggest parentheses around arithmetic in operand of ‘|’ [-Wparentheses]
    sykes2.c:1:1: warning: control reaches end of non-void function [-Wreturn-type]


Obfuscated C Code Contest 2006. Please explain sykes2.c

Has anybody used a good obfuscator for PHP? I&#39;ve tried some but they don&#39;t work for very big projects. They can&#39;t handle variables that are included in one file and used in another, for instance.

Or do you have any other tricks for stopping the spread of your code?


Is there a code obfuscator for PHP?

I&#39;ve been contemplating how to protect my C/C++ code from disassembly and reverse engineering.  Normally I would never condone this behavior myself in my code; however the current protocol I&#39;ve been working on must not ever be inspected or understandable, for the security of various people.

Now this is a new subject to me, and the internet is not really resourceful for *prevention against reverse engineering* but rather depicts tons of information on *how to reverse engineer*

Some of the things I&#39;ve thought of so far are:

 - Code injection (calling dummy functions before and after actual function calls)
 - Code obfustication (mangles the disassembly of the binary)
 - Write my own startup routines (harder for debuggers to bind to)  

    &lt;!--- lang-c ---!&gt;

        void startup();  
        int _start()   
        {  
            startup( );  
            exit   (0)   
        }  
        void startup()  
        {  
            /* code here */  
        }

 - Runtime check for debuggers (and force exit if detected)
 - Function trampolines


    &lt;!--- lang-c ---!&gt;

         void trampoline(void (*fnptr)(), bool ping = false)  
         {  
           if(ping)  
             fnptr();  
           else  
             trampoline(fnptr, true);  
         }

 - Pointless allocations and deallocations (stack changes a lot)
 - Pointless dummy calls and trampolines (tons of jumping in disassembly output)
 - Tons of casting (for obfuscated disassembly)

I mean these are some of the things I&#39;ve thought of but they can all be worked around and or figured out by code analysts given the right time frame.  Is there anything else alternative I have?


Protecting executable from reverse engineering?

I saw the following code in [this commit][2] for [MongoDB&#39;s Java Connection driver][3], and it appears at first to be a joke of some sort. What does the following code do?

    if (!((_ok) ? true : (Math.random() &gt; 0.1))) {
        return res;
    }

(EDIT: the code [has been updated since][1] posting this question)

  [1]: https://github.com/mongodb/mongo-java-driver/commit/8e02cd006d79acd1d0ae6604c2ee7537b250c044#diff-08d4a794472cb22d6bf2c4bb0615aa49L212
  [2]: https://github.com/mongodb/mongo-java-driver/blob/1d2e6faa80aeb5287a26d0348f18f4b51d566759/src/main/com/mongodb/ConnectionStatus.java#L213
  [3]: https://github.com/mongodb/mongo-java-driver


Why does the MongoDB Java driver use a random number generator in a conditional?

This code prints the map of India. How does it work?

    #include &lt;stdio.h&gt;
    main()
    {
        int a,b,c;
        int count = 1;
        for (b=c=10;a=&quot;- FIGURE?, UMKC,XYZHello Folks,\
        TFy!QJu ROo TNn(ROo)SLq SLq ULo+\
        UHs UJq TNn*RPn/QPbEWS_JSWQAIJO^\
        NBELPeHBFHT}TnALVlBLOFAkHFOuFETp\
        HCStHAUFAgcEAelclcn^r^r\\tZvYxXy\
        T|S~Pn SPm SOn TNn ULo0ULo#ULo-W\
        Hq!WFs XDt!&quot; [b+++21]; )
        for(; a-- &gt; 64 ; )
        putchar ( ++c==&#39;Z&#39; ? c = c/ 9:33^b&amp;1);
        return 0;
    }

How does this code generate the map of India?

My product has several components: ASP.NET, Windows Forms App and Windows Service. 95% or so of the code is written in VB.NET.

For Intellectual Property reasons, I need to obfuscate the code, and until now I have been using a version of dotfuscator which is now over 5 years old. I&#39;m thinking it is time to move to a new generation tool. What I&#39;m looking for is a list of requirements which I should consider when searching for a new obfuscator.

What I know I should look for so far:

* ***Serialization/De-serialization***. In my current solution, I simply tell the tool **not** to obfuscate any class data members because the pain of not being able to load data which was previously serialized is simply too big.
* ***Integration with Build Process***
* ***Working with ASP.NET***. In the past, I have found this problematic due to changing .dll names (you often have one per page) - which not all tools handle well.

.NET obfuscation tools/strategy

I want to make a JavaScript application that&#39;s not open source, and thus I wish to learn how to can obfuscate my JS code? Is this possible?

