1. Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP http://www.owasp.org How to Lock Down your Java Byte code? Girish Kulkarni Tech Mahindra, Mumbai kugirish@techmahindra.com 022 - 66882000 31/07/2006

2. OWASP 2 Agenda  Java - Multi platform language  Java Architecture  Java decompilation  Techniques to defeat decompilation Obfuscators Byte code Encrypter/Decrypter Generating Exe from source  Result and summary

3. OWASP 3 Java – Multi platform language JAVA Source Code Compile Java Byte Code Java Virtual Machine Platform specific Machine Code

4. OWASP 4 Java Architecture  Java Byte code  Simplicity of JVM architecture  Byte code format - Well documented  Prone to Reverse Engineering attacks

5. OWASP 5 Java Decompilation  Definition  Demo  Disadvantages

6. OWASP 6 Techniques to defeat Decompilation  Obfuscators  Byte code Encrypter/Decrypter  Generating Exe from source

7. OWASP 7 Techniques to Defeat Decompilation - Obfuscators  Techniques used  Layout Obfuscation  Data Obfuscation  Control Obfuscation  Demo  Pros and cons

8. OWASP 8 Techniques to defeat Decompilation Contd.  Byte code Encrypter/Decrypter  Technique  Vulnerable to attack  Generating Exe from source  Technique  Exe – Platform dependent

9. OWASP 9 Summary and Result  Summary and Result  Questions Thank You