10

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality.

Apart from the generic arguments about 'security through obscurity' are there any specific issues in using the wrapping functionality ?

Gary
  • 884
  • 7
  • 12

2 Answers2

8

There are unwrappers available for code wrapped with the Oracle 10g and 11g mechanism. These include both an online 'unwrapper' and the source code of an unwrapper written in Python.

As such, wrapping will do little to prevent someone with that level of access obtaining the source code.

Additional indicators of the nature of the code can be obtained using the *_DEPENDENCIES views, through an SQL trace or use of DBMS_TRACE.

The dependency views will show which tables and other objects might be called from the program, either directly or indirectly. The SQL trace will show the SQLs executed as a result of a particular call to a procedure. This can include 'bind variables', for example showing the salt used in an encryption call. The DBMS_TRACE is not usually installed, but when installed and enabled it can be used to track the path taken through the code, in terms of line numbers and procedure/function calls.

To protect code from being analysed, the first recourse should be to use packages. With procedures and functions, the entirety of the code is available to any database user who has been given permission to execute the program. With packages only the specification (program name and argument names/datatypes) are available and the actual code in the body is only visible to the owner of the program and those with high database privileges (normally DBAs).

Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
Gary
  • 884
  • 7
  • 12
2

It would appear that PL/SQL source text wrapping is not useful to eliminate the technical means to read PL/SQL code, but rather to accomplish one or more of the following goals.

  1. To discourage novice software developers from relying on implementations rather than interfaces for packages and types. So source text wrapping could tend to avoid backward compatibility problems if and when those implementations are revised.
  2. To support a claim that if anyone would read those implementations, then that person would transgress the DMCA law in the United States, or at least would demonstrate an intention to read those implementations in the face of measures that are clearly intended to render them difficult to read.
  3. To prevent people who are quite casual about the task and quite constrained in their resources from obtaining the program text.
minopret
  • 434
  • 3
  • 9