NecroBit just sounds like they are wrapping as an unmanaged binary. So on disk it looks like unmanaged code and decompilers will fail, but when running the IL code is still exposed in memory. The way to test this is using .NET generic unpackerhttp://www.ntcore.com/utilities.php[^] This tool will produce unprotected code while app is running if no other countermeasures are deployed

There are two ways to protect .NET code; obfuscation (string encryption, variable naming code flow) and code protection (prevents decompilers, code encryption, anti-debug stuff, and anti-tampering). This discussion thread seem to morph the two approaches. So I have attempted to compare the varous products mentioned in the threads (below). But first this is how I would define the two classes of protectors Code Protection - Products that employ anti-reverse engineering technology into the code and protect the code at runtime - Can include anti-decompiling capabilities, code encryption, anti-debug, anti-tamper, and runtime exection protection Code Obfuscators - Products that remove context from the code by obfuscating the IL. - Includes string encryption, changing code flow, variable renaming - Some may include anti-decompiler technology, but without protection of the code in memory its has little value Here is how would groups the different products mentioned Code Protection V.i. Labs CodeArmor - Encrypts IL code at assembly level and protects the decryption operation with a driver based technology. Continiously monitors for anti-debugging and other reverse engineer tools to deter analyzing the code in memory. The .NET binaries will appear as native unmanged code on disk. Microsoft SLPS - Tranforms and encrypts code into a per vendor proprietary format and implements a separate VM CLR to compile code. Can protect at method level, but have severe performance issues because of VM CLR component. XHEO CodeVeil - Encrypts IL code, has some obfuscation, some anti-debug, but code is accessible in memory and more exposed to dumpers. Salamander Protector - Not an available product, but can test by giving them code. I believe they encrypt the IL code and provide a library that hooks the CLR to decrypt JIT and limited exposure in memory. However, I do not believe that monitor the runtime environment for tools and protect against their stuff being hooked. Traditional Code Obfuscation Note: Should be able to combine obfuscation with some of the products above for really strong protection. Spices.NET Obfuscation .NET Reactor PreEmptive DotObfuscator