How can I obfuscate (protect) JavaScript?

I am developing a piece of software in Python that will be distributed to my employer&#39;s customers. My employer wants to limit the usage of the software with a time-restricted license file.

If we distribute the `.py` files or even `.pyc` files it will be easy to (decompile and) remove the code that checks the license file.

Another aspect is that my employer does not want the code to be read by our customers, fearing that the code may be stolen or at least the &quot;novel ideas&quot;.

Is there a good way to handle this problem?

How do I protect Python code from being read by users?

I&#39;ve spent the past few days working on updating my personal website. The URL of my personal website is (my first name).(my last name).com, as my last name is rather unusual, and I was lucky enough to pick up the domain name. My e-mail address is (my first name)@(my last name).com. So really, when it comes down to guessing it, it&#39;s not very hard.

Anyways, I want to integrate a mailto: link into my website, so people can contact me. And, despite my e-mail address not being very hard to guess, I&#39;d rather not have it harvested by spam bots that just crawl websites for e-mail address patterns and add them to their database.

What is the best way for me to obfuscate my e-mail address, preferably in link form? The methods I know of are:

    &lt;a href=&quot;mailto:x@y.com&quot;&gt;e-mail me&lt;/a&gt;

It works, but it also means that as soon as my website hits Google, I&#39;ll be wading through spam as spam bots easily pick out my e-mail address.

    &lt;img src=&quot;images/e-mail.png&quot; /&gt;

This is less desirable, because not only will visitors be unable to click on it to send me an e-mail, but smarter spam bots will probably be able to detect the characters that the image contains.

I know that there is probably no perfect solution, but I was just wondering what everyone thought was best. I&#39;m definitely willing to use JavaScript if necessary, as my website already makes use of tons of it.



Best way to obfuscate an e-mail address on a website?

I want to automate a fairly simple task. For this I have written a small PHP script which I run from the command line using PHP-CLI. Now I want to hand over this script to someone but I do not want to:

 - give away the source code
 - ask him to install PHP on the system

Is there a way to create a .exe version of the PHP script. I am really not much worried about de-compilation; I am more worried about asking people to install and configure PHP.

Convert a PHP script into a stand-alone windows executable

_this question is difficult to summarize in a question title_

__UPDATE__
I created a JSFiddle that builds an obfuscated string out of your input based on the letters extracted from this question: You can access it [here][1], or would a [gist][2] be easier?

I recently came across a fun bit of obfuscated JavaScript in [this profile][3] that looks like this:

    javascript:[[]+1/!1][1^1][1&gt;&gt;1]+({}+[])[1&lt;&lt;1^11&gt;&gt;1]+([]+!!-
    [])[1&lt;&lt;1]+[/~/+{}][+!1][-~1&lt;&lt;1]+([]+/-/[(!!1+[])[1&gt;&gt;1]+(!!1
    +[])[1&lt;&lt;1^1]+(!1+[])[1|1&lt;&lt;1]+(!!1+[])[1^1]])[1^11&lt;&lt;1]+([,][
    ~1]+[])[1-~1]+[[]+{}][!1.1%1][11111.1%11.1*111e11|!1]+(/1/+
    1/[1&lt;1][1%1])[1^11]+[[],[]+{}][1][+1]+(/&lt;&lt;/[1]+[])[1/1.1&amp;1]

Sorry to ruin the surprise but when this is evaluated it returns this:

    &quot;I love you&quot; in Chrome
    &quot;I lone you&quot; In Firefox
    &quot;I lo[e you&quot; in IE10

The way this works when broken out, is to generate a series of messages and to pull letters out of them like so (using the &quot;I&quot; as an example):

    []+1/!1
    returns
    &quot;Infinity&quot;
    then
    [[]+1/!1]
    creates this array:
    [&quot;Infinity&quot;]
    then
    [[]+1/!1][1^1]
    Takes the first (1^1 == 0) element of that array
    &quot;Infinity&quot;
    finally
    [[]+1/!1][1^1][1&gt;&gt;1]
    Takes the first (1&gt;&gt;1 == 0) char of that string
    &quot;I&quot;

Other strings that are generated include:

    ({}+[])       -&gt; &quot;[object Object]&quot; (where the space comes from)
    ([]+!!-[])    -&gt; &quot;false&quot; (used for it&#39;s &quot;l&quot;)
    [/~/+{}][+!1] -&gt; &quot;/~/[object Object]&quot; (this is used for an &quot;o&quot;)
    (/&lt;&lt;/[1]+[])  -&gt; &quot;undefined&quot;

I was interested in finding a replacement for the &quot;n&quot; and &quot;[&quot; and came up with this:

    String.fromCharCode((&#39;1&#39;.charCodeAt(0)&lt;&lt;1)+(10&lt;&lt;1))

Which I feel in in the spirit of using 1&#39;s and 0&#39;s, but violates one of the more elegant aspects of the original code which is the appearance of having nothing to do with strings at all.  Does anyone else have an idea of how to generate a &quot;v&quot; that is in keeping with the original obfuscated code?

