0

I am trying to hide original code from library file which is written in C++. My question is "How can I hide my code securely when I built library file, like .o or .so ?"

Environment description

  • Ubuntu 20.04 LTS (with WSL2)
  • gcc 9.3.0

Problem description.

Source code

let's think there is test.cpp file

#include <iostream>

void foo() {
    std::cout << "This is FOO\n";
}
int bar() {
    int a = 5;
    int b = 12;
    std::cout << "This is BAR\n";
    return a + b;
}
char test() {
    std::cout << "This is TEST\n";
    return 'T';
}

How did I build (on terminal)

$ g++ -o test.o -c test.cpp -O2
$ g++ -c -fPIC test.cpp -o test.so -O2

I built 2 files if there is difference between object file and static object file to solve my problem.

test.o

You can see like below picture. There is "FOO" "BAR" or something else.

test.o

and also when I use nm test.o it shows function name like T _Z3barv T _Z3foov etc.

$ nm test.o
0000000000000000 r .LC0
000000000000000d r .LC1
000000000000001a r .LC2
                 U _GLOBAL_OFFSET_TABLE_
0000000000000000 t _GLOBAL__sub_I__Z3foov
0000000000000020 T _Z3barv
0000000000000000 T _Z3foov
0000000000000050 T _Z4testv
                 U _ZNSt8ios_base4InitC1Ev
                 U _ZNSt8ios_base4InitD1Ev
                 U _ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_l
                 U _ZSt4cout
0000000000000000 b _ZStL8__ioinit
                 U __cxa_atexit
                 U __dso_handle

test.so

This file also shows "FOO" "BAR" things which prints string.

test.so

like above, when I use nm test.so, it shows function name like T _Z3barv T _Z3foov etc.

$ nm test.so
0000000000000000 r .LC0
000000000000000d r .LC1
000000000000001a r .LC2
                 U _GLOBAL_OFFSET_TABLE_
0000000000000000 t _GLOBAL__sub_I_test.cpp
0000000000000020 T _Z3barv
0000000000000000 T _Z3foov
0000000000000050 T _Z4testv
                 U _ZNSt8ios_base4InitC1Ev
                 U _ZNSt8ios_base4InitD1Ev
                 U _ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_l
                 U _ZSt4cout
0000000000000000 b _ZStL8__ioinit
                 U __cxa_atexit
                 U __dso_handle

Question

I want to hide everything securely, so that the malicious cannot disassemble my library easily. Can I hide that strings like "FOO" "BAR" "TEST"?

TyeolRik
  • 466
  • 2
  • 25
  • @luk2302 Oh thank you. Then How can I hide the functions that .cpp used? When I use ```nm test.o``` I can read the function name. – TyeolRik Dec 25 '21 at 18:46
  • Related question https://stackoverflow.com/questions/52719364/how-to-use-the-attribute-visibilitydefault – 273K Dec 25 '21 at 18:56
  • You are probably looking for [obfuscation](https://en.wikipedia.org/wiki/Obfuscation_(software)). – zdf Dec 25 '21 at 19:08
  • @S.M. Thank you. I skimmed the link, it looks like what I am looking for. – TyeolRik Dec 25 '21 at 19:13
  • @zdf: Obfuscation is the art of making a source file more difficult to read. – Thomas Matthews Dec 25 '21 at 19:15
  • @zdf Well, I read the wikipedia that you linked, it is not. But I will try to do it to my code :) – TyeolRik Dec 25 '21 at 19:15
  • Overall, this is all pointless, hiding stuff in `.o` files. If you are giving your customers `.o` files, then they have full and complete access. Hiding things in it (encryption) will slow things down, which will make customers unhappy. What you do, in real life, is sign an agreement with customers so that they have to pay you _a lot_ when they distribute/leak what you give them (basically NDA), or you just distribute your service as a cloud. – KamilCuk Dec 25 '21 at 19:31
  • `Then How can I hide the functions that .cpp used? When I use nm test.o` Please do not ask multiple questions, please see https://meta.stackoverflow.com/questions/266767/what-is-the-the-best-way-to-ask-follow-up-questions . Which functions do you want to remove from `nm` output? `_Z3barv` or `_ZNSt8ios_base4InitC1Ev` or both? Does `objcopy --strip-symbol=_Z3barv` answer your question? – KamilCuk Dec 25 '21 at 19:37
  • I always operate under the assumption that a sufficiently motivated party can reverse engineer anything. Additionally I would say obfuscation doesn't so much apply to source code, rather to the output. It is generally achieved with encoders or other tooling. – floomby Dec 25 '21 at 19:40

0 Answers0