Quote:

Technically, what we’re looking for here, is any kind of bijection; we’ll use this bijection to convert our data from one representation into another one (and as it is a bijection, we can revert it later).

Another Quote:

As we’re not writing our obf<> classes manually (instead, we have a code generator doing it for us on each build), the sky is the limit to the obfuscations we can generate."<> classes manually (instead, we have a code generator doing it for us on each build), the sky is the limit to the obfuscations we can generate.

Quote:

Bingo! We’ve got an executable, which automagically performs TONS of integrity checks, which checks are spread all over the executable, and are extremely non-obvious too.

Another Quote:

This approach of 'not revealing code until attack costs are high' is certainly not limited to payments.

Quote:

it is fundamentally impossible to prevent (or detect) debugging, at least as long we’re staying on one single box.

Another Quote:

DON’T spend more than 10% of your overall anti-bot-fighting time budget on system-specific protections.

Quote:

Some of the system calls are not absolutely necessary, and using them will significantly simplify life of the attacker

Another Quote:

Scrambling will help to protect your protocol even if the attacker manages to F.L.I.R.T. with your TLS library