___Here is some extra information that was found after many talented JavaScript programers took a deeper look at this___

Firefox returns &quot;I lone you&quot; Because of this line:

    ([]+/-/[(!!1+[])[1&gt;&gt;1]+(!!1+[])[1&lt;&lt;1^1]+(!1+[])[1|1&lt;&lt;1]+(!!1+[])[1^1]])[1^11&lt;&lt;1]+

`[1^11&lt;&lt;1]` trims a specific character from this:

    ([]+/-/[(!!1+[])[1&gt;&gt;1]+(!!1+[])[1&lt;&lt;1^1]+(!1+[])[1|1&lt;&lt;1]+(!!1+[])[1^1]])

Which evaluates to this:

    &quot;function test() {
        [native code]
    }&quot;

Which looks like we might have our &quot;V&quot;!!!

Chrome returns &quot;I love you&quot;, because the same code returns this:

    &quot;function test() { [native code] }&quot;

----
Before the question is closed for questionable connection with &quot;a real programming issue&quot;, I thought I&#39;d add a summarized solution that builds on [@Supr&#39;s][5], [@Cory&#39;s][6] and [@alpha123&#39;s][7], behold:

    alert([[]+1/!1][1^1][1&gt;&gt;1]+({}+[])[1&lt;&lt;1^11&gt;&gt;1]+(
    []+!!-[])[1&lt;&lt;1]+[/~/+{}][+!1][-~1&lt;&lt;1]+[([]+/-/[(
    !!1+[])[1&gt;&gt;1]+(!!1+[])[1&lt;&lt;1^1]+(!1+[])[1|1&lt;&lt;1]+(
    !!1+[])[1^1]])[1+(1^(11+1+1)&lt;&lt;1)],([]+/-/[(!!1+[
    ])[1&gt;&gt;1]+(!!1+[])[1&lt;&lt;1^1]+(!1+[])[1|1&lt;&lt;1]+(!!1+[
    ])[1^1]])[1^11&lt;&lt;1],([]+/-/[(!!1+[])[1&gt;&gt;1]+(!!1+[
    ])[1&lt;&lt;1^1]+(!1+[])[1|1&lt;&lt;1]+(!!1+[])[1^1]])[1^(11
    +1+1)&lt;&lt;1]][((([]+/-/[(!!1+[])[1&gt;&gt;1]+(!!1+[])[1&lt;&lt;
    1^1]+(!1+[])[1|1&lt;&lt;1]+(!!1+[])[1^1]])[(1&lt;&lt;1&lt;&lt;1&lt;&lt;1
    )+1&lt;&lt;1]==({}+[])[1^1])*1)+((([]+/-/[(!!1+[])[1&gt;&gt;
    1]+(!!1+[])[1&lt;&lt;1^1]+(!1+[])[1|1&lt;&lt;1]+(!!1+[])[1^1
    ]])[(1^11&lt;&lt;1)-1]==({}+[])[1^1])&lt;&lt;1)]+([,][~1]+[]
    )[1-~1]+[[]+{}][!1.1%1][11111.1%11.1*111e11|!1]+
    (/1/+1/[1&lt;1][1%1])[1^11]+[[],[]+{}][1][+1]+(/&lt;&lt;/
    [1]+[])[1/1.1&amp;1])

Given the complexity of the code and the message it produces it&#39;s almost like the JavaScript engine is telling how special you make it feel :)


  [1]: http://jsfiddle.net/w9rFF/14/
  [2]: http://bl.ocks.org/jasonsperske/5400283
  [3]: https://stackoverflow.com/users/1249581/vision
  [4]: https://stackoverflow.com/users/1249581/vision
  [5]: https://stackoverflow.com/a/15981930/16959
  [6]: https://stackoverflow.com/a/15980008/16959
  [7]: https://stackoverflow.com/a/15978467/16959
  [8]: https://stackoverflow.com/users/1249581/vision

What are JavaScript&#39;s builtin strings?

Is it possible to hide the Javascript code from the html of a webpage, when the source code is viewed through the browsers View Source feature? 

I know it is possible to obfuscate the code, but I would prefer it being *hidden* from the view source feature.

How do I hide javascript code in a webpage?

I am developing a security software and want to obfuscate my java code so it will become impossible to reverse engineer. What is the most reliable java obfuscator ?

