Is there any better way than obfuscation?

[Builder]

Hello,

As I recently read this article:

http://www.codeproject.com/KB/security/DontRelyOnObfuscation.aspx?msg=2742011#xx2742011xx

I am afraid to release my application after obfuscation. Does anybody
knows some better approach? It doesn't metter if it is a commercial
tool.

Thanks,
Peter

 

[Kerem Gümrükcü]

Hi Peter,

there is no 100% way to protect your code against
disassebling or reversing. If you are a skilled asm(x86/x64, etc)
coder and have experience in debugging/disassembling then
there is NO way for someone to protect his/her code. Even
..NET is easy to debug and obfuscation is not a real way to
protect your code, it just makes the process of reversing just
a little difficult nothing more

If you want to make a reversers life a bit harder, then i recommend
you to write your code in native languages like C++, C and other
"real" compiled to native code languages and/or roll the functionalities
of your application to external native libraries. And even this is no
guarantee for code protection. The most secure way is to implement
your functionality in a WebService and make it callable from a server.
Thats the best way to protect your code!

Sure, there are other ways like, eg. Digital Signing, Certifictaes, Hashing,
etc, but even this is not 100% secure,...

Regards

Kerem

--

 

[Kerem Gümrükcü]

Dear MC,

why you wrote that to me? Read my post!
I think you wanted to send this to the OP,...

Regards

Kerem

--

 

[Duggi]

Hello,

As I recently read this article:

http://www.codeproject.com/KB/security/DontRelyOnObfuscation.aspx?msg...

I am afraid to release my application after obfuscation. Does anybody
knows some better approach? It doesn't metter if it is a commercial
tool.

Thanks,
Peter

To all the Programmers in the thread:

there are only 2 cases arise when you are program in any language.

1. you are writing some code that is highly inteletual property. and
you do not want to revel to the other programmers
2. you are writing a normal logic which can be sahre with the other
programmers.

Case 2 is not required for discussion
Case 1
Again there are 2 sub cases
case A: you are developing some IP which can not be reveled to the
world.
case B: you are developing some IP which can be reveled to the world
(but you want to gain most out of it)

Case A:
this senario management/company genarally go with the native languages
or high security mesures in site .net code and external factors like
obfuscation will be considered.

Case B:
Before releasing the product, IP is patented and protected by the
company / individual.

-Cnu

 

[xcal]

Ive seen some posts that argue you can translate your code to native code.
From here you can start to "ofuscate" it, and it is
almost impossible to break it. Well, I didnt try this, but
I remember also, you need some third party tools, but sorry,
I dont remember program names

hope this helps, Carlos.

 

[Peter Morris]

Take a look at this old thread....

 

[Peter Morris]

Take a look at this old thread....

http://tinyurl.com/obfuscator

 

[Chris Dunaway]

I didn't write it to you. I posted it in the newsgroup. In the thread, it
follows your message, but that doesn't mean it's addressed just to you.

But you did! In a newsreader that properly formats the thread, your
message was a direct reply to Kerem. Here is the header for your
message:

From: "MC" <[email protected]>
References: <0b1dcf36-bce1-4922-
(e-mail address removed)> <uCrr#tJIJHA.
(e-mail address removed)>
In-Reply-To: <uCrr#[email protected]>
Subject: Re: Is there any better way than obfuscation?
Date: Sat, 27 Sep 2008 09:54:18 -0400

Notice the In-Reply-To header. That is the message ID of Kerem's
post. Your message is a direct reply to his. If you put your
newsreader into threaded view, you should see that. That's why he
asked why you replied to him instead of the OP.

The OP's message id is Message-ID: <0b1dcf36-bce1-4922-
(e-mail address removed)>

Just thought you'd be interested.

Chris

 

[Builder]

What do you thing about CodeVeil? Is it acceptable solution?

 

[Chris Dunaway]

What do you thing about CodeVeil? Is it acceptable solution?

I have never used CodeVeil, so I cannot comment on it.

You might also look at Microsoft's Code Protector which is designed
for use with .Net.

See this link:

http://www.microsoft.com/SLPS/code-protector.aspx

Chris