Introduction
When you want to release your .net application to the public as closed source you should note that Microsoft .net applications are easy to decompile and reconstruct once distributed. In this article, I intend to explore various options and explain why we settled on one particular Obfuscator that is open source.
Obfuscation is the practice of making something difficult to understand. Programming code is often obfuscated to protect intellectual property and prevent an attacker from reverse engineering a proprietary software program. Obfuscation may involve encrypting some or all of the code, stripping out potentially revealing metadata, renaming useful class and variable names to meaningless labels or adding unused or meaningless code to an application binary. A tool called an obfuscator can be used to automatically convert straight-forward source code into a program that works the same way, but is much harder to read and understand.
The purpose of this article is not a how to use the various obfuscation tools but is a pointer to the tools that could be included in a developers toolbox. But remember that Obfuscation is generally just a technique to make decompiling harder.
We explored a range of commercial and open source obfuscators such as ConfuserEX, ConfuserEX2, DotFuscatorCE, Obfuscar with varying levels of success.
One glaring issue is that none of the obfuscators have great documentation for new comers or experienced developers when things don’t work as expected. Many hours are required to hunt down solutions from places other than the authors repositories.
Visual Studio – Microsoft have bundled the DotFuscator Community Edition with Visual Studio however we are not impressed with the free version as a serious entry point to protect your works. Also we don’t like being pestered to register.
Obfuscar – Probably works but we could not get any exe’s or DLL’s to work after obfuscation and it was just too difficult to find solutions and the authors site appears to have wiped the wiki.
ConfuserEX has a number of forks available and we settled on ConfuserEX-Reborn
And to compliment ConfuserEX we installed ConfuserEX for Visual Studio from Market Place however this crashed Visual Studio 2017 frequently and when you attempt to remove obfuscation from a project it leaves an entry “exec” in the project file that prevents a successful compile. So ConfuserEX for Visual Studio caused more issues than it was worth and we uninstalled it from Visual Studio.
Our final decision was to download the source for ConfuserEX Reborn and dnlib and compile ourselves. The ConfuserEX comes with a very functional GUI that we found was great for building the Ofuscated project and finally protecting your solutions.
ConfuserEX – Reborn
Features
- Supports .NET Framework 2.0/3.0/3.5/4.0/4.5
- Supports Mono (Some feature restrictions apply)
- Symbol renaming (Support WPF/XAML/BAML)
- Protection against debuggers/profilers
- Protection against memory dumping
- Protection against tampering (method encryption)
- Control flow obfuscation
- Constant/resources encryption
- Reference hiding proxies
- Disable decompilers
- Embedding dependency
- Compressing output
- Extensible plugin API
- Many more are coming!
-
- ConfuserEX GUI
-
- ConfuserEX GUI Settings
-
- ILSpy – Obfuscated
Protections
Anti Debug
Anti Dump
Anti IL Dasm
Anti Tamper
Constants
Control Flow
Invalid Metadata
Name
Reference Proxy
Resources
Compressor
Item Signatures
<h2 class="gh-header-title instapaper_title">Anti Debug Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>anti debug</em><br />
Preset: Minimum</p>
<p>This protection prevents the assembly from being debugged or profiled.</p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Anti-Debug-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>mode</strong>: This parameter define the used anti debug engine. Supported values are:</p>
<ul>
<li><em>safe</em>: ConfuserEx would detect debugger/profiler using managed API</li>
<li><em>win32</em>: ConfuserEx would detect debugger/profiler using unmanaged WinAPI (<strong>Incompatible with OS other than Windows</strong>)</li>
<li><em>antinet</em>: ConfuserEx would detect debugger/profiler using antinet by 0xd4d (<strong>Produces unverifiable modules, incompatibile with Mono</strong>)</li>
</ul>
<p>Default is <em>safe</em>.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Anti Dump Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>anti dump</em><br />
