Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP How to Lock Down your Java Byte code? Girish Kulkarni Tech Mahindra, Mumbai /07/2006

OWASP 2 Agenda  Java - Multi platform language  Java Architecture  Java decompilation  Techniques to defeat decompilation Obfuscators Byte code Encrypter/Decrypter Generating Exe from source  Result and summary

OWASP 3 Java – Multi platform language JAVA Source Code Compile Java Byte Code Java Virtual Machine Platform specific Machine Code

OWASP 4 Java Architecture  Java Byte code  Simplicity of JVM architecture  Byte code format - Well documented  Prone to Reverse Engineering attacks

OWASP 5 Java Decompilation  Definition  Demo  Disadvantages

OWASP 6 Techniques to defeat Decompilation  Obfuscators  Byte code Encrypter/Decrypter  Generating Exe from source

OWASP 7 Techniques to Defeat Decompilation - Obfuscators  Techniques used  Layout Obfuscation  Data Obfuscation  Control Obfuscation  Demo  Pros and cons

OWASP 8 Techniques to defeat Decompilation Contd.  Byte code Encrypter/Decrypter  Technique  Vulnerable to attack  Generating Exe from source  Technique  Exe – Platform dependent

OWASP 9 Summary and Result  Summary and Result  Questions Thank You