IT Hare on Soft.ware

“Technically, what we’re looking for here, is any kind of bijection; we’ll use this bijection to convert our data from one representation into another one (and as it is a bijection, we can revert it later).”

“As we’re not writing our obf<> classes manually (instead, we have a code generator doing it for us on each build), the sky is the limit to the obfuscations we can generate.”

“Bingo! We’ve got an executable, which automagically performs TONS of integrity checks, which checks are spread all over the executable, and are extremely non-obvious too.”

“This approach of ‘not revealing code until attack costs are high’ is certainly not limited to payments.”

“it is fundamentally impossible to prevent (or detect) debugging, at least as long we’re staying on one single box.”

“DON’T spend more than 10% of your overall anti-bot-fighting time budget on system-specific protections.”