[IMPORTANT] obfuscators

[Yama]

Gentlemen,

I realized that code security can easily be corrupted by cheap decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Richard Blewett [DevelopMentor]]

There is only one way to stop someone reverse engineering your binary - don't give them the binary, only provide remote access. Once you have given them your binary then you are in a battle as to the cost in reverse engineering compared with the benefit they will get from reverse engineering.

For example, reverse engineering an industrial strength cryptography algorithm gives ytooiu nothing as the algorithm is public knowledge (in general) and the cryptography, just by its nature is hard to crack. Reverse engineering MS Word would not give you a huge amout of information about howq Word works as its complexity lives at the macro level not within each method. So many application just provide no benefit from reverse engineering.

If you must supply the binary and it does have IP in teh code (like a new video CODEC) then you have two options: obfuscation or building the sensitive operation in non-managed code and using interop. The latter takes the reverse engineering difficulty to the same level as the world before .NET.

Regards

Richard Blewett - DevelopMentor
http://www.dotnetconsult.co.uk/weblog
http://www.dotnetconsult.co.uk

nntp://news.microsoft.com/microsoft.public.dotnet.languages.csharp/<BD**********************************@microsoft.co m>

Gentlemen,

I realized that code security can easily be corrupted by cheap decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Richard Blewett [DevelopMentor]]

There is only one way to stop someone reverse engineering your binary - don't give them the binary, only provide remote access. Once you have given them your binary then you are in a battle as to the cost in reverse engineering compared with the benefit they will get from reverse engineering.

For example, reverse engineering an industrial strength cryptography algorithm gives ytooiu nothing as the algorithm is public knowledge (in general) and the cryptography, just by its nature is hard to crack. Reverse engineering MS Word would not give you a huge amout of information about howq Word works as its complexity lives at the macro level not within each method. So many application just provide no benefit from reverse engineering.

If you must supply the binary and it does have IP in teh code (like a new video CODEC) then you have two options: obfuscation or building the sensitive operation in non-managed code and using interop. The latter takes the reverse engineering difficulty to the same level as the world before .NET.

Regards

Richard Blewett - DevelopMentor
http://www.dotnetconsult.co.uk/weblog
http://www.dotnetconsult.co.uk

nntp://news.microsoft.com/microsoft.public.dotnet.languages.csharp/<BD**********************************@microsoft.co m>

Gentlemen,

I realized that code security can easily be corrupted by cheap decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Yama]

Thanks Richard.

What obfuscation software does Microsoft provide? suggest?

Thanks,

Yama
"Richard Blewett [DevelopMentor]" <ri******@NOSPAMdevelop.com> wrote in
message news:OL**************@tk2msftngp13.phx.gbl...

There is only one way to stop someone reverse engineering your binary -
don't give them the binary, only provide remote access. Once you have
given them your binary then you are in a battle as to the cost in reverse
engineering compared with the benefit they will get from reverse
engineering.

For example, reverse engineering an industrial strength cryptography
algorithm gives ytooiu nothing as the algorithm is public knowledge (in
general) and the cryptography, just by its nature is hard to crack.
Reverse engineering MS Word would not give you a huge amout of information
about howq Word works as its complexity lives at the macro level not
within each method. So many application just provide no benefit from
reverse engineering.

If you must supply the binary and it does have IP in teh code (like a new
video CODEC) then you have two options: obfuscation or building the
sensitive operation in non-managed code and using interop. The latter
takes the reverse engineering difficulty to the same level as the world
before .NET.

Regards

Richard Blewett - DevelopMentor
http://www.dotnetconsult.co.uk/weblog
http://www.dotnetconsult.co.uk
nntp://news.microsoft.com/microsoft.public.dotnet.languages.csharp/<BD**********************************@microsoft.co m>

Gentlemen,

I realized that code security can easily be corrupted by cheap
decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Yama]

Thanks Richard.

What obfuscation software does Microsoft provide? suggest?

Thanks,

Yama
"Richard Blewett [DevelopMentor]" <ri******@NOSPAMdevelop.com> wrote in
message news:OL**************@tk2msftngp13.phx.gbl...

There is only one way to stop someone reverse engineering your binary -
don't give them the binary, only provide remote access. Once you have
given them your binary then you are in a battle as to the cost in reverse
engineering compared with the benefit they will get from reverse
engineering.

For example, reverse engineering an industrial strength cryptography
algorithm gives ytooiu nothing as the algorithm is public knowledge (in
general) and the cryptography, just by its nature is hard to crack.
Reverse engineering MS Word would not give you a huge amout of information
about howq Word works as its complexity lives at the macro level not
within each method. So many application just provide no benefit from
reverse engineering.

