C++ – Is It Important to Obfuscate C++ Application Code?

cdynamic-linkingobfuscationstatic-linking

In the Java world, sometimes it seems to be a problem, but what about C++? Are there different solutions?

I was thinking about the fact that someone can replace the C++ library of a specific OS with a different version of the same library, but full of debug symbols to understand what my code does. Is it a good thing to use standard or popular libraries?

This can also happen with some dll library under Windows replaced with the "debug version" of that library. Is it better to prefer static compilation? In commercial applications, I see that for the core of their app they compile everything statically and for the most part, the DLLs (dynamic libraries in general) are used to offer some third party technologies like anti-piracy solutions (I see this in many games), GUI library (like Qt), OS libraries, etc.

Is static compilation the equivalent to obfuscation in the Java world? In better terms, is it the best and most affordable solution to protect your code?

Best Answer

Don't Waste Your Time on Losing Battles

As noted in many other similar answers for C++ and other languages, this is mostly useless.

Further Reading

Selected reads on the topic (not all are C++ specific, but the general principles apply):

StackExchange Answers

Papers

Famous Quotes on Obfuscation:

Then finally, there is that question of code privacy. This is a lost cause. There is no transformation that will keep a determined hacker from understanding your program. This turns out to be true for all programs in all languages, it is just more obviously true with JavaScript because it is delivered in source form. The privacy benefit provided by obfuscation is an illusion. If you don’t want people to see your programs, unplug your server. - Douglas Crockford


Never?

I'm not saying you should never obfuscate and that there aren't any good reasons for it, but I seriously question the need for it in most cases, and its cost-effectiveness.

Furthermore, there are situations where obfuscation is a de-facto requirement. For instance, if you write viruses, obviously obfuscation (and a dynamic one, preferrably) is as good a thing for your program's survival as it's ability to replicate. However, this hardly constitutes a "common" case...

Related Topic