Is code pruning related to obfuscation?

Question

From my research, many obfuscation/optimization packages include a feature called pruning where the software will remove dead code during processing.

The following packages include both obfuscation and code pruning as a feature (to name a few):

• RedGate SmartAssembly (.NET)
• Preemtive Dotfuscator (.NET)
• Inquartos Obfuscator (.NET)
• ProGuard (Java)

I see the common thread that both operations require scanning and analyzing an assembly, but I'm curious if the two features are or even could be fundamentally related. The reason I am asking is that we are considering disabling code pruning in our environment (unrelated issue), but our concern is that it could potentially decrease the effectiveness of the obfuscation process and thus protect our Intellectual Property less.

Does or could code pruning influence obfuscation, and how?

Answer 1

The existence of dead code would not increase the obfuscation, when decompiling/deobfuscating code, the flow of the program is always lost, the functions are not ordered in the way that the would naturally be laid out by a developer, so once the output is rendered, the user is always hunting around for the entry points into objects/functions before they can begin to map the methods/functions and their relationships.

Additional, unused code, could be a source of confusion for the person(s) who are attempting to reuse your code after the code has been output, but it would not make the output of the code more difficult for the algorithms to create in the first place. The tools would work the same, and it would offer no additional protection.

Some times dead code is actually added to increase the obfuscation (so not eliminating it sounds like it would be better) but it is actually done to avoid detection. As seen here: http://isyou.hosting.paran.com/papers/bwcca10-2.pdf

Answer 2

Obfuscation has to do with hiding or disguising the original intent of the code from being easily comprehended by humans.

Removing dead code ( code that is proven to never be executed regardless of the inputs ) is an optimization technique which has to do with making the executable use less time or space or both.

Most, if not all the packages you list are not just about obfuscation, but do lots of things to make the code take less time or space or both along with other features.

Some of those optimization's could be considered to make the deduction of the logic flow of the code harder to deduce for a human. Removing dead code probably isn't one of those optimizations.