Protecting your .NET applications

Protecting your .NET applications

I have often been asked questions from my readers - How do I obfuscate my application? Or how do I protect my assemblies from being disassembled? Or how do I stop my code from being reverse engineered?..and so on.

The answer to all these questions is Obfuscation. One thing to remember is that Obfuscation does not guarantee that your code cannot be reverse engineered. It makes the process of reverse engineering harder.

Note: There are a couple of free and paid obfuscator tools in the market. How efficient an Obfuscator tool is, also depends on the complexity of your code. Before investing money in such a tool, make sure you invest time in trying out these products and test their efficiency.

The Dotfuscator is a third-party tool from Preemptive Solutions shipped freely with Visual Studio 2010 which obfuscates .NET applications. To use this tool, launch Visual Studio 2010. Go to Tools > Dotfuscator Software Services

If you are using this tool for the first time, you will be presented with a License agreement. After accepting the license agreement, you can also register this product to get access to free updates and online support.

On the Dotfuscator UI, right click on the project and click ‘Add Assemblies’ and add an assembly of the project you have created

Note: If you observe, options like Control Flow, String Encryption, Removal, Linking and PreMark are grayed out. That is because they are available in the Professional edition. The Instrumentation option is available but you have to manually enable it.

Once the assembly is selected, hit ‘Ctrl + B’ or go to Build > Build Project

Click on the Results tab and expand the root tree and the sub-trees. The blue diamond shaped icons indicates that they are renamed methods and fields.

Once the obfuscation process is completed, you can examine the obfuscated assembly using ILDASM. ILDASM is a disassembler utility which comes with the .NET Framework SDK and allows you to decompile .NET assemblies into IL Assembly Language statements. To start ILDASM, go to Visual Studio Command Prompt and type ildasm. Then select the assembly to browse. Here’s a comparison of the same assembly, before obfuscation and after obfuscation

Note: The obfuscated assembly got created in the Dofuscated folder.

Observe how the method and property names are obfuscated. The obfuscated version makes it difficult to understand what a method or property is doing. You can even open a method to view the IL code. Here’s a comparison of the IL before and after the obfuscation:

As you can observe, Dotfuscator renamed the methods and properties and made it difficult to find out the purpose of each method using a disassembler. You can also explore the different Configuration Options to control the renaming of members or to exclude members you do not want to obfuscate.