Code Obfuscation

  • Thread starter Thread starter Alex Glass
  • Start date Start date
A

Alex Glass

I'm concerned a commercial application I've completed could be stolen by
deobsfuscation. However it's not clear to me what information is gained
when my .net executable is deobsfuscated (decompiled?). Any insight on the
subject would be greatly appreciated.

-Alex
 
Alex Glass said:
I'm concerned a commercial application I've completed could be stolen by
deobsfuscation. However it's not clear to me what information is gained
when my .net executable is deobsfuscated (decompiled?). Any insight on the
subject would be greatly appreciated.
Click to expand...

Obfuscation and decompilation are separate things - obfuscation just
makes it harder to read the decompiled code.

The easiest way to find out what someone would see is to try it
yourself. Personally I think it's not too much of a problem for most
people - code is very hard to understand as a whole when you haven't
got local variable names or any comments.

I wouldn't worry about other comparnies stealing your code, unless
you've got an important algorithm in there (which most applications
don't - the IP is in the design, usually) but you might legitimately
worry about people getting round your licensing code (if you use a
licence key etc). However, the proportion of the population who can do
this is very small - so long as they don't distribute the cracked
version (which is something you might want to search for on a regular
basis) you shouldn't lose many sales.
 
beside sign your assembly.
it makes cracked version of your assembly less usable! (I believe...)
 
Lloyd Dupont said:
beside sign your assembly.
it makes cracked version of your assembly less usable! (I believe...)
Click to expand...

Not really. The cracker just needs to find all the things which depend
on the assembly being signed, and remove those dependencies. It makes
it a little bit harder, but not a lot.

Assembly signing is really there to allow the end user to prove that
the software came from you; it doesn't make sure that someone who
doesn't care about signatures can't run code.
 
Yes john this is what I had assumed, my IP is in the design but I was still
concerned about whether or not people who deobfuscate would be able to
somehow recreate the code as it looks in my compiler.

Obfuscation and decompilation are separate things - obfuscation just
Click to expand...
makes it harder to read the decompiled code.

The easiest way to find out what someone would see is to try it
Click to expand...
yourself. Personally I think it's not too much of a problem for most
Click to expand...
people - code is very hard to understand as a whole when you haven't
Click to expand...
got local variable names or any comments.

I wouldn't worry about other comparnies stealing your code, unless
Click to expand...
you've got an important algorithm in there (which most applications
Click to expand...
don't - the IP is in the design, usually) but you might legitimately
Click to expand...
worry about people getting round your licensing code (if you use a
Click to expand...
licence key etc). However, the proportion of the population who can do
Click to expand...
this is very small - so long as they don't distribute the cracked
Click to expand...
version (which is something you might want to search for on a regular
Click to expand...
basis) you shouldn't lose many sales.


Jon Skeet - <[email protected]>

If replying to the group, please do not mail me too
Click to expand...
 
Alex Glass said:
Yes john this is what I had assumed, my IP is in the design but I was still
concerned about whether or not people who deobfuscate would be able to
somehow recreate the code as it looks in my compiler.
Click to expand...

Well, if you were to give people a debug build (with the pdb), they'd
have pretty much your code minus the comments. If you give them a
release build (without a pdb) they'll have the code without comments or
local variables. If you obfuscate the code, that will remove as many
meaningful names as possible (within the bounds of implementing public
interfaces etc).
 
Back
Top