C Obfuscating Source Code with the PL/SQL Wrap Utility

This appendix shows you how to run the wrap utility. wrap is a standalone program that obfuscates PL/SQL source code, so that you can deliver PL/SQL applications without exposing your source code.

This appendix contains these topics:

Advantages of Wrapping PL/SQL Procedures
Running the PL/SQL Wrap Utility
Limitations of the PL/SQL Wrap Utility

Advantages of Wrapping PL/SQL Procedures

By hiding application internals, the wrap utility makes it difficult for other developers to misuse your application, or business competitors to see your algorithms.
Your code is not visible through the USER_SOURCE, ALL_SOURCE, or DBA_SOURCE data dictionary views.
SQL*Plus can process wrapped files. You can obfuscate source files that create PL/SQL procedures and packages.
The Import and Export utilities accept wrapped files. You can back up or move wrapped procedures.

Running the PL/SQL Wrap Utility

To run the wrap utility, enter the wrap command at your operating system prompt using the following syntax:

wrap iname=input_file [oname=output_file]

Note: Do not use any spaces around the equal signs.

input_file is the name of a file containing SQL statements, that you typically run using SQL*Plus. If you omit the file extension, an extension of .sql is assumed. For example, the following commands are equivalent:

wrap iname=/mydir/myfile
wrap iname=/mydir/myfile.sql

You can also specify a different file extension:

wrap iname=/mydir/myfile.src

output_file is the name of the obfuscated file that is created. The oname option is optional, because the output file name defaults to that of the input file and its extension defaults to .plb. For example, the following commands are equivalent:

wrap iname=/mydir/myfile
wrap iname=/mydir/myfile.sql oname=/mydir/myfile.plb

You can use the option oname to specify a different file name and extension:

wrap iname=/mydir/myfile oname=/yourdir/yourfile.out

Input and Output Files for the PL/SQL Wrap Utility

The input file can contain any combination of SQL statements. Most statements are passed through unchanged. CREATE statements that define subprograms, packages, or object types are obfuscated; their bodies are replaced by a scrambled form that the PL/SQL compiler understands.

The following CREATE statements are obfuscated:

CREATE [OR REPLACE] FUNCTION function_name
CREATE [OR REPLACE] PROCEDURE procedure_name
CREATE [OR REPLACE] PACKAGE package_name
CREATE [OR REPLACE] PACKAGE BODY package_name
CREATE [OR REPLACE] TYPE type_name AS OBJECT
CREATE [OR REPLACE] TYPE type_name UNDER type_name
CREATE [OR REPLACE] TYPE BODY type_name

Note: The CREATE [OR REPLACE] TRIGGER statement, and BEGIN..END anonymous blocks, are not obfuscated.

All other SQL statements are passed unchanged to the output file. Most comment lines are deleted. C-style comments (delimited by /* */) are preserved when they occur in the middle of a SQL statement. Comments are also preserved when they occur immediately after the CREATE statement, before the obfuscated body starts.

The output file is a text file, which you can run in SQL*Plus to set up your PL/SQL procedures, functions, and packages:

SQL> @wrapped_file_name.plb;

Tips:

When wrapping a package or object type, wrap only the body, not the spec. That way, other developers see the information they need to use the package or type, but they do not see its implementation.
PL/SQL source inside wrapped files cannot be edited. To change wrapped PL/SQL code, edit the original source file and wrap it again. You can either hold off on wrapping your code until it is ready for shipment to end-users, or include the wrapping operation as part of your build environment.
To be sure that all the important parts of your source code are obfuscated, view the wrapped file in a text editor before distributing it.

Limitations of the PL/SQL Wrap Utility

Although wrapping a compilation unit helps to hide the algorithm and makes reverse-engineering hard, Oracle Corporation does not recommend it as a secure method for hiding passwords or table names.
Because the source code is parsed by the PL/SQL compiler, not by SQL*Plus, you cannot include substitution variables using the SQL*Plus DEFINE notation inside the PL/SQL code. You can use substitution variables in other SQL statements that are not obfuscated.
The wrap utility does not obfuscate the source code for triggers. To hide the workings of a trigger, you can write a one-line trigger that calls a wrapped procedure.
Some, but not all, comments are removed in wrapped files.
If your PL/SQL compilation units contain syntax errors, the wrap utility detects and reports them. The wrap utility does not detect semantic errors, such as tables or views that do not exist. Those errors are detected when you run the output file in SQL*Plus.
The Wrap Utility is upward-compatible between Oracle releases, but is not downward-compatible. For example, you can load files processed by the V8.1.5 wrap utility into a V8.1.6 Oracle database, but you cannot load files processed by the V8.1.6 wrap utility into a V8.1.5 Oracle database.