与大多数人所说的相反，基于他们的直觉和个人经验，我不认为密码安全的程序混淆通常被证明是不可能的。

这是一个完美混淆的程序语句的例子，以证明我的观点:

printf("1677741794\n");

人们永远猜不到它真正的作用是什么

printf("%d\n", 0xBAADF00D ^ 0xDEADBEEF);

关于这个问题有一篇有趣的论文，它证明了一些不可能的结果。它叫做“关于混淆程序的(Im)可能性”。

尽管这篇论文确实证明了使程序与它实现的函数不可区分的混淆是不可能的，但以某种较弱的方式定义的混淆仍然是可能的!

安全网哨兵(原阿拉丁)。不过要注意的是——他们的API很烂，文档也很烂，但与他们的SDK工具相比，这两者都很棒。

I've used their hardware protection method (Sentinel HASP HL) for many years. It requires a proprietary USB key fob which acts as the 'license' for the software. Their SDK encrypts and obfuscates your executable & libraries, and allows you to tie different features in your application to features burned into the key. Without a USB key provided and activated by the licensor, the software can not decrypt and hence will not run. The Key even uses a customized USB communication protocol (outside my realm of knowledge, I'm not a device driver guy) to make it difficult to build a virtual key, or tamper with the communication between the runtime wrapper and key. Their SDK is not very developer friendly, and is quite painful to integrate adding protection with an automated build process (but possible).

Before we implemented the HASP HL protection, there were 7 known pirates who had stripped the dotfuscator 'protections' from the product. We added the HASP protection at the same time as a major update to the software, which performs some heavy calculation on video in real time. As best I can tell from profiling and benchmarking, the HASP HL protection only slowed the intensive calculations by about 3%. Since that software was released about 5 years ago, not one new pirate of the product has been found. The software which it protects is in high demand in it's market segment, and the client is aware of several competitors actively trying to reverse engineer (without success so far). We know they have tried to solicit help from a few groups in Russia which advertise a service to break software protection, as numerous posts on various newsgroups and forums have included the newer versions of the protected product.

最近，我们在一个较小的项目上尝试了他们的软件许可解决方案(HASP SL)，如果您已经熟悉HL产品，那么这个解决方案就足够简单了。它似乎有效;目前还没有关于盗版事件的报道，但这款产品的需求要低得多。

当然，没有什么保护措施是完美的。如果有人有足够的动机，并且有大量的现金可以烧，我相信HASP提供的保护是可以规避的。

安布尔说的完全正确。你可以让逆向工程变得更难，但你永远无法阻止它。永远不要相信依赖于防止逆向工程的“安全性”。

That said, the best anti-reverse-engineering techniques that I've seen focused not on obfuscating the code, but instead on breaking the tools that people usually use to understand how code works. Finding creative ways to break disassemblers, debuggers, etc is both likely to be more effective and also more intellectually satisfying than just generating reams of horrible spaghetti code. This does nothing to block a determined attacker, but it does increase the likelihood that J Random Cracker will wander off and work on something easier instead.

使代码难以进行逆向工程称为代码混淆。

你提到的大多数技术都很容易解决。他们专注于添加一些无用的代码。但是无用的代码很容易被发现和删除，留下一个干净的程序。

为了有效地混淆，您需要使程序的行为依赖于正在执行的无用部分。例如，与其这样做:

a = useless_computation();
a = 42;

这样做:

a = complicated_computation_that_uses_many_inputs_but_always_returns_42();

或者不这样做:

if (running_under_a_debugger()) abort();
a = 42;

这样做(其中running_under_a_debugger不应该很容易被识别为测试代码是否在调试器下运行的函数-它应该将有用的计算与调试器检测混合在一起):

a = 42 - running_under_a_debugger();

有效的混淆并不是仅仅在编译阶段就能做到的。编译器能做的，反编译器也能做。当然，您可以增加反编译器的负担，但这不会有太大的帮助。有效的混淆技术，就其存在而言，包括从第一天开始编写混淆的源代码。让你的代码自修改。你的代码中充斥着从大量输入中得到的计算跳跃。例如，而不是简单的调用

some_function();

这样做，你碰巧知道some_data_structure中精确的位的预期布局:

goto (md5sum(&some_data_structure, 42) & 0xffffffff) + MAGIC_CONSTANT;

如果你认真对待混淆，那就在你的计划中增加几个月的时间;混淆视听代价不菲。请务必考虑到，到目前为止，避免人们对您的代码进行逆向工程的最好方法是使其无用，这样他们就不会费心了。这是一个简单的经济考虑:如果对他们来说价值大于成本，他们就会逆向工程;但提高他们的成本也会大大提高你的成本，所以尽量降低他们的价值。

既然我已经告诉过你，混淆是困难和昂贵的，我要告诉你，无论如何，它不适合你。你写

目前我正在研究的协议绝不能被检查或理解，为了各种人的安全

这是一个危险的信号。它是通过默默无闻来保证安全的，而默默无闻的记录非常糟糕。如果协议的安全性依赖于人们不知道协议，那么你已经输了。

推荐阅读:

安全圣经:Ross Anderson的《安全工程》 混淆的圣经:由Christian Collberg和Jasvir Nagra开发的Surreptitious软件

有人试过codemoth: http://www.sourceformat.com/code-obfuscator.htm吗? 或者Themida: http://www.oreans.com/themida_features.php ?

晚一点看起来更有希望。

为了避免逆向工程，您不能将代码提供给用户。也就是说，我建议使用在线应用程序……然而(因为你没有给出背景)，这对你来说可能是毫无意义的。