From: Will Drewry <will@...>
Date: 2004-06-04T02:20:53+09:00
Subject: Re: Obfuscating Ruby Code.


Just for a little bit of fun, I wrote a dumb obfuscator. It takes a ruby script
and converts it to a C integer array with the ASCII values increased by 
array size and the letter's index in the array.  This is then included in a C
source file.  This then converts the code back to a char array in dynamically
allocated memory and evaluates it with rb_eval_string_protect.

Here's what it looks like:

$ ls
code.rb  foo.c  to_cary

# We want to obfuscate code.rb.
$ cat code.rb
require 'openssl'
puts "obfuscated ruby - woohoo!"
puts "Here's a hash:"
foo = OpenSSL::Digest::SHA1.new
foo.update("obfuscate me baby")
puts foo


$ cat to_cary
#!/usr/bin/ruby -w

def file2cary(path)
  header = "static int code[] = { "
  footer = " };\n"
  body = ''
  me = 0

  body << header
  file = File.read(path)
  file.each do |line|
    line.split('').each do |chr|
      body << "#{chr[0]-(file.size+me)}, "
      me += 1
    end
  end
  body << footer
  body << "#define RUBY_CODE_SIZE #{file.size}\n"
  return body
end

puts file2cary(ARGV[0])

$ ./to_cary code.rb > code.h
$ cat code.h

static int code[] = { -32, -46, -35, -32, -45, -37, -51, -121, -115,
-44, -44, -56, -48, -44, -45, -53, -123, -153, -52, -48, -50, -52,
-136, -135, -59, -73, -70, -56, -59, -76, -79, -61, -77, -79, -148,
-67, -65, -85, -63, -153, -141, -155, -69, -78, -79, -87, -81, -82,
-161, -161, -186, -85, -81, -83, -85, -169, -168, -131, -103, -91,
-105, -168, -93, -177, -113, -179, -108, -116, -99, -111, -158, -183,
-208, -117, -109, -110, -190, -162, -192, -146, -114, -126, -118,
-146, -147, -155, -174, -175, -166, -130, -133, -136, -123, -123,
-182, -183, -159, -171, -179, -196, -200, -137, -147, -130, -240,
-149, -141, -142, -208, -138, -144, -157, -161, -143, -159, -221,
-228, -152, -166, -163, -149, -152, -169, -172, -154, -170, -240,
-164, -173, -243, -178, -180, -180, -158, -246, -240, -272, -171,
-167, -169, -171, -255, -186, -178, -179, -281,  };
#define RUBY_CODE_SIZE 146

$ cat foo.c

/*
 * debian-build: gcc -I/usr/lib/ruby/1.8/i386-linux
-L/usr/lib/ruby/1.8/i386-linux -O2 foo.c -o foo -lruby1.8
 * redhat-build: gcc -I/usr/lib/ruby/1.8/i686-linux-gnu
-L/usr/lib/ruby/1.8/i686-linux-gnu -O2 foo.c -o foo -lruby
 */

#include "ruby.h" 
RUBY_EXTERN VALUE ruby_errinfo;

#include "code.h"

int main() {
  int state=0, i;
  char *real_code;

  real_code = (char *)malloc(sizeof(char[RUBY_CODE_SIZE]));
  for(i=0;i<RUBY_CODE_SIZE;i++) {
    real_code[i] = (char)(code[i]+(RUBY_CODE_SIZE+i));
  }
  ruby_init();
  ruby_init_loadpath();
  ruby_script("my_cool_code");
  rb_eval_string_protect(real_code, &state);
  if (state) {
    rb_p(ruby_errinfo);
   }
  free(real_code);
  return state;
}


$ gcc -I/usr/lib/ruby/1.8/i686-linux-gnu
-L/usr/lib/ruby/1.8/i686-linux-gnu -O2 foo.c -o foo -lruby

$ strip -s foo

$ ./foo
obfuscated ruby - woohoo!
Here's a hash:
4fd04f3b648e92d2356c2ee577c2c2ff523bbee4

# end of fake shell experience 

Now if you 'hexedit' the executable, any visible ascii will look like
gibberish. What's cool is that you can fiddle with the to_cary script
to use a custom "obfuscation algorithm" for your program.  This should
deter the average code prodder.  Anyone who pokes around with the
runtime heap memory will get the script they were after though.  This
also doesn't help much if your code is in a lot of separate files.  It
all really depends on how much code is getting obfuscated, and if you
can write a build process to stick it all in one ruby file. There are
no doubt much better ideas, but this was a fun experiment.

I'm pretty sure you can write the above code, compile it and sell it
without having to release it GPL since it isn't compiled into Ruby. 
You should ask a lawyer.  If it's true, however, then I hereby release
this code into the public domain ;-)

Good luck!
/wad