# Math Obfuscation of Java Bytecode

Earlier today, I visited the Tigress C obfuscator website today (I haven’t for awhile) and it looks much nicer now ;). Anyways, something that particularly interested me was Tigress’s page on EncodeArithmetic. Since I, a maintainer of a Java bytecode obfuscator, am always looking for cool things to try, found the book they linked of interest. In said book, several identities are given (if the notation is unfamiliar to you, perhaps visit Wikipedia’s page on Boolean Algebra) but here are the ones relevant to today’s blog post

\begin{aligned} -x&=\begin{cases} \neg x+1\\ \neg(x-1) \end{cases}\\ x+y&=\begin{cases} x-\neg y-1\\ (x\oplus y)+2(x\wedge y)\\ (x\vee y)+(x\wedge y)\\ 2(x\vee y)-(x\oplus y) \end{cases}\\ x-y&=\begin{cases} x+\neg y+1\\ (x\oplus y)-2(\neg x\wedge y)\\ (x\wedge\neg y)-(\neg x\wedge y)\\ 2(x\wedge\neg y)-(x\oplus y) \end{cases}\\ x\oplus y&=(x\vee y)-(x\wedge y)\\ x\vee y&=(x\wedge\neg y)+y\\ x\wedge y&=(\neg x\vee y)-\neg x \end{aligned}

Now, the relevant opcodes for these identities are ineg, iadd, isub, ixor, ior, and iand.

Note that Java’s logical operator NOT is not present in the identities. This is because $\neg x$ is compiled to $x\oplus-1$.

Also note that these “identities” are not limited to just the ones I just ran through - there are a lot more if you choose to find them yourself. With some creativity, you can apply this not only to integers, but floats as well.

Here are some of what the above identities implemented as a transformer would do:

# ineg

Before

iload 0   // x
ineg


After

iload 0   // x
iconst_m1
ixor
iconst_1


Before

iload 0   // x


After

iload 0   // x
ior
iconst_1
ishl
ixor
isub


# isub

Before

iload 0   // x
isub


After

iload 0   // x
iconst_m1
ixor
iconst_1


# ixor

Before

iload 0   // x
ixor


After

iload 0   // x
ior
iand
isub


# ior

Before

iload 0   // x
ior


After

iload 0   // x
iconst_m1
ixor
iand


# iand

Before

iload 0   // x
iand


After

iload 0   // x
iconst_m1
ixor