Best Java obfuscator?

The new documentation on [ProGuard for Android][1] says to add a line to the default.properties file in the project home directory. However, on opening this file, I read at the top: 

    # This file is automatically generated by Android Tools. 
    # Do not modify this file -- YOUR CHANGES WILL BE ERASED! 

Am I missing something?

Also, is there a way to enable ProGuard only for a production build from Eclipse (i.e., when exporting the finished product)?


  [1]: http://developer.android.com/guide/developing/tools/proguard.html

Enabling ProGuard in Eclipse for Android

Obfuscation is one way, but it can&#39;t protect from breaking the piracy protection security of the application. How do I make sure that the application is not tampered with, and how do I make sure that the registration mechanism can&#39;t be reverse engineered?

Also it is possible to convert a C# application to native code, and [Xenocode][1] is too costly.

C# provides lot of features, and is the ideal language for my code, so writing the whole codebase again in C++ is out of the question.

Secure certificates can be easily removed from the signed assemblies in .NET.

  [1]: http://en.wikipedia.org/wiki/Spoon_%28software%29


Protect .NET code from reverse engineering?

I need to store sensitive information (a symmetric encryption key that I want to keep private) in my C++ application. The simple approach is to do this:

```
std::string myKey = &quot;mysupersupersecretpasswordthatyouwillneverguess&quot;;
```

However, running the application through the `strings` process (or any other that extracts strings from a binary app) will reveal the above string.

What techniques should be used to obscure such sensitive data?

__Edit:__

OK, so pretty much all of you have said _&quot;your executable can be reverse engineered&quot;_ - of course! This is a pet peeve of mine, so I&#39;m going to rant a bit here:

Why is it that 99% (OK, so perhaps I exaggerate a little) of all security-related questions on this site are answered with a  torrent of &quot;there is no possible way to create a perfectly secure program&quot; - that is not a helpful answer! Security is a sliding scale between perfect usability and no security at one end, and perfect security but no usability at the other. 

The point is that you pick your position on that sliding scale depending on what you&#39;re trying to do and the environment in which your software will run. _I&#39;m not writing an app for a military installation, I&#39;m writing an app for a home PC_. I need to encrypt data across an untrusted network with a pre-known encryption key. In these cases, &quot;security through obscurity&quot; is probably good enough! Sure, someone with enough time, energy and skill could reverse-engineer the binary and find the password, but guess what? I don&#39;t care:

The time it takes me to implement a top-notch secure system is more expensive than the loss of sales due to the cracked versions (not that I&#39;m actually selling this, but you get my point). This blue-sky &quot;lets do it the absolute best way possible&quot; trend in programming amongst new programmers is foolish to say the least.


Thank you for taking the time to answer this question - they were most helpful. Unfortunately I can only accept one answer, but I&#39;ve up-voted all the useful answers.

Techniques for obscuring sensitive strings in C++

Are the users able to convert the apk file of my application back to the actual code?
If they do - is there any way to prevent this?

Is it possible to decompile an Android .apk file?

I&#39;m looking for very simple obfuscation (like encrypt and decrypt but not necessarily secure) functionality for some data. It&#39;s not mission critical. I need something to keep honest people honest, but something a little stronger than [ROT13][1] or [Base64][2].

I&#39;d prefer something that is already included in the [.NET][3] framework 2.0, so I don&#39;t have to worry about any external dependencies.

I really don&#39;t want to have to mess around with public/private keys, etc. I don&#39;t know much about encryption, but I do know enough to know that anything I wrote would be less than worthless... In fact, I&#39;d probably screw up the math and make it trivial to crack.

  [1]: http://en.wikipedia.org/wiki/ROT13
  [2]: http://en.wikipedia.org/wiki/Base64
  [3]: http://en.wikipedia.org/wiki/.NET_Framework


Simple insecure two-way data &quot;obfuscation&quot;?

I have my class `ClassMultiPoint` with subclasses.

    public class ClassMultiPoints
     {
       public String message;
       public List&lt;ClassPoints&gt; data;

       public class ClassPoints
        {
          public String id;
          public List&lt;ClassPoint&gt; points;
          public class ClassPoint
           {
             public String speed;
             public String bearing;
           }
        }
     }


I will get value of object `oPoints` from parse `GSON`:

`oPoints = gson.fromJson( jsonString, ClassMultiPoints.class);`

I try use `oPoints.message`.

When I run my application without `proguard` app run success.
When I run my app with `proguard` my app crash.

I think problem is: `proguard` rename attribute `&#39;oPoints.message&#39;` of my class to short `&#39;a&#39;`. 