Preset: Maximum</p>
<p>This protection prevents the assembly from being dumped from memory.</p>
<p><strong>This protection produces unverifiable modules.</strong><br />
<strong>This protection is incompatible with OS other than Windows due to usage of WinAPI.</strong></p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Anti-Dump-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p>This protection has no parameters.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Anti IL Dasm Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>anti ildasm</em><br />
Preset: Minimum</p>
<p>This protection marks the module with a attribute that discourage ILDasm from disassembling it.</p>
<p><em>Note that this attribute, SuppressIldasmAttribute, can be circumvented quite easily and generally not respected by modern decompilers. This protection is just here for... completeness. :P</em></p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Anti-IL-Dasm-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p>This protection has no parameters.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Anti Tamper Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>anti tamper</em><br />
Preset: Maximum</p>
<p>This protection ensures the integrity of application.</p>
<p>This protection encrypts the methods with the checksum of the whole module, to ensure that the module will load only if no modification has been made to it.</p>
<p><strong>This protection produces unverifiable modules.</strong><br />
<strong>This protection is incompatible with OS other than Windows due to usage of WinAPI.</strong></p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Anti-Tamper-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>mode</strong>: This parameter define the way ConfuserEx decrypts the methods. Supported values are:</p>
<ul>
<li><em>normal</em>: ConfuserEx would validate the checksum and decrypt the methods at the start of application.</li>
<li><em>jit</em>: ConfuserEx would validate the checksum at the start of application, and decrypt the methods right before each method is being compiled using JIT hooks. (<strong>Incompatibile with Mono, and potentially future version of .NET Framework. Use with care.</strong>)</li>
</ul>
<p>Default is <em>normal</em>.</p>
<p><strong>key</strong>: This parameter define the way ConfuserEx derives the decryption key. Supported values are:</p>
<ul>
<li><em>normal</em>: ConfuserEx would use static algorithms with random parameters to derive the decryption key.</li>
<li><em>dynamic</em>: ConfuserEx would use dynamically generated algorithms to derive the decryption key.</li>
</ul>
<p>Default is <em>normal</em>.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Constants Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>constants</em><br />
Preset: Normal</p>
<p>This protection encodes and compresses constants (numbers, strings, and initializers) in the code.</p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Constants-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>mode</strong>: This parameter define the way ConfuserEx encode the constants. Supported values are:</p>
<ul>
<li><em>normal</em>: ConfuserEx would use static algorithms with random parameters to encode the constants.</li>
<li><em>dynamic</em>: ConfuserEx would use dynamically generated algorithms to encode the constants.</li>
<li><em>x86</em>: ConfuserEx would use dynamically generated native x86 expressions to encode the constants. (<strong>Produces unverifiable modules</strong>)</li>
</ul>
<p>Default is <em>normal</em>.</p>
<p><strong>decoderCount</strong>: This parameter is an integer value defining how many constant decoder ConfuserEx would generate. Default is 5.</p>
<p>Since each decoder has slight differences, more decoders would make manual decoding of constants by attackers more annoying, but the result file size would increase.</p>
<p><strong>elements</strong>: This parameter defines what type of constants would be encoded. Possible values are a combination of:</p>
<ul>
<li><em>S</em>: String constants (excluding primitive constants)</li>
<li><em>N</em>: Numeric constants (excluding primitive constants)</li>
<li><em>P</em>: Primitive constants (empty strings and commonly used numbers, e.g. 0, -1, 1, 2, etc.)</li>
<li><em>I</em>: Array initializer (Those using RuntimeHelpers.InitializeArray)</li>
