How to obfuscate my code.
-
wrote on 6 Apr 2020, 13:13 last edited by
I have Qt GUI project and when i built it, i found with hex editor that there is my MySql connection data.
How can i protect and obfuscate my code?
-
Lifetime Qt Championwrote on 6 Apr 2020, 13:25 last edited by SGaist 4 Jun 2020, 13:25
Hi and welcome to devnet,
The best way is to not have that data in your binary at all. It's typically something your user should fill settings for.
-
Hi and welcome to devnet,
The best way is to not have that data in your binary at all. It's typically something your user should fill settings for.
wrote on 6 Apr 2020, 13:50 last edited by@SGaist It's database with logins and passes. I can't give access to it to users.
-
Where is that database supposed to be located ?
What is it used for ? -
wrote on 6 Apr 2020, 19:49 last edited by
@SGaist On remote mysql server, i need to obfuscate servername, username, dbaname, and pass. For logins and passwords of users.
-
It sounds like you should rather provide a web service to access the data behind the database rather than hard coding all these informations in your application.
-
It sounds like you should rather provide a web service to access the data behind the database rather than hard coding all these informations in your application.
wrote on 6 Apr 2020, 20:41 last edited by@SGaist It's harder then just obfucate code. So i can't do that?
-
wrote on 6 Apr 2020, 21:05 last edited by
It doesn't matter if you obfuscate the code. The solution to de-obfuscate is in the code itself. So someone can still figure out how to get your database password and info. They can just look at the memory of the app to see this data. Also, if you ever change passwords the code breaks for the users who need to get the updated app.
-
@SGaist It's database with logins and passes. I can't give access to it to users.
wrote on 6 Apr 2020, 23:34 last edited byIt's database with logins and passes. I can't give access to it to users.
@InferusAnima If you can't give it to users, then You Can't Give It To Users.
Giving them a program with the credentials baked in is fundamentally the wrong solution to that category of problem, no matter how much you try to obfuscate it. Reverse engineering it is going to be pretty much trivial.
-
wrote on 7 Apr 2020, 06:19 last edited by
One rather simple solution is to encrypt this data. Still, this means that you also need to provide the key for decryption along with it. So, anyone who wants to get to that data still will figure it out. Nevertheless, it is not that obvious anymore when looking at the hex dump of your executable.
Note that this approach only obfuscates, but does not prevent anybody looking at it.
1/10