If you must supply the binary and it does have IP in teh code (like a new
video CODEC) then you have two options: obfuscation or building the
sensitive operation in non-managed code and using interop. The latter
takes the reverse engineering difficulty to the same level as the world
before .NET.

Regards

Richard Blewett - DevelopMentor
http://www.dotnetconsult.co.uk/weblog
http://www.dotnetconsult.co.uk
nntp://news.microsoft.com/microsoft.public.dotnet.languages.csharp/<BD**********************************@microsoft.co m>

Gentlemen,

I realized that code security can easily be corrupted by cheap
decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Scott Allen]

There is nothing that is going to make it 100% impossible, but as you
probably know there are obfuscators available to make the job more
difficult.

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Tue, 9 Nov 2004 16:15:06 -0800, "Yama"
<Ya**@discussions.microsoft.com> wrote:

Gentlemen,

I realized that code security can easily be corrupted by cheap decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Scott Allen]

There is nothing that is going to make it 100% impossible, but as you
probably know there are obfuscators available to make the job more
difficult.

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Tue, 9 Nov 2004 16:15:06 -0800, "Yama"
<Ya**@discussions.microsoft.com> wrote:

Gentlemen,

I realized that code security can easily be corrupted by cheap decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Arne Janning]

Hi Yama!

"Yama" schrieb

What obfuscation software does Microsoft provide? suggest?

Microsoft does not provide any obfuscation software. However Microsoft
distributes a "community" version of Dotfuscator from PreEmtive Solutions
together with Visual Studio 2003.

You'll find more info here:

http://www.gotdotnet.com/team/dotfuscator/

Cheers

Arne Janning

[Arne Janning]

Hi Yama!

"Yama" schrieb

What obfuscation software does Microsoft provide? suggest?

Microsoft does not provide any obfuscation software. However Microsoft
distributes a "community" version of Dotfuscator from PreEmtive Solutions
together with Visual Studio 2003.

You'll find more info here:

http://www.gotdotnet.com/team/dotfuscator/

Cheers

Arne Janning

[William Stacey [MVP]]

Everything can be reverse engineered or brute forced given time, desire, and
money - including native win32 exes and public key crypto. That will not
change I don't think. What you hope for is to make it so painful to do so,
that people don't try or just give up. I have XenoCode 2003 version and am
now at 2005. I really like this startup and their product. I was able to
crash a decompiler that was boasting about how they could decompile any .net
assembly using the defaults. It is also really easy to use and includes
signing, and building one exe from many assemblies with point and click or
command line. They have things like string encryption, control flow
obfuscation, and something to crash ILASM and others if someone tries to use
that. TMK, it is about as good as it gets in obfuscators today. Try the
trial and use Reflector on the resulting assembly to see what it does or
does not do. hth

--
William Stacey, MVP
http://mvp.support.microsoft.com

"Yama" <Ya**@discussions.microsoft.com> wrote in message
news:BD**********************************@microsof t.com...

Gentlemen,

I realized that code security can easily be corrupted by cheap decompilers. What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[William Stacey [MVP]]

Everything can be reverse engineered or brute forced given time, desire, and
money - including native win32 exes and public key crypto. That will not
change I don't think. What you hope for is to make it so painful to do so,
that people don't try or just give up. I have XenoCode 2003 version and am
now at 2005. I really like this startup and their product. I was able to
crash a decompiler that was boasting about how they could decompile any .net
assembly using the defaults. It is also really easy to use and includes
signing, and building one exe from many assemblies with point and click or
command line. They have things like string encryption, control flow
obfuscation, and something to crash ILASM and others if someone tries to use
that. TMK, it is about as good as it gets in obfuscators today. Try the
trial and use Reflector on the resulting assembly to see what it does or
does not do. hth

--
William Stacey, MVP
http://mvp.support.microsoft.com

"Yama" <Ya**@discussions.microsoft.com> wrote in message
news:BD**********************************@microsof t.com...

Gentlemen,

I realized that code security can easily be corrupted by cheap decompilers. What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Steve McLellan]

Hi,

We also use Xenocode and I've found it very good, there're also other
products from RemoteSoft and the PreEmptive one that somebody else mentioned
(which also has a paid for version). They all do a fairly similar job, I
think. But, as has been said before, if someone really, really, really wants
to look at your source code they will, in any language. The question is why
would they, and how much effort are they willing to put into it?

Steve

"William Stacey [MVP]" <st***********@mvps.org> wrote in message
news:Oa****************@tk2msftngp13.phx.gbl...