</ul>
<p>The value is case-insensitive. For example, a value of "SI" indicates non-empty strings and initializers should be encoded. Default is "SI".</p>
<p><strong>cfg</strong>: This parameter is a boolean value whether decoding of constants are based on a control flow dependent state variable. Default is <code>false</code>.</p>
<p>Enabling it would greatly enhance the strength of protection but the runtime performance may have a impact.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Control Flow Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>ctrl flow</em><br />
Preset: Normal</p>
<p>This protection mangles the code in the methods so that decompilers cannot decompile the methods.</p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Control-Flow-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>type</strong>: This parameter define how ConfuserEx mangles the method code. Supported values are:</p>
<ul>
<li><em>switch</em>: ConfuserEx would insert a switch-base state machine to reorder the codes.</li>
<li><em>jump</em>: ConfuserEx would inserts jumps in methods to produce traditional spaghetti code. (<strong>Produces unverifiable modules</strong>)</li>
</ul>
<p>Default is <em>switch</em>.</p>
<p><strong>predicate</strong>: This parameter define how ConfuserEx store the state variable if <strong>type</strong> is set to <em>switch</em>. Supported values are:</p>
<ul>
<li><em>normal</em>: ConfuserEx would use the state variable directly.</li>
<li><em>expression</em>: ConfuserEx would encode the state variable using dynamically generated expressions.</li>
<li><em>x86</em>: ConfuserEx would encode the state variable using dynamically generated native x86 expressions. (<strong>Produces unverifiable modules</strong>)</li>
</ul>
<p>Default is <em>normal</em>.</p>
<p><strong>intensity</strong>: This parameter is a integer value from 0 to 100, indicates how large is each split code block. Default is 60.</p>
<p><strong>depth</strong>: This parameter define how deep is the generated expression if <strong>predicate</strong> is set to <em>expression</em> or <em>x86</em>. Default is 4.</p>
<p><strong>junk</strong>: This parameter is a boolean value indicates whether junk codes would be inserted. Default is <code>false</code>. (<strong>Produces unverifiable modules</strong>)</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Invalid Metadata Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>invalid metadata</em><br />
Preset: Maximum</p>
<p>This protection adds invalid metadata to modules to prevent disassembler/decompiler from opening them.</p>
<p><strong>This protection produces unverifiable modules.</strong><br />
<strong>This protection may not be compatible with Mono.</strong></p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Invalid-Metadata-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p>This protection has no parameters.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Name Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>rename</em><br />
Preset: Minimum</p>
<p>This protection obfuscate the symbols' name so the decompiled source code can neither be compiled nor read.</p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Name-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>mode</strong>: This parameter define the way ConfuserEx renames symbols. Supported values are:</p>
<ul>
<li><em>empty</em>: ConfuserEx would rename all symbols to a empty string.<br />
<strong>Expect many problems when using this mode.</strong></li>
<li><em>unicode</em>: ConfuserEx would rename symbols to Unicode unreadable characters.<br />
<strong>Reflection may not work in this mode.</strong></li>
<li><em>ascii</em>: ConfuserEx would rename symbols to readable ASCII characters.<br />
<strong>Reflection may not work in this mode.</strong></li>
<li><em>letters</em>: ConfuserEx would rename symbols to English letters.</li>
<li><em>decodable</em>: ConfuserEx would rename symbols to decodable string. The obfuscated name mapping would be saved to output folder in the file "symbols.map".</li>
<li><em>sequential</em>: ConfuserEx would rename symbols to sequential string. The obfuscated name mapping would be saved to output folder in the file "symbols.map".</li>
<li><em>reversible</em>: ConfuserEx would encrypt the symbols. The obfuscated names could be decoded by providing the password used in obfuscation.</li>
