Disadvantages of Visual Basic.NET

[might]

There is a huge disappointment when I read on a website that applications written Visual Basic.NET easily converted back to source code. Furthermore I am getting more excited since hearing good comments about Visual Basic.NET from Beta users.
I don`t know if this problem covers applications written in other languages compiled by Visual Studio.NET (But you know all languages first converted to common language then compiles to machine language, so is there any possibility for also other languages except VB ? )

What`s Microsoft trying to do ?
I had thought they really know the meaning of "commerical application", don`t they.

What`s your thought ?

[substring]

Which web site did you read about *hacking* VB.NET app for source code?

[might]

Firstly, sorry for being late.
I saw about this on a poll of product demo download page on the following link : http://www.aivosto.com/getshareware.html
The question is this : (On the 10th question)
Programs compiled with VB.NET may easily be discompiled back to source code.
Would that be a problem for you?

Thanks for interest

[hellswraith]

Also look in the May 2001 of Visual Basic Programmer's Journal. They have a whole article devoted to it.
If you have the DevX Premier Club membership you can read it online at www.vbpj.com and enter the code VB0105DF_T

To subscribe to the Premier Club go to www.devx.com

I am not advertising for them, just telling you where you can access an article on the subject.

[might]

I want to thank you for your interest and reply, Hellswraith.
I`m not a current member of Premier Club. Would you please give a summarize of the article, if possible.

Will Microsoft fix this problem in the future, or is there still a solution for this.

I searched through the DevX web site and found some threads of discussions about easily decompilation of VB.NET applications and how to decompile applications written in VB.NET .

This is a serious problem. Unless a solution is/will be provided, VB programmers` efforts will be stolen and the result will be vain.

[numtel]

it sux for me because even though i probably wont completely switch to .net windows isn't open source and even tho i like the idea of open sourse i'd use linux primarly if i wanted to develop with it.

[goudabuddha]

Sorry, but .NET is gay

[Smurfwow]

er...... why?

[numtel]

that's just what he says.

[DaoK]

.NEt work only in NT / 2000 = bad for user who dont have it

[Joacim Andersson]

The .Net framework will be available for every Windows OS from Win98 and above. There will be an unsupported version for Win95 as well.

You can't actually convert a .Net application back to the original source code but to a readable intermediate language code. Which looks something like this:

.method /*06000002*/ public instance bool
VerifyEmail(string Addr) cil managed
{
    // code size          20 (0x14)
    .maxstack  3
    .locals init (bool V_0)
    IL_0000:  ldarg.1
    IL_0001:  ldstr      "@" /* 70000001 */
    IL_0006:  ldc.i4.0
    IL_0007:  call        int32 [Microsoft.VisualBasic/* 23000002 */]Microsoft.VisualBasic.Strings/* 01000002 */::InStr(string, string, valuetype [Microsoft.VisualBasic/* 23000002 */]Microsoft.VisualBasic.CompareMethod/* 01000003 */) /* 0A000002 */
    IL_000c:  ldc.i4.0
    IL_000d:  ble.s      IL_0012

    IL_000f:  ldc.i4.1
    IL_0010:  br.s       IL_0013

    IL_0012:  ldloc.0
    IL_0013:  ret
}

The above is a part of a disassembly that shows one small method in a class written in VB.Net Beta2

(What it does is verifying if the passed string is an e-mail address simply by searching for an @-sign)

Best regards

[sail3005]

is MS making the unsupported Win95 version.

[BrianHawley]

I don't entirely buy this "decompile back to source code" argument - although I agree it's worth further investigation.

Right now there are tools that will 'decompile' almost anything (including VB) back to assembler. What you get is miles and miles of undocumented code that it is almost impossible to recompile back into the original - never mind modify it.

Are we talking about something similar here?

Joacim, how is it done? Do you have any good links?

Certainly I would like to have a go at any of my commercial applications to see if this is a security issue.

[Joacim Andersson]

Originally posted by sail3005
is MS making the unsupported Win95 version.

Yes, the Win98 version can be installed on Win95 but it will not be supported on that platform.

Originally posted by BrianHawley
I don't entirely buy this "decompile back to source code" argument - although I agree it's worth further investigation.

Right now there are tools that will 'decompile' almost anything (including VB) back to assembler. What you get is miles and miles of undocumented code that it is almost impossible to recompile back into the original - never mind modify it.

Are we talking about something similar here?

Joacim, how is it done? Do you have any good links?

Certainly I would like to have a go at any of my commercial applications to see if this is a security issue.

You will be able to decompile or disassemble a .Net assembly.
The disassembly program I used to produce the above posted code is ildasm.exe and that is included in the .Net Software Development Kit.
The advantage you'll get with the ability to disassemble an assembly is that you can debug compiled code.
Many commersial component developers have been pressuring Microsoft to come up with some sort of obfuscator tool that can scramble data to make it harder to figure out what a particular assembly is doing.
I beleive that such a tool will be provided, if not from Microsoft from some third-party.
But this problem isn't unique to .Net - other virtual machine-based platforms (read Java) suffer the same problem.

Best regards

[BrianHawley]

Thanks. That's interesting.

I wonder if it will be possible to use tricks to prevent exposure of the code, like the things you can do with assembler to trip-up disassemblers - putting in dummy code, phantom jumps, etc.