I try keep the names of the methods and attributes is constant, but `proguard` rename its:

`proguard.cfg:`

    -injars      bin/classes
    -injars      libs
    -outjars     bin/classes-processed.jar
    -dontpreverify
    -repackageclasses &#39;&#39;
    -allowaccessmodification
    -optimizations !code/simplification/arithmetic
    -keepattributes *Annotation*
    -dontskipnonpubliclibraryclasses
    -optimizationpasses 5
    -printmapping map.txt
    -flattenpackagehierarchy
    
    -keep public class * extends android.app.Activity
    -keep public class * extends android.app.Application
    -keep public class * extends android.app.MapActivity
    -keep public class * extends android.app.Service
    -keep public class * extends android.content.BroadcastReceiver
    -keep public class * extends android.content.ContentProvider
    
    -libraryjars  libs/commons-io-2.2.jar
    -libraryjars  libs/ftp4j-1.7.1.jar
    -libraryjars  libs/gson-2.2.2.jar
    
    -keep public class org.apache.commons.io.**
    -keep public class it.sauronsoftware.ftp4j.**
    -keep public class com.google.gson.**
    
    -keep public class com.mypackagename.ActivityMonitor$*
    
    -keep public class * extends android.view.View {
        public &lt;init&gt;(android.content.Context);
        public &lt;init&gt;(android.content.Context, android.util.AttributeSet);
        public &lt;init&gt;(android.content.Context, android.util.AttributeSet, int);
        public void set*(...);
    }
    
    -keepclasseswithmembers class * {
        public &lt;init&gt;(android.content.Context, android.util.AttributeSet);
    }
    
    -keepclasseswithmembers class * {
        public &lt;init&gt;(android.content.Context, android.util.AttributeSet, int);
    }
    
    -keepclassmembers class * extends android.content.Context {
       public void *(android.view.View);
       public void *(android.view.MenuItem);
    }
    
    -keepclassmembers class * implements android.os.Parcelable {
        static android.os.Parcelable$Creator CREATOR;
    }
    
    -keepclassmembers class **.R$* {
        public static &lt;fields&gt;;
    }
    
What is right way to keep names of the methods and attributes of the my one (static) class?

Prevent class member name obfuscation by ProGuard

    #include &lt;stdio.h&gt;
    #define decode(s,t,u,m,p,e,d) m##s##u##t
    #define begin decode(a,n,i,m,a,t,e)
    
    int begin()
    {
    	printf(&quot;Ha HA see how it is?? &quot;);
    }

Does this indirectly call `main`? how?

This obfuscated C code claims to run without a main(), but what does it really do?

Sometimes, it is useful to hide a string from a binary (executable) file.
For example, it makes sense to hide encryption keys from binaries.

When I say “hide”, I mean making strings harder to find in the compiled binary.

For example, this code:

    const char* encryptionKey = &quot;My strong encryption key&quot;;
    // Using the key

after compilation produces an executable file with the following in its data section:

&lt;!-- language: lang-none --&gt;

    4D 79 20 73 74 72 6F 6E-67 20 65 6E 63 72 79 70   |My strong encryp|
    74 69 6F 6E 20 6B 65 79                           |tion key        |

You can see that our secret string can be easily found and/or modified.

I could hide the string…

    char encryptionKey[30];
    int n = 0;
    encryptionKey[n++] = &#39;M&#39;;
    encryptionKey[n++] = &#39;y&#39;;
    encryptionKey[n++] = &#39; &#39;;
    encryptionKey[n++] = &#39;s&#39;;
    encryptionKey[n++] = &#39;t&#39;;
    encryptionKey[n++] = &#39;r&#39;;
    encryptionKey[n++] = &#39;o&#39;;
    encryptionKey[n++] = &#39;n&#39;;
    encryptionKey[n++] = &#39;g&#39;;
    encryptionKey[n++] = &#39; &#39;;
    encryptionKey[n++] = &#39;e&#39;;
    encryptionKey[n++] = &#39;n&#39;;
    encryptionKey[n++] = &#39;c&#39;;
    encryptionKey[n++] = &#39;r&#39;;
    encryptionKey[n++] = &#39;y&#39;;
    encryptionKey[n++] = &#39;p&#39;;
    encryptionKey[n++] = &#39;t&#39;;
    encryptionKey[n++] = &#39;i&#39;;
    encryptionKey[n++] = &#39;o&#39;;
    encryptionKey[n++] = &#39;n&#39;;
    encryptionKey[n++] = &#39; &#39;;
    encryptionKey[n++] = &#39;k&#39;;
    encryptionKey[n++] = &#39;e&#39;;
    encryptionKey[n++] = &#39;y&#39;;

…but it&#39;s not a nice method. Any better ideas?

