secure .net applications against disassembly

  • Thread starter Thread starter Achim Kühn
  • Start date Start date
A

Achim Kühn

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily disassemble
and manipulate the application?
 
Hi,

Use an obfuscator like dotfuscator comuntity edition which comes
with visual studio 2003.

Ken
 
You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition
is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java
's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered
from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and
we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same
nutritional value as it did before (luckily, CLRs aren't picky about taste).
The trick of an obfuscator is to confuse observers, while still giving CLRs
the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscator/dotfuscator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
 
Please eat breakfast prior to posting ;)


Jan Tielens said:
You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition
is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java
's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered
from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and
we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same
nutritional value as it did before (luckily, CLRs aren't picky about taste).
The trick of an obfuscator is to confuse observers, while still giving CLRs
the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscator/dotfuscator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
Click to expand...
 
Back
Top