Secure .Net Assemblies - any thoughts?

[Chua Wen Ching]

Hi all,

Basically right now, i am interested to learn how to break strong names in
..net assemblies. I had researched a lot and found a blog that mention how to
hack strong name assemblies.
http://blogs.msdn.com/shawnfa/archiv...20/218049.aspx

"
In order to enable post-build modifications, you need to either:

Delay sign your assembly, hack the PE image, and then perform the final
signing; or
Sign your assembly, hack the PE image, and the use SN -R to resign the
assembly
"
I had look and read about Portable Executables, but the problem is most of
them are in concepts.

Do you had any experience in breaking apart a .net strong name assemblies?

It seems that PE are in C++ codes, and in order to hack PE, i need to
write C++ codes, or use binary editors to manually change?

I am looking into possibilities to protected my office .net libraries, at
least make it harder for hacker.

I heard you can apply a ECMA key, and you can secure the libraries, just
like what Microsoft did to some of their .net framework codes, which you
can't use .net reflector to see the codes.

Please correct me if had a wrong understanding :)

I tried the binary editor from Visual Studio .NET, but i can't seem to
understand how to modify anything (hex or ascii), when i change and save back
to the exe, it fails to run. An error related to not a proper win32
executable.

I had tested with ildasm by generating an il, manually delete the lines of
codes that calls the software license and compile back to an exe by using
ilasm. That is easy. I think even you obfuscate the code, it is still
breakable as obfuscation only changes method and class names to
alphanumerics. The codes in there are still the same.

Is there no way way to encrypt all the codes than being shown in there? I
tried obfuscation and strong names, it seems to be the same. No difference. I
can still see codes inside void main (example) using .net reflector by Lutz
Roeder or Anakrino.

Can you share some opinion to me, please?

Thanks.

--
Regards,
Chua Wen Ching :)

[remotesoft]

A strong name does not help for preventing reverse engineering, decompiler
retrieves code exactly the same whether or not an assembly is strong-named.
A strong name might help to prevent unauthorized reference of the signed
assembly. However, as you noted, strong names can be removed, or resigned
with a different key. You can download our obfuscator
(http://www.remotesoft.com/salamander/obfuscator.html), which offers an
option: -delsig to delete strong names. You can also use ildasm/ilasm to
delete or resign with a different strong name.

Obfuscators are often used to make reverse engineering more difficult, but
since the nature is renaming symbols, so the underlying code is still
available to hackers as you mentioned, although the code becomes more
difficult for a human to understand due to the presence of large amount of
non-sense class/method/field names.

If you wanted to hide the underlying code completely, so a hacker does not
have access to the logics, you can try our protector product
(http://www.remotesoft.com/salamander/protector.html). It modifies the MSIL
code, instead of the sybol names. Once protected, the MSIL code is no longer
visible.

Thanks,

Huihong

"Chua Wen Ching" <ch************@nospam.hotmail.com> wrote in message
news:CA**********************************@microsof t.com...

Hi all,

Basically right now, i am interested to learn how to break strong names in .net assemblies. I had researched a lot and found a blog that mention how to hack strong name assemblies.
http://blogs.msdn.com/shawnfa/archiv...20/218049.aspx

"
In order to enable post-build modifications, you need to either:

Delay sign your assembly, hack the PE image, and then perform the final
signing; or
Sign your assembly, hack the PE image, and the use SN -R to resign the
assembly
"
I had look and read about Portable Executables, but the problem is most of them are in concepts.

Do you had any experience in breaking apart a .net strong name assemblies?
It seems that PE are in C++ codes, and in order to hack PE, i need to
write C++ codes, or use binary editors to manually change?

I am looking into possibilities to protected my office .net libraries, at least make it harder for hacker.

I heard you can apply a ECMA key, and you can secure the libraries, just
like what Microsoft did to some of their .net framework codes, which you
can't use .net reflector to see the codes.

Please correct me if had a wrong understanding :)

I tried the binary editor from Visual Studio .NET, but i can't seem to
understand how to modify anything (hex or ascii), when i change and save back to the exe, it fails to run. An error related to not a proper win32
executable.

I had tested with ildasm by generating an il, manually delete the lines of codes that calls the software license and compile back to an exe by using
ilasm. That is easy. I think even you obfuscate the code, it is still
breakable as obfuscation only changes method and class names to
alphanumerics. The codes in there are still the same.

Is there no way way to encrypt all the codes than being shown in there? I tried obfuscation and strong names, it seems to be the same. No difference. I can still see codes inside void main (example) using .net reflector by Lutz Roeder or Anakrino.

Can you share some opinion to me, please?

Thanks.