PS: I know that merely hiding secrets doesn&#39;t work against a determined attacker, but it&#39;s much better than nothing…

Also, I know about assymetric encryption, but it&#39;s not acceptable in this case. I am refactoring an existing appication which uses Blowfish encryption and passes encrypted data to the server (the server decrypts the data with the same key).

I **can&#39;t** change the encryption algorithm because I need to provide backward compatibility. I **can&#39;t** even change the encryption key.

How to hide a string in binary code?

First of all, I&#39;m not looking for miracle... I know how PHP works and that there&#39;s not really way to hide my code from the clients without using encryption. But that comes with the cost of an extension to be installed on the running server.

I&#39;m looking for something different though... I&#39;m not looking to encrypt my code or even obfuscate it. There are many PHP scripts without encrypted/obfuscated code but they are commercial applications. For instance, vBulletin and/or IP.Board forum applications.

I just want to know what approach do these guys use for their applications...

I&#39;m also open to any other suggestions.

Please note that I&#39;m a single person and not working for a company. My product is also very specific, it won&#39;t sell that much. I just want you guys to know that I can&#39;t afford to consult a legal professional either to sue someone or prepare a commercial license. I&#39;m just looking for a simple way to protect my simple product, if it&#39;s indeed possible, somehow...

Best solution to protect PHP code without encryption

I recently came upon the following code:

    IntPredicate neg = x -&gt; x &lt;- x;

What is this, some sort of reverse double lambda?

What does the -&gt; &lt;- operator do?

When I got something like this

    ERROR/AndroidRuntime(18677): Caused by: java.lang.NullPointerException
    ERROR/AndroidRuntime(18677):     at com.companyname.a.a.a(Unknown Source)

How can I know where the problem is and debug this issue?
I only got the mapping output from ProGuard and don&#39;t know the line number.
Thanks.


How to debug with obfuscated (with ProGuard) applications on Android?

I&#39;ve researched quite a bit, both on SO, as well google-ing all over the place, but I can&#39;t seem to find a straight-forward answer in regards to code obfuscation for iPhone/iPad apps written in Objective-C.

My questions are these:

1. Is there a way to do it?  If so, how?
2. Is it worth it?
3. Does Apple allow it, or have a problem with it, when the app is submitted to them?




iPhone/iPad App Code Obfuscation - Is it Possible? Worth it?

**What:** Can NodeJS apps be distributed as binary? ie. you compile the .js app via V8 into its native binary, and distribute the binary to clients? (if you had total access to the NodeJS server)... or is minifying the code all you can do?

**Why:** We build serverside applications in NodeJS for clients, that have often to be hosted on the client&#39;s servers. Distributing source code means clients can easily steal our solution and stop paying licensing fees. This opens up the possibility of easy reverse-engineering or reuse of our apps without our awareness.

Secure distribution of NodeJS applications

This is a small piece of JavaScript code that alerts &quot;Hello world&quot;:

