.Net Decompiler - How do I protect my .Net Product?

  • Thread starter Thread starter gregory_may
  • Start date Start date
A community edition of the Dotfuscator is available with Visual Studio .NET
2003.
 
It looks like the .Net Decompiler (below) does just fine on simple
Obfuscation products.

I am curious what other folks do to protect their IP?

g.
 
People generally get an obfuscator. I personally don't want to pay 1100.00
for one. VS.NET has one built in.
 
There are a number of them out there and VS.NET has one as well
(Dotfuscator).

I have to admit, I'm curious how effective it is and how effective some of
the others are. I know that one company that sells one also sells a
decompiler that they advertise will get past several of the other
obfuscators out there, which makes me generally suspicious of all the
obfuscators.

Fortunately it's not an issue I need to contend with right now, but at some
point I may. I hope there are some good studies of the effectiveness of them
at some point.

Pete
 
It looks like the .Net Decompiler (below) does just fine on simple
Obfuscation products.

I am curious what other folks do to protect their IP?

What exactly do you mean by "just fine"? It will still be able to
decompile, sure, but (hopefully) without meaningful names for anything
non-public. That quickly makes code very, very difficult to read.

What exactly do you wish to protect against? Someone copying some code,
or perhaps breaking your licensing model?
 
I believe you are reading "In contrast to an obfuscator that makes
decompilation more difficult by symbol renaming, our protector completely
stops MSIL disassembly and decompilation ."

Okay, let's examine this:
1. Who makes the only commercial decompiler? RemoteSoft
2. Who released Protector? RemoteSoft

Fox in the chicken house.

What level of protection do you need? Salamander will decompile most
obfuscated code. This is true, but you figure out how to make this code
work:

private int i;
private double i;
private string i;

public long RandomMethod()
{
i = 100;
i = 1000;
i = "something";

i = i(i,i,i);
}

private string i(string i, long i)
{

}

Yes, you can decompile, but imagine tons of lines of code written like so.
It would take you a long time to "steal" the product; long enough a new
version would likely be out.

A couple of things you can do:
First, refactor classes to place all repetitive code in private methods. If
you find the same code in two functions, put it in a private method. This
will make your code harder to decompile, as an obfuscator will name a lot of
things by the same symbol. It is also a good practice, regardless, as you
have code in one place, not many, when you need to update.

Second, reduce exposure on as many functions as possible. Public and
protected functions are not obfuscated. If you do not need outside access,
reduce the exposure. This is also common programming practice.

NOTE: This post is not a knock of protector. From what I have gathered,
protector is a great product. In some instance, protector may be needed,
esp. if you shrink wrap software.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

**********************************************************************
Think Outside the Box!
**********************************************************************
 
LSW DotNet-Lab will be released soon:

- Reflection-Browser
- C# and VB.NET Decompiler
- Obfuscator with ILDASM Protection, String Encryption & Control-Flow
Obfuscation and Multi Assembly Obfuscation
- Cross-Referencer
- Automatically layouted UML Diagrams & miscellaneous Diagrams incluing XML
- Visual Syntax
- Assembly Editor

with best regards, Frank Lesser, www.lesser-software.com
 
So, from what I am gathering:

* Use an obfuscator until your IP exposure gets to be significant, then
invest in a tool like the Protector...
* To properly use and obfuscator, make sure you are using as many private
Subs/Functions as possible.

So, I am also guessing, obfuscation becomes part of your release cycle.
Right before you deploy the project to a final QA process.
 
Is there a more econimical way to stop people from decompiling my .Net
product? I dont have $1900 to spend on the .Net Decompiler Protector.
Anyone have any thoughts/experiences with these or simliar products?

Is Microsoft working on a solution to this problem?


.Net Decompiler - $1100
http://www.remotesoft.com/salamander/

.Net Decompiler Protector -$1900
http://www.remotesoft.com/salamander/protector.html
Try 9Rays.Net Spices.Net -
http://9rays.net/products/spices
(explorer, obfuscator, 6 languages decompiler - IL. C#, VB.Net, MC++, J#,
Delphi.Net).
Spices.Net is more cheaper product. Full Spices.net you can buy for $392.
 
Back
Top