What is code obfuscation and what is it used for?

Making data secret, encryption and decryption, are an integral part of the history of computing. Whether for reasons of personal data security, geopolitical strategies, industrial concerns, and so on...

But when you distribute software, or an application available on the web, the code, whether compiled (software) or not (web), must be executable by the client machine and must therefore not be encrypted, as it would then become unusable.

The alternative sometimes chosen is therefore to sufficiently modify the original code (automatically or manually) so that reading and understanding it becomes much more difficult for a malicious user, this is what is called obfuscation (brouillage in French).

Is this technique really effective, and what are its different uses? That's what we're going to look at in the rest of this article!

3 types of code obfuscation

Optimization

Obfuscation is not always a direct intention, but sometimes a consequence, particularly in the world of web front-end. In order to optimize loading times for sites and web applications, it is recommended to use so-called "minification" tools.

During minification, all unnecessary characters are removed, and variable and function names are shortened as much as possible, producing code that is much less readable, but more optimized for loading.

If you want to learn more about minification, I recommend reading our article dedicated to it: https://code-garage.fr/blog/why-and-how-to-minify-your-code-with-parcel/

Artistic

Code is an art. I hope this statement has already sunk in and doesn't need further proof, but there are code obfuscation competitions, aimed at further highlighting the artistic side of programming.

This is notably the case with IOCCC, the "International Obfuscation C Code Contest", a competition made up of several themes, but always revolving around obfuscation.

The goal is to produce functional C code, but with constraints on size, shape, artistic aspects, etc...

Here is a very telling example, of code in the shape of a donut (on the right), which when executed produces an ascii animation of a spinning donut (on the left).

If you're interested in the explanation, here it is: https://www.a1k0n.net/2011/07/20/donut-math.html

Security

The most obvious reason is the attempt to scramble source code (and/or compiled code) in order to prevent other developers from understanding its secrets, reusing it, or modifying it.

This type of obfuscation can, for example, consist of:

• Changing variable/function names
• Adding useless modules/functions/variables
• Encrypting/decrypting modules and loading them on the fly
• Adding thousands of comments, line breaks, tabs, etc...

We can, for example, mention the JSFuck initiative, which provides a great representation of obfuscation:

alert(1);

Becomes in JSFuck (and can be interpreted by a standard Javascript interpreter):

[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()((![]+[])[+!+[]]+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[+!+[]]]+[+!+[]])

If you want to understand how this works: https://github.com/aemkei/jsfuck

Is it really useful?

For minification and the artistic side, the question doesn't really arise, but on the security side, are there any benefits to "obscuring" your code?

Well, not really, in any case this is not a security measure on which you should base your strategy. It can slow down "attacks" or discourage the less persistent or less skilled, but as long as your code ends up on someone's machine, it can always be used, or repurposed.