August 17, 2004

Recommendations for an Obfuscator?

Can anyone out there in C# land give me some recommendations for a good Obfuscator for standalone C# apps under the following parameters?

  • Must be able to be launched in an automated build environment (through nant)
  • Should do String and Resource encryption/hiding
  • Should just work. No weird complex profiling needed for apps
  • Must defeat all known decompilers
  • Must fit the pocket book of a small ISV

The short list I have compiled so far include:


Anyone have any real experience with any of these? I am currently using DotFuscator Community Edition which comes with Visual Studio .NET, and it blows as it needs Visual Studio to be open and running for it to work, which means it won't work in my automated build environment. I need something, but not sure what to turn to without having to either mortgage my house or live with half my stuff not being obfuscated.

Advice and feedback welcomed!

Posted by SilverStr at August 17, 2004 08:42 AM | TrackBack
Comments

The one I always recommend is Brent Rector's obfuscator Demeanor for .NET (Enterprise Edition). I am biased, though, as I haven't worked with the others, except DotFuscator Community Edition which is a joke.

In evaluating obfuscator, I like Brent's explanations here:

http://www.franklins.net/fnetdotnetrocks/dotnetrocks.aspx?showid=35

and here:

http://www.wintellect.com/resources/newsletters/2002/aug2002.aspx

As Brent points out, no obfuscator is completely fool proof, but there are some features that a good obfuscator must include:

You need an obfuscator that operates directly on the binary assembly produced by your .NET compiler. As such, it requires NO change [to] your source code and isn't restricted to those constructs supported by your language of choice. Many less functional obfuscators use ILDASM and ILASM to decompile an assembly into an IL source file, make a few text edits to the source file, then recompile back into a binary assembly. Unfortunately, not all assemblies survive this round-tripping process, for example, assemblies produced by the Microsoft C++ with Managed Extensions compiler. Choose an obfuscator that can obfuscate assemblies containing managed and unmanaged code, such as those produced by the Microsoft MC++, as well as assemblies produced by practically any .NET programming language.

Robert

Posted by: Robert Hurlbut at August 17, 2004 10:56 AM