Code obfuscation tool

You mean obfuscating source code, or the generated assembly?

If you want to obfuscate your code, you don't want other people to modify it (obviously you keep a non obfuscated version somewhere right?)
If you dont want others to modify it, they don't need to compile it. If they don't need to compilet it, why would you make the source code accessible to them in the first place?

So.. the best obfuscation tool would be not to make source code available to other people :)

my 0.001 cent

You are right!
I can't enter into details, but basically I own a software that the company I work for now wants to buy a license for. In the mean time they want me to make the software ready for commercialisation (I do this at work), however they always find excuses not to sign a contract right away. So I am worried they might just use me. Of course one part of the software is in the form of a dll, but the other part (the one that needs bug correction, etc.) contains some good algorithms they might just copy.

So I don't want to change project configurations, just swap some key source files if needed (normal source <--> obfuscated source).

No contract, no software, no exceptions.

I've been in similar situations (where my employer wants to buy/license something from me). My rule is: no contract, no code. Simple as that. Your employer is a business (I assume), so they should completely understand. If they don't, then I'm not sure I'd be jumping to do business with them.

Edit: Bah! Beaten to the punch....

Quote:

Original post by floatingwoods however they always find excuses not to sign a contract right away.

That should make all alarm bells ring.

Obfuscating your source isn't going to help you any. Make them sign a contract. If they don't want to sign any, then assume you are working in a completely untrusted environment.

Technical data security can only be ensured if you work on a trusted platform. That means you should bring your own notebook to your working place, and make sure nothing critical ever leaves it. Keep everything constantly encrypted on a transparently encrypted filesystem. Have appropriate access control, biometric is ideal (lots of newer notebooks now have built-in fingerprint readers). If you connect to their corporate network, always treat the network as entirely untrusted. Keep your sources on a (well protected) source control server somewhere outside of the company. Connect from your notebook over an encrypted channel (SSH tunneling or VPN). Have a strong firewall installed. Turn on a screensaver with reauthentication. Turn off USB ports if you don't use them (eg. in screensaver mode). Never leave your notebook unattended.

Doing this in an entirely consistent manner is the only way to ensure your data is safe in such a working environment. It is also very annoying and a major pain. Seriously, if your company treats you like you said, just quitting might be the better option.

And even that may not be enough, because most working contracts (employer suggests you have at least one of these) contain clauses that the company owns what you make in your working time or with working equipment (sometimes even what you make in your free time).

So even if you use a trusted platform, due to "make the software ready for commercialisation (I do this at work)", they'll simply claim that they own your work, and likely get away with it.

If you have no other option then to work on the code while at work that my suggestion would be to keep the files on a thumb drive and never actually move them over to your work computer.

This way you don't have to worry about them coming to your computer and taking the files. Just remove the thumb drive when ever you walk away from the system.

Tho personally i wouldn't even bring the software into the office because:

1.) as was said before most companies force you to sign a "what ever i come up with while at work( or while employed by this company) is the property of this company".

2.) if you don't trust them there must be a reason, and its probably a good one.

3.) if the code is there and they really really want it no matter how much obfuscation/encryption you add to the files they will eventually get it.

Thank you for all the constructive replies! Of course I try to protect myself with several different means, and code obfuscation is one of them that I would like to implement in a few files.

I looked at some freely available software that is supposed to do that but they don't perform in a very flexible way: given my entire project, I want to be able to specify which c/c++ source code files need obfuscation and which don't. That means that variables and function names declared in a source file that needs obfuscation, that are referenced by source files that don't need obfuscation, then those variables and function names shouldn't be modified (so that the regular code can still be read!). Any such software out there?
I am using VS8 and c/c++.
Would Dotfuscator community edition be able to achieve what I need?

Thanks

Quote:

Original post by floatingwoods I own a software that the company I work for now wants to buy a license for. ... Of course I try to protect myself with several different means, and code obfuscation is one of them that I would like to implement in a few files.

You really need a lawyer.

Technical protections are not enough. The company could claim that they own the software on legal grounds, even if you have never brought it in to the office.

Selling something to the company that employs you can be a nightmare. Most large companies have strict policies about this type of thing because it can cause very evil legal problems.


This type of contract could be handled by a competent business lawyer. Call around, ask about their specialties and prices. Business contract lawyers are fairly inexpensive for the few hours of work that this would take.

Once you have hired the a lawyer, tell the people who want to buy it that you still want to hire it, but because the sale involves a contract you decided that you'll need a lawyer to write the contract. Get your lawyer in touch with their lawyer.

But beware -- selling things to your employer can place your product and your employment at risk if things go badly.

Again, thank you for the reply.
I am in touch with a lawyer, but as I said, I want to protect myself by several means: even with a perfect contract, you'll still need enough money (and maybe even luck) to go to court and win if the company fails to comply. Escpecially in certain countries (I work in an Asian country) (where laws might be bended more than in your home country). So again, yes, a lawyer is important, but protecting your code is also a good idea in addition to that. Think about it: the company had better rewrite the whole application than try to decode the obfuscated code that is several hundred thousand code lines long. This is one additional obstacle for the company. In addition to that, I deliver some functionalities only in a compiled form. But now I am somewhat running out of time and also need to obfuscate some parts of my code. Any suggestion? (other than a laywer please)