.NET Obfuscation

Jeff Varszegi

I'd obfuscate them, but in the past I've mostly just used renaming features of the obfuscators I've used. No matter what kind of genius wrote the tool, I'm a little leery of rearranging the structure of the code I already lovingly tuned for performance. You could always use ngen.exe to generate native images and redistribute those, couldn't you? I read about it a while back, but I've never used it. You'd have to compile different versions for different OSes, but how hard could it be? That'd make it ten times more work for someone to figure out what your code was doing, wouldn't it? Regards, Jeff Varszegi EEEP! An Extensible Expression Evaluation Package

Anders Molin

Jeff Varszegi wrote: No matter what kind of genius wrote the tool, I'm a little leery of rearranging the structure of the code I already lovingly tuned for performance. I know what you mean. And an obfuscated assembly will still be possible to decompile. It will be a mess to look at, but I don't see why it should be impossible to decompile it... Jeff Varszegi wrote: ou could always use ngen.exe to generate native images and redistribute those, couldn't you? I read somewhere that it was not possible and you had to provide the assembly anyway... - Anders Money talks, but all mine ever says is "Goodbye!" ShotKeeper, my Photo Album / Organizer Application[^]

My Photos[^]

Jeff Varszegi

You're right. MSDN says If Ngen.exe encounters any methods in an assembly that it cannot generate, it excludes them from the native image. When the runtime executes this assembly, it will revert to JIT compilation for the methods that were not included in the native image. Not only that, but the native image contains processor-specific machine code. Sorry for wasting your time on that one. Regards, Jeff Varszegi EEEP! An Extensible Expression Evaluation Package

Marcie Jones

All of my .NET code is ASP.NET, so no, I don't obfuscate it :-D Marcie CP Blog[^]

peterchen

I am looking for Deobfuscators for OpenSource Fortran code written by "6 crazy researchers". (Thats how the CTO labeled them). Do you think a .NET obfuscator could be used here? OK silly question - but an idea: Just write the core routines in Fortran.NET we now continue with the normal program

Flirt harder, I'm a Coder
mlog || Agile Programming | doxygen

l a u r e n

see this is another thing i really dont like about .NOT you have to give ur source code away practically but i guess since .NOT is basically a giant vm scripting language that isnt really surprising :suss:

"there is no spoon"
biz stuff about me

Anders Molin

peterchen wrote: I am looking for Deobfuscators for OpenSource Fortran code written by "6 crazy researchers". LOL :laugh: - Anders Money talks, but all mine ever says is "Goodbye!" ShotKeeper, my Photo Album / Organizer Application[^]

My Photos[^]

Gavin Lees

l a u r e n wrote: .NOT :laugh::laugh::laugh::laugh:

Nemanja Trifunovic

Doesn't work. I've talked about it with some Java guys and they say it is the same with Java. Whatever obfuscator you use, it will be still very easy to reverse-engineer your app. I guess this is one of the reasons why Java is used mainly for web applications.

Jeff Varszegi

It is the same in Java, but just being able to decompile something doesn't mean that you can use it. Have you ever downloaded an obfuscated Java applet and taken a look at the decompiled source? It's not worth the time to figure out what's going on; just destroying human-readable names makes the source, well, not human-readable. This won't defeat the resources of a government agency, a corporation, or even a knowledgeable motivated person. It is some measure of protection, though; no script kiddie or even intermediate-level person will be able to use the source, and nobody'll be able to use it without some effort. I think that to say Java is used mainly for web applications is sort of silly. It's not used for systems programming, but it is widely used for just about everything else. If you have a programmable cell phone, odds are you can program it easily in Java. Oh, wait-- I forgot where I am. Scratch that last statement. ;) To each his/her own. Regards, Jeff Varszegi EEEP! An Extensible Expression Evaluation Package

Ryan Binns

I'd vote 5 a thousand times if I could

Ryan

"Punctuality is only a virtue for those who aren't smart enough to think of good excuses for being late" John Nichol "Point Of Impact"

Terry ONolley

Could you be a little clearer please?

Glano perictu com sahni delorin!

Alvaro Mendez

Jeff Varszegi wrote: I think that to say Java is used mainly for web applications is sort of silly. It's not used for systems programming, but it is widely used for just about everything else. If you have a programmable cell phone, odds are you can program it easily in Java. Oh, wait-- I forgot where I am. Scratch that last statement. To each his/her own. :laugh: Yes, please be sure to use J# when referring to J**a in the future. :-) Regards, Alvaro

Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.

Rocky Moore

l a u r e n wrote: you have to give ur source code away practically You do that same any program, it is just the source they see is assembler ;) Rocky <>< www.HintsAndTips.com www.GotTheAnswerToSpam.com

Rocky Moore

Nemanja Trifunovic wrote: I guess this is one of the reasons why Java is used mainly for web applications And all this time, I thought it was the ugly GUI :) Kidding aside, there actually are a lot of Java applications in use today which many people may not even know are Java. One that comes to mind that I used in the past was Source Offsite. Oh yeah, they moved to .NET and is not written in C# ;) Rocky <>< www.HintsAndTips.com www.GotTheAnswerToSpam.com

Paul Watson

I'm lkoiong itno Otfbusacion of .ENT aselsmebis and is wnodrenig how mnay ppoele taht atculaly uess it... If you mkae poarmgrs unisg .NET, do you Ofbucsate yuor felis bfreoe gnviig tehm to csutoemrs? Any togthuhs aobut Oifuscatobn in ganeerl? regards, Paul Watson Bluegrass South Africa Christopher Duncan quoted: "...that would require my explaining Einstein's Fear of Relatives" Crikey! ain't life grand? Einstein says...

Paul Watson

1. Nutters, opressed-from-on-high developers and pomegranates use it 2. No 3. It's daft. 4. But if you want to, then go right ahead. regards, Paul Watson Bluegrass South Africa Christopher Duncan quoted: "...that would require my explaining Einstein's Fear of Relatives" Crikey! ain't life grand? Einstein says...

Paul Watson

As a fellow ASP.NET developer I wish I could say the same. We do a lot of dev for partner companies, not direct to the end-client and have on ocassion been asked to obfuscate our code. So far my flat out refusal to do so has worked but I am sure one day a partner will be more stubborn than I am and I will have to actually install the VS.NET obfuscator. regards, Paul Watson Bluegrass South Africa Christopher Duncan quoted: "...that would require my explaining Einstein's Fear of Relatives" Crikey! ain't life grand? Einstein says...

Nish Nishant

Hey Anders One easy way to obfuscate your code would be to get a few former-VB6 guys and ask them to write portions of your .NET assemblies. They’d write obfuscated code by default that’d beat any obfuscator’s obfuscated code. :-D Nish

Now with my own blog - void Nish(char* szBlog); My MVP tips, tricks and essays web site - www.voidnish.com

Ian Darling

Alvaro Mendez wrote: Yes, please be sure to use J# when referring to J**a in the future. Or "J-Thing" - that's what I use :-)

Ian Darling "If we've learned anything from history, it's that those who feed trolls are condemned to repetitive conversations. Or something like that." - Eric Lippert