--
Regards,
Chua Wen Ching :)

[remotesoft]

A strong name does not help for preventing reverse engineering, decompiler
retrieves code exactly the same whether or not an assembly is strong-named.
A strong name might help to prevent unauthorized reference of the signed
assembly. However, as you noted, strong names can be removed, or resigned
with a different key. You can download our obfuscator
(http://www.remotesoft.com/salamander/obfuscator.html), which offers an
option: -delsig to delete strong names. You can also use ildasm/ilasm to
delete or resign with a different strong name.

Obfuscators are often used to make reverse engineering more difficult, but
since the nature is renaming symbols, so the underlying code is still
available to hackers as you mentioned, although the code becomes more
difficult for a human to understand due to the presence of large amount of
non-sense class/method/field names.

If you wanted to hide the underlying code completely, so a hacker does not
have access to the logics, you can try our protector product
(http://www.remotesoft.com/salamander/protector.html). It modifies the MSIL
code, instead of the sybol names. Once protected, the MSIL code is no longer
visible.

Thanks,

Huihong

"Chua Wen Ching" <ch************@nospam.hotmail.com> wrote in message
news:CA**********************************@microsof t.com...

Hi all,

Basically right now, i am interested to learn how to break strong names in .net assemblies. I had researched a lot and found a blog that mention how to hack strong name assemblies.
http://blogs.msdn.com/shawnfa/archiv...20/218049.aspx

"
In order to enable post-build modifications, you need to either:

Delay sign your assembly, hack the PE image, and then perform the final
signing; or
Sign your assembly, hack the PE image, and the use SN -R to resign the
assembly
"
I had look and read about Portable Executables, but the problem is most of them are in concepts.

Do you had any experience in breaking apart a .net strong name assemblies?
It seems that PE are in C++ codes, and in order to hack PE, i need to
write C++ codes, or use binary editors to manually change?

I am looking into possibilities to protected my office .net libraries, at least make it harder for hacker.

I heard you can apply a ECMA key, and you can secure the libraries, just
like what Microsoft did to some of their .net framework codes, which you
can't use .net reflector to see the codes.

Please correct me if had a wrong understanding :)

I tried the binary editor from Visual Studio .NET, but i can't seem to
understand how to modify anything (hex or ascii), when i change and save back to the exe, it fails to run. An error related to not a proper win32
executable.

I had tested with ildasm by generating an il, manually delete the lines of codes that calls the software license and compile back to an exe by using
ilasm. That is easy. I think even you obfuscate the code, it is still
breakable as obfuscation only changes method and class names to
alphanumerics. The codes in there are still the same.

Is there no way way to encrypt all the codes than being shown in there? I tried obfuscation and strong names, it seems to be the same. No difference. I can still see codes inside void main (example) using .net reflector by Lutz Roeder or Anakrino.

Can you share some opinion to me, please?

Thanks.

--
Regards,
Chua Wen Ching :)

[Miha Markic [MVP C#]]

Hi Chua,

Strong naming is not a form of encryption. It just guarantees that an
assembly is not tampered and also who signed it (which strong key).
You can delete or change the signature but then the assembly is tampered and
any application using it will notice (if the application was linked or is
linking against original one).
As a form of protection, you should use one of obfuscators out there (just
search for obfuscator - one is included with vs.net, btw).

--
Miha Markic [MVP C#] - RightHand .NET consulting & development
miha at rthand com
www.rthand.com

"Chua Wen Ching" <ch************@nospam.hotmail.com> wrote in message
news:CA**********************************@microsof t.com...

Hi all,

Basically right now, i am interested to learn how to break strong names
in
.net assemblies. I had researched a lot and found a blog that mention how
to
hack strong name assemblies.
http://blogs.msdn.com/shawnfa/archiv...20/218049.aspx

"
In order to enable post-build modifications, you need to either:

Delay sign your assembly, hack the PE image, and then perform the final
signing; or
Sign your assembly, hack the PE image, and the use SN -R to resign the
assembly
"
I had look and read about Portable Executables, but the problem is most of
them are in concepts.

Do you had any experience in breaking apart a .net strong name
assemblies?

It seems that PE are in C++ codes, and in order to hack PE, i need to
write C++ codes, or use binary editors to manually change?

I am looking into possibilities to protected my office .net libraries, at
least make it harder for hacker.

I heard you can apply a ECMA key, and you can secure the libraries, just
like what Microsoft did to some of their .net framework codes, which you
can't use .net reflector to see the codes.

Please correct me if had a wrong understanding :)

I tried the binary editor from Visual Studio .NET, but i can't seem to
understand how to modify anything (hex or ascii), when i change and save
back
to the exe, it fails to run. An error related to not a proper win32
executable.

