Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection

Paperback (Print)
Used and New from Other Sellers
Used and New from Other Sellers
from $50.78
Usually ships in 1-2 business days
(Save 21%)
Other sellers (Paperback)
  • All (7) from $50.78   
  • New (6) from $50.78   
  • Used (1) from $51.33   


“This book gives thorough, scholarly coverage of an area of growing importance in computer security and is a ‘must have’ for every researcher, student, and practicing professional in software protection.”
—Mikhail Atallah, Distinguished Professor of Computer Science at Purdue University

Theory, Techniques, and Tools for Fighting Software Piracy, Tampering, and Malicious Reverse Engineering

The last decade has seen significant progress in the development of techniques for resisting software piracy and tampering. These techniques are indispensable for software developers seeking to protect vital intellectual property. Surreptitious Software is the first authoritative, comprehensive resource for researchers, developers, and students who want to understand these approaches, the level of security they afford, and the performance penalty they incur.

Christian Collberg and Jasvir Nagra bring together techniques drawn from related areas of computer science, including cryptography, steganography, watermarking, software metrics, reverse engineering, and compiler optimization. Using extensive sample code, they show readers how to implement protection schemes ranging from code obfuscation and software fingerprinting to tamperproofing and birthmarking, and discuss the theoretical and practical limitations of these techniques.

Coverage includes

  • Mastering techniques that both attackers and defenders use to analyze programs
  • Using code obfuscation to make software harder to analyze and understand
  • Fingerprinting software to identify its author and to trace software pirates
  • Tamperproofing software using guards that detect and respond to illegal modifications of code and data
  • Strengthening content protection through dynamic watermarking and dynamic obfuscation
  • Detecting code theft via software similarity analysis and birthmarking algorithms
  • Using hardware techniques to defend software and media against piracy and tampering
  • Detecting software tampering in distributed system
  • Understanding the theoretical limits of code obfuscation
Read More Show Less

Product Details

  • ISBN-13: 9780321549259
  • Publisher: Addison-Wesley
  • Publication date: 8/7/2009
  • Series: Addison-Wesley Software Security Series
  • Edition description: New Edition
  • Pages: 792
  • Sales rank: 1,346,598
  • Product dimensions: 7.00 (w) x 9.10 (h) x 1.60 (d)

Meet the Author

Christian Collberg received a B.Sc. in computer science and numerical analysis and a Ph.D. in computer science from Lund University, Sweden. He is currently an associate professor in the department of computer science at the University of Arizona and has also worked at the University of Auckland, New Zealand, and the Chinese Academy of Sciences in Beijing. Professor Collberg is a leading researcher in the intellectual property protection of software, and also maintains an interest in compiler and programming language research. In his spare time he writes songs, sings, and plays guitar for The Zax and hopes one day to finish his Great Swedish Novel.

Jasvir Nagra received his B.Sc. in mathematics and computer science and a Ph.D. in computer science from the University of Auckland, New Zealand. He’s been a postdoctoral scholar on the RE-TRUST project at the University of Trento, where his focus is on applying obfuscation, tamperproofing, and watermarking techniques to protect the integrity of software executing on a remote untrusted platform. His research interests also include the design of programming languages and its impact on the security of applications. He’s currently with Google Inc., where he is building Caja, an open source, secure subset of JavaScript. In his spare time Jasvir dabbles with Lego and one day hopes to finish building his Turing machine made entirely out of Lego blocks.

