Forum Moderators: open
- Is it possible to achieve anti-cracking security with .NET apps as strong as with other languages, and is there a not-too-expensive package that can do this?
- I've been told that locking an application to a particular machine makes it easier to crack. Is this true? I know there's disagreement about the effectiveness of it from the point of view of customer annoyance, but my question is just about security.
- I've seen a reference to the Microsoft Developer Security Toolkit, a free DVD for developers that shows best practices, sample code, etc. Has anyone used this, and will following its recommendations provide high-level security, or is it basically common info that most developers already know?
Thanks.
hth,
mcm
hth,
mcm
There are tools that do obfuscation. Search for that +.net or look in any msdn magazine and you'll see plenty advertised there.
How secure is obfuscation? It appears that an obfuscator replaces class names with some other name, making it more difficult for a cracker to see what the program is doing. But if it leaves the rest of the logical flow intact, I imagine someone who knew what the app was supposed to do could still figure it out?
How much are you expecting to lose through piracy? If its less that $550 is it really worth bothering with?
You can use obfuscation but at the end of the day it won't do much more than give you a false sense of security.
As others have said, if an application can be compiled then it can also be decompiled. You seem to be of the opinion that there are uncrackable applications out there. if that is the case, you are the victim of some dodgy marketing.
If an application runs on a computer then the processor has to have access to the code. if the processor has access then the user has access, and a cracker can alter it.
.Net obfuscation can perhaps deter a casual cracker because it'll mean they'll find it easier to use a lower level analysis of the code, but it won't do much more than that.
JasperSEO, you're looking for some kind of failsafe anti-cracking mechanism. Yet you want it free or cheaply?
Well, at a reasonable price for my niche shareware. For example, you can get licensing software for about half that.
How much are you expecting to lose through piracy? If its less that $550 is it really worth bothering with?
Good point, but I don't know yet--the application hasn't gone on sale (or been built). The typical user isn't heavily into programming.
.Net obfuscation can perhaps deter a casual cracker because it'll mean they'll find it easier to use a lower level analysis of the code, but it won't do much more than that.
That may be enough--I'm not looking for industrial strength, although one of the obfuscators does seem to make it impossible to recompile and still works. Here's what I found: www.howtoselectguides.com/dotnet/obfuscators
Thanks.
one of the obfuscators does seem to make it impossible to recompile and still works
The site is requiring authentication when I try and visit it.
I can assure you that it is still possible to re-assemble the application after decompiling it and altering it.
I really wouldn't recommend buying from companies if they have misleading adveertsing. You never really know what you're getting.
If you want to obfuscate your code and that will give you peace of mind then go ahead and buy the obfuscator.
$550 really doesn't seem that expensive to me for specialist software of this nature.
What I was referring to was this:
The QND Obfuscator itself takes a simple and unique approach to the problem of obfuscation. It simply finds every private symbol in the string heap in the PE file manifest, and changes them all to the "$" symbol. You can use attributes to prevent this from happening for particular symbols if you need to, but otherwise you effectively overload everything - indeed, to the point where the resulting executable violates the CLI specification (as author Dan Appleman points out in the e-book). This means that code decompiled from the obfuscated assembly has zero chance of compiling, but at the same time, you're depending on undocumented behavior to keep your code running. Our test assemblies seemed to work fine, but this is something to be aware of.
This one is $40--more my style.
This means that code decompiled from the obfuscated assembly has zero chance of compiling
It depends on how it's decompiled.
As has been said before. You can not create an uncrackable app. All you can do is put barriers up to deter the casual cracker.