    ﾟωﾟﾉ=/｀ｍ&#180;）ﾉ~┻━┻//*&#180;∇｀*/[&#39;_&#39;];o=(ﾟｰﾟ)=_=3;c=(ﾟΘﾟ)=(ﾟｰﾟ)-(ﾟｰﾟ);(ﾟДﾟ)=(ﾟΘﾟ)=(o^_^o)/(o^_^o);(ﾟДﾟ)={ﾟΘﾟ:&#39;_&#39;,ﾟωﾟﾉ:((ﾟωﾟﾉ==3)+&#39;_&#39;)[ﾟΘﾟ],ﾟｰﾟﾉ:(ﾟωﾟﾉ+&#39;_&#39;)[o^_^o-(ﾟΘﾟ)],ﾟДﾟﾉ:((ﾟｰﾟ==3)+&#39;_&#39;)[ﾟｰﾟ]};(ﾟДﾟ)[ﾟΘﾟ]=((ﾟωﾟﾉ==3)+&#39;_&#39;)[c^_^o];(ﾟДﾟ)[&#39;c&#39;]=((ﾟДﾟ)+&#39;_&#39;)[(ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ)];(ﾟДﾟ)[&#39;o&#39;]=((ﾟДﾟ)+&#39;_&#39;)[ﾟΘﾟ];(ﾟoﾟ)=(ﾟДﾟ)[&#39;c&#39;]+(ﾟДﾟ)[&#39;o&#39;]+(ﾟωﾟﾉ+&#39;_&#39;)[ﾟΘﾟ]+((ﾟωﾟﾉ==3)+&#39;_&#39;)[ﾟｰﾟ]+((ﾟДﾟ)+&#39;_&#39;)[(ﾟｰﾟ)+(ﾟｰﾟ)]+((ﾟｰﾟ==3)+&#39;_&#39;)[ﾟΘﾟ]+((ﾟｰﾟ==3)+&#39;_&#39;)[(ﾟｰﾟ)-(ﾟΘﾟ)]+(ﾟДﾟ)[&#39;c&#39;]+((ﾟДﾟ)+&#39;_&#39;)[(ﾟｰﾟ)+(ﾟｰﾟ)]+(ﾟДﾟ)[&#39;o&#39;]+((ﾟｰﾟ==3)+&#39;_&#39;)[ﾟΘﾟ];(ﾟДﾟ)[&#39;_&#39;]=(o^_^o)[ﾟoﾟ][ﾟoﾟ];(ﾟεﾟ)=((ﾟｰﾟ==3)+&#39;_&#39;)[ﾟΘﾟ]+(ﾟДﾟ).ﾟДﾟﾉ+((ﾟДﾟ)+&#39;_&#39;)[(ﾟｰﾟ)+(ﾟｰﾟ)]+((ﾟｰﾟ==3)+&#39;_&#39;)[o^_^o-ﾟΘﾟ]+((ﾟｰﾟ==3)+&#39;_&#39;)[ﾟΘﾟ]+(ﾟωﾟﾉ+&#39;_&#39;)[ﾟΘﾟ];(ﾟｰﾟ)+=(ﾟΘﾟ);(ﾟДﾟ)[ﾟεﾟ]=&#39;\\&#39;;(ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ﾟｰﾟ)[o^_^o-(ﾟΘﾟ)];(oﾟｰﾟo)=(ﾟωﾟﾉ+&#39;_&#39;)[c^_^o];(ﾟДﾟ)[ﾟoﾟ]=&#39;\&quot;&#39;;(ﾟДﾟ)[&#39;_&#39;]((ﾟДﾟ)[&#39;_&#39;](ﾟεﾟ+(ﾟДﾟ)[ﾟoﾟ]+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)+(o^_^o))+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)+(o^_^o))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ)+(ﾟΘﾟ))+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟΘﾟ)+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+((ﾟｰﾟ)+(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)-(ﾟΘﾟ))+((ﾟｰﾟ)+(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+((ﾟｰﾟ)+(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)+(o^_^o))+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟoﾟ])(ﾟΘﾟ))(&#39;_&#39;);

A good looking version:

    ﾟωﾟﾉ = /｀ｍ&#180;）ﾉ~┻━┻//*&#180;∇｀*/[&#39;_&#39;];
    o = (ﾟｰﾟ) = _ = 3;
    c = (ﾟΘﾟ) = (ﾟｰﾟ) - (ﾟｰﾟ);
    (ﾟДﾟ) = (ﾟΘﾟ) = (o^_^o)/(o^_^o);
    (ﾟДﾟ) = {
      ﾟΘﾟ:  &#39;_&#39;,
      ﾟωﾟﾉ: ((ﾟωﾟﾉ==3)+&#39;_&#39;)[ﾟΘﾟ],
      ﾟｰﾟﾉ: (ﾟωﾟﾉ+&#39;_&#39;)[o^_^o-(ﾟΘﾟ)],
      ﾟДﾟﾉ: ((ﾟｰﾟ==3)+&#39;_&#39;)[ﾟｰﾟ]
    };
    (ﾟДﾟ)[ﾟΘﾟ] = ((ﾟωﾟﾉ==3)+&#39;_&#39;)[c^_^o];
    (ﾟДﾟ)[&#39;c&#39;] = ((ﾟДﾟ)+&#39;_&#39;)[(ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ)];
    (ﾟДﾟ)[&#39;o&#39;] = ((ﾟДﾟ)+&#39;_&#39;)[ﾟΘﾟ];
    (ﾟoﾟ)=(ﾟДﾟ)[&#39;c&#39;] + (ﾟДﾟ)[&#39;o&#39;] + (ﾟωﾟﾉ + &#39;_&#39;)[ﾟΘﾟ] + ((ﾟωﾟﾉ==3) + &#39;_&#39;)[ﾟｰﾟ] + ((ﾟДﾟ) + &#39;_&#39;)[(ﾟｰﾟ) + (ﾟｰﾟ)] + ((ﾟｰﾟ==3) + &#39;_&#39;)[ﾟΘﾟ] + ((ﾟｰﾟ==3) + &#39;_&#39;)[(ﾟｰﾟ) - (ﾟΘﾟ)] + (ﾟДﾟ)[&#39;c&#39;] + ((ﾟДﾟ) + &#39;_&#39;)[(ﾟｰﾟ) + (ﾟｰﾟ)] + (ﾟДﾟ)[&#39;o&#39;] + ((ﾟｰﾟ==3) + &#39;_&#39;)[ﾟΘﾟ];
    (ﾟДﾟ)[&#39;_&#39;] = (o^_^o)[ﾟoﾟ][ﾟoﾟ];
    (ﾟεﾟ) = ((ﾟｰﾟ==3) + &#39;_&#39;)[ﾟΘﾟ] + (ﾟДﾟ).ﾟДﾟﾉ + ((ﾟДﾟ) + &#39;_&#39;)[(ﾟｰﾟ) + (ﾟｰﾟ)] + ((ﾟｰﾟ==3) + &#39;_&#39;)[o^_^o-ﾟΘﾟ] + ((ﾟｰﾟ==3) + &#39;_&#39;)[ﾟΘﾟ] + (ﾟωﾟﾉ+&#39;_&#39;)[ﾟΘﾟ];
    (ﾟｰﾟ) += (ﾟΘﾟ);
    (ﾟДﾟ)[ﾟεﾟ] = &#39;\\&#39;;
    (ﾟДﾟ).ﾟΘﾟﾉ = (ﾟДﾟ+ﾟｰﾟ)[o^_^o-(ﾟΘﾟ)];
    (oﾟｰﾟo) = (ﾟωﾟﾉ+&#39;_&#39;)[c^_^o];
    (ﾟДﾟ)[ﾟoﾟ] = &#39;\&quot;&#39;;
    (ﾟДﾟ)[&#39;_&#39;]((ﾟДﾟ)[&#39;_&#39;](ﾟεﾟ+(ﾟДﾟ)[ﾟoﾟ]+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)+(o^_^o))+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)+(o^_^o))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ)+(ﾟΘﾟ))+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟΘﾟ)+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+((ﾟｰﾟ)+(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+(c^_^o)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)-(ﾟΘﾟ))+((ﾟｰﾟ)+(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+((ﾟｰﾟ)+(o^_^o))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((o^_^o)+(o^_^o))+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+(ﾟｰﾟ)+(ﾟｰﾟ)+(ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+((o^_^o)-(ﾟΘﾟ))+(ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ)+(ﾟΘﾟ))+(ﾟΘﾟ)+(ﾟДﾟ)[ﾟoﾟ])(ﾟΘﾟ))(&#39;_&#39;);