<li><em>debug</em>: ConfuserEx would add an underscore before the symbols. Not intended for production use.</li>
</ul>
<p>Default is <em>unicode</em>.</p>
<p><strong>password</strong>: This parameter is a string value, indicates the password ConfuserEx should use to encrypt the symbol names when reversible mode is used. Only effective on modules. Default is null.</p>
<p><strong>renameArgs</strong>: This parameter is a boolean value, indicates whether ConfuserEx should remove the name of methods' parameters. Default is <code>true</code>.</p>
<p><strong>renEnum</strong>: This parameter is a boolean value, indicates whether ConfuserEx should change the name of enum values. Default is <code>false</code>.</p>
<p><strong>flatten</strong>: This parameter is a boolean value, indicates whether ConfuserEx should flatten the types by removing the namespaces. Default is <code>true</code>.</p>
<p><strong>forceRen</strong>: This parameter is a boolean value, indicates whether ConfuserEx should rename the symbols even if the analyzer shows that it should not be renamed. Default is <code>false</code>.</p>
<p><strong>renPublic</strong>: This parameter is a boolean value, indicates whether ConfuserEx should rename the symbols even if the item is visible outside the assembly. Default is <code>false</code>.</p>
<p><strong>renPdb</strong>: This parameter is a boolean value, indicates whether ConfuserEx should rename the variable names and the file names in PDB. Default is <code>false</code>.</p>
<p><strong>renXaml</strong>: This parameter is a boolean value, indicates whether ConfuserEx should rename the XAML file name. Default is <code>true</code>.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Reference Proxy Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>ref proxy</em><br />
Preset: Normal</p>
<p>This protection encodes and hides references to type/method/fields.</p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Reference-Proxy-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>mode</strong>: This parameter define the way ConfuserEx hide the references. Supported values are:</p>
<ul>
<li><em>mild</em>: ConfuserEx would add an indirection method as proxy.</li>
<li><em>strong</em>: ConfuserEx would add a dynamic method delegate as proxy.</li>
<li><em>ftn</em>: ConfuserEx would use function pointer as proxy. Not implemented yet.</li>
</ul>
<p>Default is <em>mild</em>.</p>
<p><strong>encoding</strong>: This parameter define the way ConfuserEx encodes the method references. Supported values are:</p>
<ul>
<li><em>normal</em>: ConfuserEx would use static algorithms with random parameters to encode the references.</li>
<li><em>expression</em>: ConfuserEx would use dynamically generated expressions to encode the references.</li>
<li><em>x86</em>: ConfuserEx would use dynamically generated native x86 expressions to encode the references. (<strong>Produces unverifiable modules</strong>)</li>
</ul>
<p>Default is <em>normal</em>.</p>
<p><strong>internal</strong>: This parameter is a boolean value, indicates whether ConfuserEx should also hide internal references. Default is <code>false</code>.</p>
<p><strong>typeErasure</strong>: This parameter is a boolean value, indicates whether ConfuserEx should hide the types of method parameters. Default is <code>false</code>.</p>
<p><strong>depth</strong>: This parameter define how deep is the generated expression if <strong>encoding</strong> is set to <em>expression</em> or <em>x86</em>. Default is 3.</p>
<p><strong>initCount</strong>: This parameter define how many delegate initializer should be added if <strong>mode</strong> is set to <em>strong</em>. Default is 16.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Resources Protection</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>resources</em><br />
Preset: Normal</p>
<p>This protection encodes and compresses the embedded resources.</p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Resources-Protection#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>mode</strong>: This parameter define the way ConfuserEx encodes the resources. Supported values are:</p>
<ul>
<li><em>normal</em>: ConfuserEx would use static algorithms with random parameters to encode the resources.</li>
<li><em>dynamic</em>: ConfuserEx would use dynamically generated algorithms to encode the resources.</li>
</ul>
