  To counter software reverse engineering or tampering, software obfuscation
tools can be used. However, such tools to a large degree hard-code how the
obfuscations are deployed. They hence lack resilience and stealth in the face
of many attacks. To counter this problem, we propose the novel concept of
flexible obfuscators, which implement protections in terms of data structures
and APIs already present in the application to be protected. The protections
are hence tailored to the application in which they are deployed, making them
less learnable and less distinguishable. In our research, we concretized the
flexible protection concept for opaque predicates. We designed an interface to
enable the reuse of existing data structures and APIs in injected opaque
predicates, we analyzed their resilience and stealth, we implemented a
proof-of-concept flexible obfuscator, and we evaluated it on a number of
real-world use cases. This paper presents an in-depth motivation for our work,
the design of the interface, an in-depth security analysis, and a feasibility
report based on our experimental evaluation. The findings are that flexible
opaque predicates indeed provide strong resilience and improved stealth, but
also that their deployment is costly, and that they should hence be used
sparsely to protect only the most security-sensitive code fragments that do not
dominate performance. Flexible obfuscation therefor delivers an expensive but
also more durable new weapon in the ever ongoing software protection arms race.