[JSFiddle](http://jsfiddle.net/E4b5d/1/)
-

It is taken from here: *https://codegolf.stackexchange.com/questions/23975/obfuscation-challenge/24041#24041*

How does it work? I don&#39;t even see the `alert` in that code.



How does this magic JavaScript code work?

Is it possible to hide/encode/encrypt the php file/source code, and let others have the system installed and run on their machine?

Is it possible to hide/encode/encrypt php source code and let others have the system?

Is there any way to hide or encrypt JavaScript code to prevent people from viewing, copying, and/or modifying proprietary programs?

How can I hide or encrypt JavaScript code?

I want visitors to be able to click on (or copy) an email address directly on my webpage. However, if I could make it (a little bit) harder for bots and other crawlers to get said email address and register it in a spam list, it would be awesome.

I found different ways of doing this (i.e. encoding mailto HTML links), either with JavaScript or in pure HTML, but what do you guys recommend ? The JavaScript techniques seem more complicated, but this may potentially affect users that have it turned off, and legit crawlers like Google.

On the other hand, the HTML one seems a bit basic, the bot writers should have figured it out by now...

Should I bother at all doing this, or will the spammers get my email anyway ? I know that antispam filters are getting better and better, but if I can do something more to slow spammers down, I will.

How to spamproof a mailto link?

I plan to release one small, low priced utility. Since this is more hobby than business, I planned to use Dotfuscator Community Edition that is shipped with VS2008. 

How good is it? 

I could also use definition of &quot;good enough obfuscator&quot; - what features are missing from Dotfuscator Community Edition to make it good enough. 

**Edit:**

I checked pricing on number of commercial obfuscators and they cost a lot. Is it worth it? 

Are commercial versions that much better protecting from reverse engineering?  

I&#39;m not very afraid of my application being cracked (it will be disappointing if application is so bad that no one is interested in cracking it). It&#39;s not heavily protected anyway, not overly complex serial key and licence checks on few places in code. It just bugs me that without obfuscation, somebody can easily get source code, rebrand it and sell it as its own.  

Does this happens a lot?

**Edit 2:**

Can somebody recommend commercial obfuscator. I found lots of them, all of them are expensive, some even don&#39;t have price listed on web site.  

Feature wise, all products seem more or less similar. 

What is minimal set of features obfuscator should have? 


All Obfuscation Solutions on Gang of Coders

Total of 39 Obfuscation Solutions