secure .net applications against disassembly

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition
is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java
's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered
from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and
we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same
nutritional value as it did before (luckily, CLRs aren't picky about taste).
The trick of an obfuscator is to confuse observers, while still giving CLRs
the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
_______________ _______________ __
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK******** ******@TK2MSFTN GP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily disassemble and manipulate the application?

Jul 21 '05 #3

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily disassemble and manipulate the application?

Jul 21 '05 #4

Bryan Martin

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.pl ease.leadit.be> wrote in message
news:%2******** ********@TK2MSF TNGP10.phx.gbl. ..

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java 's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same nutritional value as it did before (luckily, CLRs aren't picky about taste). The trick of an obfuscator is to confuse observers, while still giving CLRs the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
_______________ _______________ __
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK******** ******@TK2MSFTN GP09.phx.gbl...
I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily

disassemble
and manipulate the application?

Jul 21 '05 #5

Bryan Martin

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.pl ease.leadit.be> wrote in message
news:%2******** ********@TK2MSF TNGP10.phx.gbl. ..

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java 's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same nutritional value as it did before (luckily, CLRs aren't picky about taste). The trick of an obfuscator is to confuse observers, while still giving CLRs the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
_______________ _______________ __
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK******** ******@TK2MSFTN GP09.phx.gbl...
I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily

disassemble
and manipulate the application?

Jul 21 '05 #6

?

--
Greetz,
Jan
_______________ _______________ ____
Read my weblog: http://weblogs.asp.net/jan
"Bryan Martin" <sp**@ahwayside .com> schreef in bericht
news:eN******** ******@TK2MSFTN GP11.phx.gbl...

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.pl ease.leadit.be> wrote in message
news:%2******** ********@TK2MSF TNGP10.phx.gbl. ..
You need to use obfuscation. In VS.NET 2003 the Obfuscator Community

edition
is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption, but in the context of .NET (or java) code, it might be better. Early in

Java
's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution. Although this made classes completely unreadable, this methodology

suffered
from a classic encryption flaw, it needed to keep the decryption-key with the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key

and
we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the bottom of the box), the food is in plain view. Obfuscation works more like putting the six item meal into a blender and sending it to the diner in a baggie. Sure everyone can see the food in transit, but besides a lucky pea or some beef-colored goop, they don't know what the original meal is. The diner still gets the intended delivery and the meal still provides the

same
nutritional value as it did before (luckily, CLRs aren't picky about

taste).
The trick of an obfuscator is to confuse observers, while still giving

CLRs
the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
_______________ _______________ __
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK******** ******@TK2MSFTN GP09.phx.gbl...
I´m planning to write a windows application using the .net framework. is there any way to secure the application so the user can´t easily

disassemble
and manipulate the application?

Jul 21 '05 #7

secure .net applications against disassembly

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.pl ease.leadit.be> wrote in message
news:%2******** ********@TK2MSF TNGP10.phx.gbl. ..
You need to use obfuscation. In VS.NET 2003 the Obfuscator Community

edition
is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption, but in the context of .NET (or java) code, it might be better. Early in

Java
's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution. Although this made classes completely unreadable, this methodology

suffered
from a classic encryption flaw, it needed to keep the decryption-key with the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key

and
we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the bottom of the box), the food is in plain view. Obfuscation works more like putting the six item meal into a blender and sending it to the diner in a baggie. Sure everyone can see the food in transit, but besides a lucky pea or some beef-colored goop, they don't know what the original meal is. The diner still gets the intended delivery and the meal still provides the

same
nutritional value as it did before (luckily, CLRs aren't picky about

taste).
The trick of an obfuscator is to confuse observers, while still giving

CLRs
the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
_______________ _______________ __
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK******** ******@TK2MSFTN GP09.phx.gbl...
I´m planning to write a windows application using the .net framework. is there any way to secure the application so the user can´t easily

disassemble
and manipulate the application?

