How are you protecting your .net applications?

What are you doing to thward hackers and competitors from reverse engineering your products?

I have not seen this topic discussed on this forum.

.NET has a utility called Dotfucator. It helps prevent reverse engineering of your program.

HTH

I'd think of protecting it if it were a commercial application/product.

Quote:

---

Originally Posted by mendhak

I'd think of protecting it if it were a commercial application/product.

---

With Dotfuscator or something else?

Dotfuscator, yes. And there are some (ironically) commercial solutions to protect your applications out there.

But from what I know of Reflection, if someone is really really determined, your .NET isn't completely safe. One way I've heard of is to actually write the most "important" part of the code in C++, compile as a DLL, and use Interop to use it in your .net app! I don't like that approach, but hey, to each his own right?

Microsoft has a list of tools here for protecting apps, and it seems to be Obfuscators all the way. Their algos might vary, I suppose.

Hows that Thing Work, It Seems to Search for xml or Some type of file eXTENSION? I Thought You could Just Find the .exe and come back after Coffee and Surprize!

As a side note Obfuscation can jack some reflections situations. I don't mean someone else trying to reflect or reverse your code I mean your code using reflection to evaluate things at runtime. Since the Obfuscation changes the type names and types and things of that nature then I wouldn't recommend any heavy reflection in the code it seems to get confused.

Dotfuscator is crap. In addition to Edneeis' comments, it can also bugger up binary serialisation and backwards compatibility with stuff.

"Removing unused fields" is not a good option to go for.

First you need a license agreement that makes it clear that reverse engineering is not permitted. That way anyone doing so knows that they are breaking the rules.

Next look at obfiscation of the code that handles licensing and and really clever proprietry algorithms but don't bother obfiscating the whole application.

A few more links I've come across while googling:

www.uspto.gov

http://www.c-sharpcorner.com/Security/ProtectILCode.asp

- Anti Cracking FAQ How to make cracking your programs a little
harder
( http://www.inner-smile.com/nocrack.phtml )

- Defending Shareware Against Cracks by Adam Smith
( http://www.senseofsecurity.com/sharenc.asp )

- Protect your programs from piracy
( http://webdon.com/vitas/antihack.asp )

- How To Protect Better
( http://www.searchlores.org/protec/protec.htm )

Obfuscation is a very weak way of protection your .net application imho. Even though the names are now scewed the source is still visible with a IL Object browser.. Sure some may throw in some goofy code to throw off people but you can still pull the code right out of your .net exe's..

Anyone do any research on thinstall or remotesoft?

www.thinstall.com
www.remotesoft.com

I would suggest reverse engineering an application and see how easy or hard it is. Then obfuscate it and try again and see if that is more effort than you think someone else will put into it. Then think of what it would be like for a larger application.

There really isn't much if anything that will fully protect you, so you are basically just trying to make it harder to do.

Obfuscators claim more protection than they can delivery..

for one, string encryption.. Sure you can't read the strings directly with your .net Object Browser but you can view the string decription function so all you have to do is pass the encrypted strings through this function and poof, there goes your "string encryption".

I believe obfuscation will only thwart those that do not know how to reverse engineer applications. It can be confusing to look at but you still have all functions in plain sight. Hard to protect algorithms when competitors can simply pull them out of your exe.

I know, old post... :p

So, how do we protect our apps?
What was MicroSoft thinking??

Them boneheads.... :mad:

.