<p>Default is <em>normal</em>.</p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Compressor</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
<p>ID: <em>compressor</em></p>
<p>This packer reduces the size of output using LZMA compression algorithm. Only one executable module may be in the project and it would be used as the main entry module.</p>
<h2><a id="user-content-parameters" class="anchor" href="https://github.com/yck1509/ConfuserEx/wiki/Compressor#parameters" aria-hidden="true"></a>Parameters</h2>
<p><strong>key</strong>: This parameter define the way ConfuserEx derives the decryption key. Supported values are:</p>
<ul>
<li><em>normal</em>: ConfuserEx would use static algorithms with random parameters to derive the decryption key.</li>
<li><em>dynamic</em>: ConfuserEx would use dynamically generated algorithms to derive the decryption key.</li>
</ul>
<p>Default is <em>normal</em>.</p>
<p><strong>compat</strong>: This parameter is a boolean value, indicates whether ConfuserEx should use compatibility mode that works with Mono. Default is <code>false</code>.</p>
<p>Example: <code><packer id="compressor"></code> <code><argument name="main" value="<module name>"/></code> <code><argument name="key" value="normal"/></code> <code></packer></code></p>
</div>
</div>
<h2 class="gh-header-title instapaper_title">Item Signatures</h2>
<div id="wiki-body" class="wiki-body gollum-markdown-content instapaper_body">
<div class="markdown-body">
Signatures in ConfuserEx are unique identifiers for items, generated by <a href="https://github.com/0xd4d/dnlib">dnlib</a>. Here are some examples of signatures:
Sample code :
<div class="highlight highlight-source-cs">
<pre><span class="pl-k">namespace</span> <span class="pl-en">NS1</span> {
<span class="pl-k">class</span> <span class="pl-en">MyClass</span> {
<span class="pl-k">class</span> <span class="pl-en">NClass</span> {
}
<span class="pl-k">public</span> <span class="pl-k">string</span> <span class="pl-smi">StringValue</span> <span class="pl-k">=</span> <span class="pl-s"><span class="pl-pds">"</span>Value<span class="pl-pds">"</span></span>;
<span class="pl-k">public</span> <span class="pl-k">static</span> <span class="pl-k">int</span> <span class="pl-en">GetInt</span>(<span class="pl-k">ref</span> <span class="pl-k">int</span> <span class="pl-smi">value</span>);
<span class="pl-k">public</span> <span class="pl-k">void</span> <span class="pl-en">DoThings</span><<span class="pl-en">T</span>>(<span class="pl-en">T</span>[] <span class="pl-smi">args</span>);
<span class="pl-k">public</span> <span class="pl-k">int</span> <span class="pl-smi">IntVal</span> { <span class="pl-k">get</span>; <span class="pl-k">set</span>; }
<span class="pl-k">public</span> <span class="pl-k">string</span> <span class="pl-k">this</span>[<span class="pl-k">int</span> <span class="pl-smi">index</span>] { <span class="pl-k">get</span>; <span class="pl-k">set</span>; }
<span class="pl-k">public</span> <span class="pl-k">event</span> <span class="pl-en">EventHandler</span> <span class="pl-en">ValueChanged</span>;
}
}</pre>
</div>
The signatures of above are:
<pre><code> MyClass : NS1.MyClass
NClass : NS1.MyClass/NClass
StringValue : NS1.MyClass::StringValue
GetInt : System.Int32 NS1.MyClass::GetInt(System.Int32&)
DoThings : System.Void NS1.MyClass::DoThings<!!0>(!!0[])
IntVal : System.Int32 NS1.MyClass::IntVal()
this : System.String NS1.MyClass::Item(System.Int32)
ValueChanged : System.EventHandler NS1.MyClass::ValueChanged
</code></pre>
</div>
</div>
Before you obfuscate you may have a project with depends on one or more library DLL’s, in some situations this can cause an obfuscated solution to fail. One potential solution can be to use ILMerge to merge the dependant dll’s into the main exe or dll. ILMerge is a free Microsoft command line tool.If you prefer nice GUI to perform your merges then check out ILMergeGUI ; there are several GUI’s available and this just happens to be the first that we found which worked as described.
So let’s say you have the following output from your project with a couple of dependant libraries:
- TheWorldsGreatest.exe
- MyCommonLibrary.dll
- MyHTMLViewer.dll
We use ILMerge to merge the two dll’s into TheWorldsGreatest.exe.
As a result we just need to obfuscate and deploy a single exe.
ILMergeGui, ILMerge, ILSpy, dotPeek
Article Rating: 
(1 votes, average: 5.00 out of 5)
Loading...
(1 votes, average: 5.00 out of 5)Loading...