# A Framework to Quantify the Quality of Source Code Obfuscation
## 1 Introduction  
Programs designed to execute specific functions within a system are distributed as source code or compiled binaries, often containing sensitive data such as algorithms and encryption keys [1]. Attackers use various tools to extract these assets [2]. Obfuscation techniques protect programs by complicating reverse engineering, thus deterring attacks [3; 4]. These techniques, applied at the code level, conceal important elements while maintaining functionality [5]. Compared to binary obfuscation, source code obfuscation generally has lower performance overhead and is more efficient. Various commercial [6; 7] and open-source [8; 9] tools, as well as researcher-developed methods [10; 11; 12; 13; 14], provide different obfuscation techniques. However, there is a lack of comprehensive analysis and proven quantitative measurement indicators for evaluating the effectiveness of these tools [15; 16]. Deobfuscation, which experts like hackers and analysts perform, is the most direct way to evaluate obfuscation techniques [15]. However, these evaluation methods depend on human expertise and entail significant costs. Furthermore, since these evaluations are based on individual expert characteristics, they are more qualitative and, therefore, challenging to utilize universally. Consequently, numerous studies on obfuscation have turned to quantitative measures when evaluating their techniques. These studies primarily utilize metrics like McCabe cyclomatic complexity [13; 14; 17; 18; 19], Line of Code (LoC) [13; 20; 21; 22], and runtime overhead [10; 23; 24; 25; 26; 27; 28]. Nonetheless, assessing obfuscation quality when only a single or a small number of evaluation indicators are used has limitations. A program, for instance, might still be relatively easy to analyze even with a high McCabe cyclomaticcomplexity index if the number of nodes is small and the size of each node (in terms of the number of instructions) is minimal. Moreover, even if the LoC count is high due to the inclusion of extensive dummy code or newline characters, it can still be easily analyzed by tools or simplified through code optimization techniques. As highlighted in Ebad's review paper [15], numerous indicators can help quantify obfuscation quality, and a more comprehensive evaluation can be achieved by combining and quantifying several of these. Consequently, there is a demonstrated need for an idea or technique to establish indicators to quantify obfuscation quality, and it is essential to conduct quantification experiments using these chosen indicators to demonstrate effectiveness. In this paper, we define and employ specific metrics to quantify obfuscation quality. Aligning with prior studies [5], we evaluate three principal categories: Potency, which reflects the difficulty of direct analysis for humans or analysts; Resilience, which indicates the challenge posed by a tool-based analysis; and Cost, which represents the performance impact of obfuscation on the target program. To assess each category, we identified challenges that program analysts or malicious attackers could face while analyzing obfuscated source code. Our approach involves defining detailed measurement indicators based on the difficulty of analyzing a program. These indicators are then used to obtain quantitative values. We developed a framework for measuring obfuscation quality that quantifies the values of the measurement indicators we define. We employed CFG Analyzer and Binary Analyzer to measure methods related to Potency and Cost, respectively, and utilized KLEE symbolic executor [29], Clang static analysis tool [30] and LLVM opt for measuring Resilience. We integrated measurement technology into the LLVM compiler [31] to measure 12 measurement indicators at the intermediate stages of the binary generation process, including IR code, bitcode, and assembly code. We incorporated our technique into the LLVM compiler source code compilation process.