I had tested with ildasm by generating an il, manually delete the lines
of
codes that calls the software license and compile back to an exe by using
ilasm. That is easy. I think even you obfuscate the code, it is still
breakable as obfuscation only changes method and class names to
alphanumerics. The codes in there are still the same.

Is there no way way to encrypt all the codes than being shown in there? I
tried obfuscation and strong names, it seems to be the same. No
difference. I
can still see codes inside void main (example) using .net reflector by
Lutz
Roeder or Anakrino.

Can you share some opinion to me, please?

Thanks.

--
Regards,
Chua Wen Ching :)

[Lionel Lindemann]

Hello,

May I suggest that you consider our obfuscator, very easy to use and
reasonably priced:

http://www.xenocode.com

Regards

Lionel Lindemann
XenoCode Europe

"Chua Wen Ching" <ch************@nospam.hotmail.com> wrote in message news:<CA**********************************@microso ft.com>...

Hi all,

Basically right now, i am interested to learn how to break strong names in
.net assemblies. I had researched a lot and found a blog that mention how to
hack strong name assemblies.
http://blogs.msdn.com/shawnfa/archiv...20/218049.aspx

"
In order to enable post-build modifications, you need to either:

Delay sign your assembly, hack the PE image, and then perform the final
signing; or
Sign your assembly, hack the PE image, and the use SN -R to resign the
assembly
"
I had look and read about Portable Executables, but the problem is most of
them are in concepts.

Do you had any experience in breaking apart a .net strong name assemblies?

It seems that PE are in C++ codes, and in order to hack PE, i need to
write C++ codes, or use binary editors to manually change?

I am looking into possibilities to protected my office .net libraries, at
least make it harder for hacker.

I heard you can apply a ECMA key, and you can secure the libraries, just
like what Microsoft did to some of their .net framework codes, which you
can't use .net reflector to see the codes.

Please correct me if had a wrong understanding :)

I tried the binary editor from Visual Studio .NET, but i can't seem to
understand how to modify anything (hex or ascii), when i change and save back
to the exe, it fails to run. An error related to not a proper win32
executable.

I had tested with ildasm by generating an il, manually delete the lines of
codes that calls the software license and compile back to an exe by using
ilasm. That is easy. I think even you obfuscate the code, it is still
breakable as obfuscation only changes method and class names to
alphanumerics. The codes in there are still the same.

Is there no way way to encrypt all the codes than being shown in there? I
tried obfuscation and strong names, it seems to be the same. No difference. I
can still see codes inside void main (example) using .net reflector by Lutz
Roeder or Anakrino.

Can you share some opinion to me, please?

Thanks.

[Chua Wen Ching]

I see... only obfuscator the only way :(

Yeah, i will evaluate it...

"Lionel Lindemann" wrote:

Hello,

May I suggest that you consider our obfuscator, very easy to use and
reasonably priced:

http://www.xenocode.com

Regards

Lionel Lindemann
XenoCode Europe

"Chua Wen Ching" <ch************@nospam.hotmail.com> wrote in message news:<CA**********************************@microso ft.com>...

Hi all,

Basically right now, i am interested to learn how to break strong names in
.net assemblies. I had researched a lot and found a blog that mention how to
hack strong name assemblies.
http://blogs.msdn.com/shawnfa/archiv...20/218049.aspx

"
In order to enable post-build modifications, you need to either:

Delay sign your assembly, hack the PE image, and then perform the final
signing; or
Sign your assembly, hack the PE image, and the use SN -R to resign the
assembly
"
I had look and read about Portable Executables, but the problem is most of
them are in concepts.

Do you had any experience in breaking apart a .net strong name assemblies?

It seems that PE are in C++ codes, and in order to hack PE, i need to
write C++ codes, or use binary editors to manually change?

I am looking into possibilities to protected my office .net libraries, at
least make it harder for hacker.

I heard you can apply a ECMA key, and you can secure the libraries, just
like what Microsoft did to some of their .net framework codes, which you
can't use .net reflector to see the codes.

Please correct me if had a wrong understanding :)

I tried the binary editor from Visual Studio .NET, but i can't seem to
understand how to modify anything (hex or ascii), when i change and save back
to the exe, it fails to run. An error related to not a proper win32
executable.

I had tested with ildasm by generating an il, manually delete the lines of
codes that calls the software license and compile back to an exe by using
ilasm. That is easy. I think even you obfuscate the code, it is still
breakable as obfuscation only changes method and class names to
alphanumerics. The codes in there are still the same.

Is there no way way to encrypt all the codes than being shown in there? I
tried obfuscation and strong names, it seems to be the same. No difference. I
can still see codes inside void main (example) using .net reflector by Lutz
Roeder or Anakrino.

Can you share some opinion to me, please?

Thanks.