Read More Show Less

Table of Contents

Preface xv
About the Authors xxv
Acknowledgments xxvii

Chapter 1: What Is Surreptitious Software? 1
1.1 Setting the Scene 1
1.2 Attack and Defense 6
1.3 Program Analysis 7
1.4 Code Obfuscation 13
1.5 Tamperproofing 32
1.6 Software Watermarking 36
1.7 Software Similarity 43
1.8 Hardware-Based Protection Techniques 49
1.9 Discussion 55
1.10 Notation 58

Chapter 2: Methods of Attack and Defense 59
2.1 Attack Strategies 60
2.2 Defense Strategies 86
2.3 Discussion 114

Chapter 3: Program Analysis 117
3.1 Static Analysis 118
3.2 Dynamic Analysis 145
3.3 Reconstituting Source 170
3.4 Pragmatic Analysis 190
3.5 Discussion 198

Chapter 4: Code Obfuscation 201
4.1 Semantics-Preserving Obfuscating Transformations 202
4.2 Definitions 217
4.3 Complicating Control Flow 225
4.4 Opaque Predicates 246
4.5 Data Encodings 258
4.6 Breaking Abstractions 277
4.7 Discussion 298

Chapter 5: Obfuscation Theory 301
5.1 Definitions 304
5.2 Provably Secure Obfuscation: Possible or Impossible? 307
5.3 Provably Secure Obfuscation: It’s Possible (Sometimes)! 313
5.4 Provably Secure Obfuscation: It’s Impossible (Sometimes)! 335
5.5 Provably Secure Obfuscation: Can It Be Saved? 344
5.6 Discussion 354

Chapter 6: Dynamic Obfuscation 357
6.1 Definitions 360
6.2 Moving Code Around 362
6.3 Encryption 383
6.4 Discussion 398

Chapter 7: Software Tamperproofing 401
7.1 Definitions 405
7.2 Introspection 412
7.3 Algorithm TPTCJ: Response Mechanisms 440
7.4 State Inspection 444
7.5 Remote Tamperproofing 453
7.6 Discussion 464

Chapter 8: Software Watermarking 467
8.1 History and Applications 468
8.2 Watermarking Software 478
8.3 Definitions 480
8.4 Watermarking by Permutation 486
8.5 TamperproofingWatermarks 494
8.6 Improving Resilience 498
8.7 Improving Stealth 505
8.8 Steganographic Embeddings 522
8.9 SplittingWatermark Integers 526
8.10 Graph Codecs 533
8.11 Discussion 537

Chapter 9: Dynamic Watermarking 541
9.1 Algorithm WMCT: Exploiting Aliasing 546
9.2 Algorithm WMNT: Exploiting Parallelism 565
9.3 Algorithm WMCCDKHLSpaths: Expanding Execution Paths 583
9.4 Algorithm WMCCDKHLSbf : Tamperproofing Execution Paths 592
9.5 Discussion 598

Chapter 10: Software Similarity Analysis 601
10.1 Applications 602
10.2 Definitions 611
10.3 k-gram-Based Analysis 616
10.4 API-Based Analysis 625
10.5 Tree-Based Analysis 631
10.6 Graph-Based Analysis 635
10.7 Metrics-Based Analysis 644
10.8 Discussion 652

Chapter 11: Hardware for Protecting Software 655
11.1 Anti-Piracy by Physical Distribution 657
11.2 Authenticated Boot Using a Trusted Platform Module 670
11.3 Encrypted Execution 683
11.4 Attacks on Tamperproof Devices 695
11.5 Discussion 711

Bibliography 713
Index 737

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star


4 Star


3 Star


2 Star


1 Star


Your Rating:

Your Name: Create a Pen Name or

Barnes & Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation


  • - By submitting a review, you grant to Barnes & and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Terms of Use.
  • - Barnes & reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously
Sort by: Showing 1 Customer Reviews
  • Posted January 27, 2010

    Intellectual Contribution!

    As being a research student in information security and being a practitioner in software auditing and protection, I found this book a wonderful guideline. As far as I know, this book is the first on the topic of Software Watermarking, which is the burning issue in these days. I wish for more contributions from the authors and a very good luck.

    Was this review helpful? Yes  No   Report this review
Sort by: Showing 1 Customer Reviews

If you find inappropriate content, please report it to Barnes & Noble
Why is this product inappropriate?
Comments (optional)