Everything can be reverse engineered or brute forced given time, desire,
and
money - including native win32 exes and public key crypto. That will not
change I don't think. What you hope for is to make it so painful to do
so,
that people don't try or just give up. I have XenoCode 2003 version and
am
now at 2005. I really like this startup and their product. I was able to
crash a decompiler that was boasting about how they could decompile any
.net
assembly using the defaults. It is also really easy to use and includes
signing, and building one exe from many assemblies with point and click or
command line. They have things like string encryption, control flow
obfuscation, and something to crash ILASM and others if someone tries to
use
that. TMK, it is about as good as it gets in obfuscators today. Try the
trial and use Reflector on the resulting assembly to see what it does or
does not do. hth

--
William Stacey, MVP
http://mvp.support.microsoft.com

"Yama" <Ya**@discussions.microsoft.com> wrote in message
news:BD**********************************@microsof t.com...

Gentlemen,

I realized that code security can easily be corrupted by cheap

decompilers.

What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Steve McLellan]

Hi,

We also use Xenocode and I've found it very good, there're also other
products from RemoteSoft and the PreEmptive one that somebody else mentioned
(which also has a paid for version). They all do a fairly similar job, I
think. But, as has been said before, if someone really, really, really wants
to look at your source code they will, in any language. The question is why
would they, and how much effort are they willing to put into it?

Steve

"William Stacey [MVP]" <st***********@mvps.org> wrote in message
news:Oa****************@tk2msftngp13.phx.gbl...

Everything can be reverse engineered or brute forced given time, desire,
and
money - including native win32 exes and public key crypto. That will not
change I don't think. What you hope for is to make it so painful to do
so,
that people don't try or just give up. I have XenoCode 2003 version and
am
now at 2005. I really like this startup and their product. I was able to
crash a decompiler that was boasting about how they could decompile any
.net
assembly using the defaults. It is also really easy to use and includes
signing, and building one exe from many assemblies with point and click or
command line. They have things like string encryption, control flow
obfuscation, and something to crash ILASM and others if someone tries to
use
that. TMK, it is about as good as it gets in obfuscators today. Try the
trial and use Reflector on the resulting assembly to see what it does or
does not do. hth

--
William Stacey, MVP
http://mvp.support.microsoft.com

"Yama" <Ya**@discussions.microsoft.com> wrote in message
news:BD**********************************@microsof t.com...

Gentlemen,

I realized that code security can easily be corrupted by cheap

decompilers.

What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar

[Richard Blewett [DevelopMentor]]

Dotfuscator Community Edition is not really an industrial strength obfuscator you would need either to upgrade to the Professional version or use another product as stated.

Another one you might want to look at is Demeanor from Wise Owl Consulting

http://www.wiseowl.com/Products/products.aspx

Regards

Richard Blewett - DevelopMentor
http://www.dotnetconsult.co.uk/weblog
http://www.dotnetconsult.co.uk

nntp://news.microsoft.com/microsoft.public.dotnet.languages.csharp/<uL**************@TK2MSFTNGP15.phx.gbl>

Hi,

We also use Xenocode and I've found it very good, there're also other
products from RemoteSoft and the PreEmptive one that somebody else mentioned
(which also has a paid for version). They all do a fairly similar job, I
think. But, as has been said before, if someone really, really, really wants
to look at your source code they will, in any language. The question is why
would they, and how much effort are they willing to put into it?

Steve

[Richard Blewett [DevelopMentor]]

Dotfuscator Community Edition is not really an industrial strength obfuscator you would need either to upgrade to the Professional version or use another product as stated.

Another one you might want to look at is Demeanor from Wise Owl Consulting

http://www.wiseowl.com/Products/products.aspx

Regards

Richard Blewett - DevelopMentor
http://www.dotnetconsult.co.uk/weblog
http://www.dotnetconsult.co.uk

nntp://news.microsoft.com/microsoft.public.dotnet.languages.csharp/<uL**************@TK2MSFTNGP15.phx.gbl>

Hi,

We also use Xenocode and I've found it very good, there're also other
products from RemoteSoft and the PreEmptive one that somebody else mentioned
(which also has a paid for version). They all do a fairly similar job, I
think. But, as has been said before, if someone really, really, really wants
to look at your source code they will, in any language. The question is why
would they, and how much effort are they willing to put into it?

Steve

[Bob Sillett]

A free version of DOTfuscator is included in VS 2003. Tools / Dotfuscator
Community Edition.

The free version is limited in that it basically renames assemblies;
however, that's not too bad for a freeware application. It's also a good
place to start playing around with the utility.

Bob
"Yama" <Ya**@discussions.microsoft.com> wrote in message
news:BD**********************************@microsof t.com...

Gentlemen,

I realized that code security can easily be corrupted by cheap
decompilers.
What does Microsoft suggest using to disable or at the least make it
impossible for the intruder to reverse engineer DLLs or EXEs.

Thanks,

Yama Kamyar