Protect .NET Code from Reverse Engineering

Background

As software developers, we are responsible for safeguarding the application’s security in all aspects, from design to deployment. One aspect of the application’s security that you should care about is the building process, especially when building .NET applications (Will explain why in the following). Adopting safe building strategies such as code obfuscation can help to secure trade secrets and other intellectual property (IP), reduce piracy and counterfeiting, and protect against tampering and unauthorized debugging.

.NET Assembly

A compiled .NET assembly contains Intermediate Language (CIL) instructions, resources, and metadata describing the types, methods, properties, fields, and events in the assembly. ^{1 2}

Reverse engineers or hackers can use these rich “materials” to reverse or decompile it without any effort, generating high-level code that makes code more readable and finally achieving their purpose - stealing and undermining the application author’s trade secrets and IP.

Code Obfuscation

One technique to defend reverse engineering is code obfuscation. It creates or modifies code that is difficult for humans or computers to understand, but program output isn’t affected. Different techniques are used in the obfuscation transforms, including renaming, string encryption, and control flow obfuscation. ^{3 4}

Referring to the comprehensive survey from obfuscators.io, ³ many solutions that provide obfuscation protection are available today. Some are free and open-source, and some are paid and commercial (from $199 - 4300). The Solution Comparison of the Obfuscation Protection ³

In the next post, I will introduce the free and open-source solution of obfuscation protection I use to protect the application made by the .NET MAUI framework.

Reference