secure .net applications against disassembly

[Achim Kühn]

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily disassemble
and manipulate the application?

[Ken Tucker [MVP]]

Hi,

Use an obfuscator like dotfuscator comuntity edition which comes
with visual studio 2003.

Ken
--------------
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK**************@TK2MSFTNGP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily disassemble and manipulate the application?

[Jan Tielens]

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition
is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java
's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered
from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and
we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same
nutritional value as it did before (luckily, CLRs aren't picky about taste).
The trick of an obfuscator is to confuse observers, while still giving CLRs
the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK**************@TK2MSFTNGP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily disassemble and manipulate the application?

[Jan Tielens]

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition
is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java
's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered
from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and
we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same
nutritional value as it did before (luckily, CLRs aren't picky about taste).
The trick of an obfuscator is to confuse observers, while still giving CLRs
the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK**************@TK2MSFTNGP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily disassemble and manipulate the application?

[Bryan Martin]

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.please.leadit.be> wrote in message
news:%2****************@TK2MSFTNGP10.phx.gbl...

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java 's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same nutritional value as it did before (luckily, CLRs aren't picky about taste). The trick of an obfuscator is to confuse observers, while still giving CLRs the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK**************@TK2MSFTNGP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily

disassemble

and manipulate the application?

[Bryan Martin]

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.please.leadit.be> wrote in message
news:%2****************@TK2MSFTNGP10.phx.gbl...

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community edition is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption,
but in the context of .NET (or java) code, it might be better. Early in Java 's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution.
Although this made classes completely unreadable, this methodology suffered from a classic encryption flaw, it needed to keep the decryption-key with
the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key and we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the
bottom of the box), the food is in plain view. Obfuscation works more like
putting the six item meal into a blender and sending it to the diner in a
baggie. Sure everyone can see the food in transit, but besides a lucky pea
or some beef-colored goop, they don't know what the original meal is. The
diner still gets the intended delivery and the meal still provides the same nutritional value as it did before (luckily, CLRs aren't picky about taste). The trick of an obfuscator is to confuse observers, while still giving CLRs the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK**************@TK2MSFTNGP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is
there any way to secure the application so the user can´t easily

disassemble

and manipulate the application?

[Jan Tielens]

?

--
Greetz,
Jan
__________________________________
Read my weblog: http://weblogs.asp.net/jan
"Bryan Martin" <sp**@ahwayside.com> schreef in bericht
news:eN**************@TK2MSFTNGP11.phx.gbl...

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.please.leadit.be> wrote in message
news:%2****************@TK2MSFTNGP10.phx.gbl...

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community

edition

is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption, but in the context of .NET (or java) code, it might be better. Early in

Java

's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution. Although this made classes completely unreadable, this methodology

suffered

from a classic encryption flaw, it needed to keep the decryption-key with the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key

and

we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the bottom of the box), the food is in plain view. Obfuscation works more like putting the six item meal into a blender and sending it to the diner in a baggie. Sure everyone can see the food in transit, but besides a lucky pea or some beef-colored goop, they don't know what the original meal is. The diner still gets the intended delivery and the meal still provides the

same

nutritional value as it did before (luckily, CLRs aren't picky about

taste).

The trick of an obfuscator is to confuse observers, while still giving

CLRs

the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK**************@TK2MSFTNGP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is there any way to secure the application so the user can´t easily

disassemble

and manipulate the application?

[Jan Tielens]

?

--
Greetz,
Jan
__________________________________
Read my weblog: http://weblogs.asp.net/jan
"Bryan Martin" <sp**@ahwayside.com> schreef in bericht
news:eN**************@TK2MSFTNGP11.phx.gbl...

Please eat breakfast prior to posting ;)
"Jan Tielens" <ja*@no.spam.please.leadit.be> wrote in message
news:%2****************@TK2MSFTNGP10.phx.gbl...

You need to use obfuscation. In VS.NET 2003 the Obfuscator Community

edition

is available (seen link at then end of this message too).

Obfuscation is the technology of shrouding the facts. It's not encryption, but in the context of .NET (or java) code, it might be better. Early in

Java

's life, several companies produced encrypting class loaders to fully
encrypt java classes. Decryption was done Just-in-time prior to execution. Although this made classes completely unreadable, this methodology

suffered

from a classic encryption flaw, it needed to keep the decryption-key with the encrypted data. Therefore, an automated utility could be created to
decrypt the code and put it out to disk. Once that happens the fully
unencrypted, unobfuscated code is in plain view.
As another comparison, we could compare encryption to locking a six item
meal into a lockbox. Only the intended diner (i.e. the CLR) has the key

and

we don't want anyone else to know what he or she is going to eat.
Unfortunately, if someone can pick the lock (or find the key hidden on the bottom of the box), the food is in plain view. Obfuscation works more like putting the six item meal into a blender and sending it to the diner in a baggie. Sure everyone can see the food in transit, but besides a lucky pea or some beef-colored goop, they don't know what the original meal is. The diner still gets the intended delivery and the meal still provides the

same

nutritional value as it did before (luckily, CLRs aren't picky about

taste).

The trick of an obfuscator is to confuse observers, while still giving

CLRs

the same delivery.
SOURCE:
http://www.preemptive.com/dotfuscato...scator_ce.html

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan
"Achim Kühn" <a.*****@e-llusions.de> wrote in message
news:eK**************@TK2MSFTNGP09.phx.gbl...

I´m planning to write a windows application using the .net framework. is there any way to secure the application so the user can´t easily

disassemble

and manipulate the application?

Another option is salamander .net protector, seems to
modify MSIL code instead of simple obfuscation.

http://www.remotesoft.com/salamander/protector.html

-----Original Message-----
I´m planning to write a windows application using the .net framework. isthere any way to secure the application so the user can´t easily disassembleand manipulate the application?


.

Another option is salamander .net protector, seems to
modify MSIL code instead of simple obfuscation.

http://www.remotesoft.com/salamander/protector.html

-----Original Message-----
I´m planning to write a windows application using the .net framework. isthere any way to secure the application so the user can´t easily disassembleand manipulate the application?


.