How to hide code in the assembly?

[Guest]

I wrote an assembly in C#/.NET that includes some personal information.
But this information can be revealed by opening the assembly in tools like
the ‘Microsoft .NET Framework IL DASM’ and ‘Reflector’.
I do not want to expose this code.

How do I hide it?

 

[Carlos J. Quintero [.NET MVP]]

You can use a 3rd party obfuscator to rename identifiers, etc. Most
obfuscators allows you to encrypt strings, or you can encrypt if yourself,
with simple methods (reversing, XORing, etc.) or using the
System.Security.Cryptography namespace. Of course, if your app must decrypt
it at run-time, the key will be in the assembly and someone could decrypt
it, but you are raising the bar.

--

Carlos J. Quintero

MZ-Tools 4.0: Productivity add-ins for Visual Studio .NET
You can code, design and document much faster.
http://www.mztools.com

 

[Terry Burns]

I would not recommend actually putting personal details anywhere you dont
want them hacked. If you must put this information in then obfuscate it.

 

[Cor Ligthert]

Sharon,

You can read and implement some of these answers in this newsgroup on your
question.

http://groups-beta.google.com/group...=obfuscate&qt_g=1&searchnow=Search+this+group

I hope this helps?

Cor

 

[Guest]

Actually by problem is a bit different then I posted.
I’m sending mail form the assembly, and for that I’m doing authentication
like that
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate", "1")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendusername", "UserName")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendpassword", " password");

And by using the tool I mentioned before, this user name and password can be
seen Easley.

How can I hide this data?

 

[Guest]

Actually by problem is a bit different then I posted.
I’m sending mail form the assembly, and for that I’m doing authentication
like that:

MailMessage MyMail = new MailMessage()
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate", "1")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendusername", "UserName")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendpassword", " password");

And by using the tool I mentioned before, this user name and password can be
seen Easley.

How can I hide this data?

 

[Guest]

Actually by problem is a bit different then I posted.
I’m sending mail form the assembly, and for that I’m doing authentication
like that
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate", "1")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendusername", "UserName")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendpassword", " password");

And by using the tool I mentioned before, this user name and password can be
seen Easley.

How can I hide this data?

 

[Guest]

Actually by problem is a bit different then I posted.
I’m sending mail form the assembly, and for that I’m doing authentication
like that:

MailMessage MyMail = new MailMessage()
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate", "1")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendusername", "UserName")
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendpassword", " password");

And by using the tool I mentioned before, this user name and password can be
seen Easley.

How can I hide this data?

 

[Carlos J. Quintero [.NET MVP]]

Hi again,

1) Why don´t you use the SMTP server of the user instead of yours? That
would avoid authentication...

2) If you really need it, then you can encrypt that data so it is no so
easily seen with a decompiler.

--

Carlos J. Quintero

MZ-Tools 4.0: Productivity add-ins for Visual Studio .NET
You can code, design and document much faster.
http://www.mztools.com

 

[Cor Ligthert]

Sharon,

I think that when you have the answer on this, you should not sent it in a
newsgroup, you become miljonair.

I think that now every organisation which has to do with creditcards sent
that kind of messages seperated and in my country not by email however by
normal mail.

Cor

 

[Guest]

Ok, it's sound much better.
But can you please explain how do I do option 1 and 2?

I'll very much appreciate code sample.

Thanks
Sharon

 

[Alexander Guirenko]

...
MailMessage MyMail = new MailMessage();
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/smtpau
thenticate", "1");
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendus
ername", "UserName");
MyMail.Fields.Add("http://schemas.microsoft.com/cdo/configuration/sendpa
ssword", " password");
And by using the tool I mentioned before, this user name and password
can be
seen Easley.
How can I hide this data?

Solution is simple enough.
Please, do not keep real "UserName" and "password" in your source code.
Hide username and password to database or keep them (encrypted!) in
web.config file. Then (during run time) extract user name and password
from database or web.config file, decrypt and use them in
MyMail.Fields.Add...

 

[Sean Hederman]

This kind of information shouldn't be in the assembly anyway. If it's "baked
in" then it can't ever be changed without causing your application to stop
working. One way would be to store it in the configuration file (encrypted).
A better way would be to ask the user to enter the user name and password
the first time your app starts, and then store it using DPAPI.