Microsoft may find this is a major issue for commercial programmers - particularly those who use some kind of authorisation scheme to unlock their apps. I doubt many people will pull apart a large app to change it cosmetically and market it as their own, but I'm sure many will try to strip-out the activation code (or break the scheme) and post in on the net.

Funny that this should come at a time when MS is going over to authorisation codes for XP, rather than unprotected copy-and-run. Maybe it's time for me to buy a copy of Delphi!

[sail3005]

Could someone explain why the win95 version is unsupported?

[Joacim Andersson]

The explanation I got from Microsoft is simply that they consider Win95 to be old and they will stop support it now when XP is released.

[JoshT]

Pretty much MS doesn't make any money when people don't upgrade their OSes every new release.

[Scott Penner]

.NET is really no different from Java. The common language runtime (read virtual machine) does essentialy what the the Jave runtime compiler does. (It's different enough to avoid a lawsuit from Sun )

Anyway, Java has had this same "issue" of producing an intermediate code that is much easier to pick apart than assembly. The idea suggested in VBPJ was to add an obfuscator like some Java compilers already have. This scrambles the variable names and function names before compilation, making undesired interpretation very time consuming.

I don't know if that added anything, but there it is....

[neodatatype]

Right now there are tools that will 'decompile' almost anything (including VB) back to assembler. What you get is miles and miles of undocumented code that it is almost impossible to recompile back into the original - never mind modify it.

It's not so easy

There are tools (try the on-line salamander for e.g.) that decompiles your app and also let you choose the language you want the decompiled back.

Decompile all but the comments and the name of variables.

Cya

[aspose]

A .Net Assembly obfuscator can prevent others from decompiling or disassembling. Could you try our obfuscator: Aspose.Obfuscator? With it, you can:

1. Obfuscate .Net Exe files while reserve all necessary names by itself
2. Obfuscate .Net Dll Files while reserve all necessary names by itself
3. Obufcate Asp.Net applications while reserve all necessary names by itself
4. Obfuscate applications whose type information is decided at runtime while reserve all necessary names by yourself

You can find more information at http://www.aspose.com and your comments or suggestions will be greatly appreciated.

[PT Exorcist]

u can get the VB,C#,blablabla code back using salamander

[MrPolite]

Originally posted by PT Exorcist
u can get the VB,C#,blablabla code back using salamander

aaah Salamander is weird!!!

[Hu Flung Dung]

Hold on a sec!

Whats all this talk about being able to decomile .NET apps so easily?

I know .NET apps compile to MSIL, which is comparable to Java bytecode. However, isn't that MSIL re-compiled by the JIT to native code? If so, then decompiling that would be no different from decompiling any other application! Right?

[MrPolite]

Originally posted by Hu Flung Dung
Hold on a sec!

Whats all this talk about being able to decomile .NET apps so easily?

I know .NET apps compile to MSIL, which is comparable to Java bytecode. However, isn't that MSIL re-compiled by the JIT to native code? If so, then decompiling that would be no different from decompiling any other application! Right?

try it, it works

it's only a 1000 dollars
http://www.remotesoft.com/salamander/



ummm, my brother decompiled some java apps before, but he said that there is a way that you can stop people from decompiling your app. The apps that he decompiled were just small example apps. I guess there is a way to stop people from decompiling your app

[PT Exorcist]

ummm, my brother decompiled some java apps before, but he said that there is a way that you can stop people from decompiling your app. The apps that he decompiled were just small example apps. I guess there is a way to stop people from decompiling your app

to that process we call obfuscation

[Hu Flung Dung]

Originally posted by MrPolite
try it, it works

it's only a 1000 dollars
http://www.remotesoft.com/salamander/



ummm, my brother decompiled some java apps before, but he said that there is a way that you can stop people from decompiling your app. The apps that he decompiled were just small example apps. I guess there is a way to stop people from decompiling your app

How long does it take? Its been working on my class for about an hour now!

[A$$Bandit]

I can't find the fricking MCI control, that's a huge disadvantage for the type of software I program!

[Hu Flung Dung]

Originally posted by A$$Bandit
I can't find the fricking MCI control, that's a huge disadvantage for the type of software I program!

Its a COM component, not a .NET assembly, so you have to add it to the toolbox manually!

Right-click on the toolbox, under the category you want to add the control to, select 'customize', then choose the COM component you want to add! I believe its in the list!

[MrPolite]

Originally posted by Hu Flung Dung
How long does it take? Its been working on my class for about an hour now!

didnt take more than a few seconds for me

[Hu Flung Dung]

Originally posted by MrPolite
didnt take more than a few seconds for me

Holy Pimentos!!!!!

I just tried it again! Now, it decompiled my app in seconds! Perhaps the site was being updated earlier today, preventing the decompiler from running (the site does look different now)?

(In the following paragraph, I am assuming many things on the basis that they just seem logical. I acknowledge the fact that I could very well be wrong).

I didn't think this was possible! .NET assemblies dont remain as MSIL (Which, I believe, is human readable, similar to ASM) but are indeed afterward compiled to native code (not a strange byte-code like Java, which, I believe, is why its so much more efficient than Java apps). I know that a process called 'reflection' allows you to view even private members in classes of compiled .NET applications (reflection is heavily documented), but thats a far cry from fully decompiling an application! Perhaps a .NET assembly's heavy use on OOP, and the fact that the framework classes it uses aren't compiled into the assembly, help decompilers determine the specific data types of variables, and from there, how each procedure was written!