Jul 21 '05 #8

Another option is salamander .net protector, seems to
modify MSIL code instead of simple obfuscation.

http://www.remotesoft.com/salamander/protector.html

-----Original Message-----
I´m planning to write a windows application using the .net framework. isthere any way to secure the application so the user can´t easily disassembleand manipulate the application?

.

Jul 21 '05 #9

Another option is salamander .net protector, seems to
modify MSIL code instead of simple obfuscation.

http://www.remotesoft.com/salamander/protector.html

-----Original Message-----
I´m planning to write a windows application using the .net framework. isthere any way to secure the application so the user can´t easily disassembleand manipulate the application?

.

Jul 21 '05 #10

Similar topics

307

by: Achim Kühn | last post by:

I´m planning to write a windows application using the .net framework. is there any way to secure the application so the user can´t easily disassemble and manipulate the application?

1597

Is VB.NET Code Secure?

by: Don Wash | last post by:

Hi Everyone! I'm new to .NET but I'm a experienced VB programmer (since VB 4) and wanting to move to VB.NET from VB 6. But as I read about .NET, I came across that compiled VB.NET code is stored in MSIL (instead of binary) which is easily decryptable by the "hackers" to reverse engineer your VB.NET application. Is this true?

What is this? "Disassembly cannot be displayed in run mode"

11778

by: kjon | last post by:

When I try to run any project, sometimes I will encounter this tab window in the IDE which has the following message: "Disassembly cannot be displayed in run mode". I mean it'll show sometimes, and sometimes don't. Just wonder what is the meaning of this? Do I need to concern of any wrong doing in my program or codes? Thanks in advance.

13415

Disable Disassembly

by: Matthew | last post by:

I had an error in a program I was working on. A dialog box came up saying "do you want to view Disassembly?" I clicked OK just for the fun of it, and now every time I run the program it opens a new tab in VB.NET titled Disassembly. My guess is I checked an option to view the disassembly every time. However, I really don't want this to...

Share session between secure and non-secure applications

2161

by: Joe | last post by:

I have an application which runs in a non-secure environment. I also have an application that runs in a secure environment (both on the same machine). Is there any way to share the session data for this? Most of the site allows the user to add things to a cart (non-secure), once they choose to check-out, I need this information which was...

ASP.NET

1676

disassembly tab?

by: cj | last post by:

Recently for no apparent reason VB 2003 has been opening a Disassembly tab along with Form1.Vb, Start Page, etc. The Disassembly tab has in it Address and a text box followed by (Enter an address to view disassembly.) Where is this coming from? What is making it appear? I'm working on just a standard windows application. No web stuff.

How to secure the Dotnet code

4588

by: Usman | last post by:

Hi I'm working on an application that contains classes for licensing, authentication etc, including all the algorithms of encryption/decryption etc. I wanted to secure this code, but after compiling all the code, I just thought of trying a decompiler on the output file. The decompiler generated almost 99% of the exact code out of it,...

VS.NET 2005 - always steps into disassembly

4117

by: Nathan Mates | last post by:

I'm using VS.NET 2005SP1 (C++ Express, though I've also seen this on 2005 Standard SP1). One bit of behavior that's been bugging me a lot, and seems to have gotten worse with SP1, is that if it ever once goes to disassembly view, it will ALWAYS change to disassembly view when I step thru code until I quit VS.NET and restart. (2005 original...

How to disable disassembly window in VC++ 2005?

4399

by: Herhor | last post by:

Hello! I have already started C++ programming with VC++ 2005 Express Edition. Unfortunately during debugging one of my first programs I had to unintentionally enable some debugger configuration feature which turns on Disassembly Window at the end of every my program (basic example below). int main() { //some instructions;

secure my DLL against use by others

1692

by: =?Utf-8?B?TWljaGVsQFZvb3JidXJn?= | last post by:

Hi all, i've built a C# dll / component with some wonderful services to the clients Payroll service. As you might guess, i only want MY pogram to use this DLL. If some developer get's hold of a reference to my dll, he or she could easily use all methods to raise his or hers salary.... I tried code access security, bu i can only use that...