obfuscation of SAS code

[reneeharper]

Someone asked me this on Twitter.  I have no idea how to answer, but would love to point him to the wealth of knowledge shared here.  His question is:

" Is there any way or tools to obfuscation of SAS code...I'm talking Base 9.2"

Because I can't add any details to the question, I'm going to refer him to this discussion just as soon as I complete the post.  Hope you guys can help hi

[OS2Rules]

Are you kidding?

Most programmers I know seem to go out of their way to do this.  We call it "job security code" - written so complex that only they can read (and thus- support) it.

Multiple macros with the same name in the same program, using format definitions that no on has heard of, run-on lines of code so long they don't fit in a standard editor, writing code to an output file and then including it to execute - I've seen it all and more.

And let's not forget the best one of all - not a single comment !

[data_null__]

 using format definitions that no on has heard of

What does that mean?

writing code to an output file and then including it to execute

I use this technique often.  When the data used to gen code is large it is more logical to keep that data in SAS date set and usedata step to gen code.  You can take advantage of BY group processing and all the other features that make a data step a powerful programming language.  This makes much more sense than working with lots of macro arrays or scanning and parsing multiple macro variables.    Plus you can print the file to the log and see exactly what code is being written, before it is executed..

[OS2Rules]

I'm not saying that these techniques do not have value.

What I'm saying is that I have seen some programs where these methods, and more, have been used intentionally to make the programs so complex that only the originator could hope to support them.

"If builders built buildings the way programmers write computer programs, then the first stiff breeze would destroy civilization".

[ballardw]

OS2Rules wrote:

"If builders built buildings the way programmers write computer programs, then the first stiff breeze would destroy civilization".

I learned this as "the first woodpecker" back aboutn 1977...

[Patrick]

@ OS/2

Totally agree with everything you say - except with "writing code to an output file and then including it to execute". I consider this as a very legitimate technique and it is often an alternative to writing complex macro code.

[Alfredo]

By obfuscation, you mean a sort of data step code encryption?

If so, try the stored program facility:

libname source 'c:\temp';

data class / pgm=source.class (alter=mypw);

   set sashelp.class;

   F=(sex='F');

run;

data pgm=source.class;

   *describe;

   execute;

run;

[art297]

Renee: Point him toward some of Art Carpenter's papers on the topic:

http://www.lexjansen.com/sugi/sugi21/tu/291-21.pdf

http://www2.sas.com/proceedings/sugi23/Training/p275.pdf

http://www.lexjansen.com/pharmasug/2005/technicaltechniques/tt05.pdf

Note: links corrected 10:47am 18APR2012

[Linlin]

Hi Art,

when I click the links I got the "

The webpage cannot be found

" message. Maybe it just happened to my computer.

Thanks - Linlin

Message was edited by: Linlin

[art297]

Linlin: try them now.  They somehow got mingled the way I had originally pasted them

[reneeharper]

Great references .  suggested two things:

• compile a macro with the SECURE option
• To protect IP, you could put key algorithms in FCMP and compile to a library

[data_null__]

I would be extremely reluctant to use any SAS program that I was not able to look at "if I wanted or needed to".

[FriedEgg]

In PROC FCMP you will also need to use the ENCRYPT option or the compiled code can be easily retrieved and viewed. 

[Haikuo]

I saw his video, that was hilarious. From my personal experience ( which is not much btw), using as much as PRX is a good way for obfuscation (of course not for toby dunn). I find it is impossible even to read my own PRX code.

Regards,

Haikuo

[JasonDiVirgilio]

Those Art Carpenter papers are priceless. Evil, but priceless. I especially like the section about using (obvious) variable names for anything other than what they look like (WEIGHT = height of the patient.)