Abstract
Obfuscation is routinely applied to malicious code, yet its effectiveness is usually argued rather than measured. In practice it is assessed by the drop in the number of engines that flag a sample – a figure that changes as signature databases do. Existing quantitative frameworks measure the program instead, but operate on source code and cannot be applied to the samples an analyst receives. This paper presents an automated pipeline that measures obfuscation quality on compiled Windows binaries and reports two quantities: an index Q of the cost imposed on analysis and a separate measure S of how much of the original byte sequence survives. Every sample is verified by execution, and the pipeline was applied to thirteen purpose-built modules under ten transformation combinations, giving 130 verified pairs. Over these pairs Q and S prove not to be interchangeable – their relationship reverses direction depending on whether transformations are compared on one sample or samples are compared with each other. The clipped normalisation of relative change in common use reaches its ceiling as soon as a measured quantity doubles, so it assigns its maximum to four fifths of the dataset although the underlying structural growth spans two orders of magnitude; a logarithmic normalisation restores the distinction. And no transformation removes a single imported function: the import table is produced by the linker, beyond the reach of a source-level obfuscator, so the strongest static indicators available to a scanner survive any amount of added control-flow complexity.