posted on Thursday, December 22, 2005 9:17 AM
by
obfuscator
Thoughts on .NET Obfuscation, Encryption and Coverting to Native
Tools that rely on encryption to protect an application suffer from has
a critical flaw: the app needs to be decrypted on the client
before being fed to the runtime. A hacker can potentially recover
a decrypted version of the image, and that image (even though it's
native) still contains the metadata.
With obfuscation, critical information (useful to human readers of the
code), is removed before the app is delivered to unsecured
clients. You can't crack it if it isn't there.
Tools that convert a .NET app into native code defeat the main ideas behind .NET.
The idea of .NET is that applications will be able to run on any platform.
Have you tried to run one a native app on a 64-bit version of the .NET
framework? I don t think it will work. I do not think it is even
possible for native code to work cross platform. Any what about
PocketPCs?
Also, this code is no longer managed because managed means 100% IL. And
there may be a big difference in security between this code, and
managed code.
Lastly, please, please test a tool that claims to turn your .NET app
into a native on your application before buying it. I have had many
people tell me that their app does not work exactly the same after
being run through a tool that converts it to a native one.
.NET Obfuscation is a safer and more robust solution. It does not
violate the intent of .NET and properly applied, it significantly
raises the bar against reverse engineering.