posted on Thursday, December 22, 2005 9:17 AM by obfuscator

Thoughts on .NET Obfuscation, Encryption and Coverting to Native

Tools that rely on encryption to protect an application suffer from has a critical flaw:  the app needs to be decrypted on the client before being fed to the runtime.  A hacker can potentially recover a decrypted version of the image, and that image (even though it's native) still contains the metadata.

With obfuscation, critical information (useful to human readers of the code), is removed before the app is delivered to unsecured clients.  You can't crack it if it isn't there.

Tools that convert a .NET app into native code defeat the main ideas behind .NET.
The idea of .NET is that applications will be able to run on any platform.
Have you tried to run one a native app on a 64-bit version of the .NET framework? I don t think it will work. I do not think it is even possible for native code to work cross platform. Any what about PocketPCs?

Also, this code is no longer managed because managed means 100% IL. And there may be a big difference in security between this code, and managed code.

Lastly, please, please test a tool that claims to turn your .NET app into a native on your application before buying it. I have had many people tell me that their app does not work exactly the same after being run through a tool that converts it to a native one.

.NET Obfuscation is a safer and more robust solution. It does not violate the intent of .NET and properly applied, it significantly raises the bar against reverse engineering.

Comments