Code Obsfuscation

A

Alex Glass

I'm concerned a commercial application I've completed could be stolen by
deobsfuscation. However it's not clear to me what information is gained
when my .net executable is deobsfuscated (decompiled?). Any insight on the
subject would be greatly appreciated.

-Alex
 
M

Michael C#

Alex Glass said:
I'm concerned a commercial application I've completed could be stolen by
deobsfuscation. However it's not clear to me what information is gained
when my .net executable is deobsfuscated (decompiled?). Any insight on
the subject would be greatly appreciated.

-Alex

A basic obfuscator re-names your public classes and variables to make the
logic of the IL code harder to understand if it is de-compiled. More
advanced obfuscators can can modify your code slightly to make the logic
even harder to follow. There are even some that can encrypt strings and
other values in your code to make it much harder to understand when
de-compiled.

Bottom line is that anyone who wants to de-compile your code can do so. All
you can do is make it as hard as possible for them to understand your code,
follow the logic within your code, and view the string and other values in
your code. For serious obfuscation, I would look for an obfuscator that
obfuscates, encrypts and possibly can modify the code to hide the logic even
more. If you're not familiar with IL, you might want to read up on it, then
compare some of your un-obfuscated IL with your obfuscated IL to get a
better understanding of how obfuscation works.
 
O

Oenone

Michael said:
A basic obfuscator re-names your public classes and variables to make
the logic of the IL code harder to understand if it is de-compiled.

How does it do this without breaking any code in other projects that uses
those public classes and variables? Surely once these have been renamed, an
external program that references an obfuscated DLL will find that the class
and variable names it is looking for no longer exist?
 
C

Carlos J. Quintero [.NET MVP]

It does not rename public elements by default. Most obfuscators allows you
to control what to obfuscate and what not through reg expressions or custom
attributes, it the defaults are not suitable.

--

Best regards,

Carlos J. Quintero

MZ-Tools: Productivity add-ins for Visual Studio .NET, VB6, VB5 and VBA
You can code, design and document much faster.
Free resources for add-in developers:
http://www.mztools.com
 
C

Carlos J. Quintero [.NET MVP]

However it's not clear to me what information is gained when my .net
executable is deobsfuscated (decompiled?).

You can get the equivalent C# or VB.NET used to produce the intermediate
language. See

..NET Reflector
http://www.aisto.com/roeder/dotnet/

or Anakrino
http://www.saurik.com/net/exemplar/

--

Best regards,

Carlos J. Quintero

MZ-Tools: Productivity add-ins for Visual Studio .NET, VB6, VB5 and VBA
You can code, design and document much faster.
Free resources for add-in developers:
http://www.mztools.com
 
M

Michael C#

Oops. My typo. I was typing faster than I was thinking. If you are
reusing your DLLs for other projects, you can specify that only private
classes and variables are obfuscated. Sorry about that...
 
Joined
Nov 21, 2009
Messages
79
Reaction score
0
With .Net assemblies, your entire source code including the control flow structure (if, while, for loops) is completely visible to anybody using a free tool called Reflector. A basic protection againt this is to use an obfuscator to rename all (or only non-public) classes/members. Advanced protections empoyed by some obfuscators are string encryption, control flow obfuscation and many more. Check out Crypto Obfuscator (http://www.ssware.com/cryptoobfuscator/obfuscator-net.htm) which also has Anti-Reflector, Anti-Debug, Anti-Tamper.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top