Forum Moderators: open

Message Too Old, No Replies

Codebehind using C++

Is there a way?

         

plumsauce

9:01 pm on Jun 30, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member




XOC,

Is there a way to do codebehind using c++?

With a wrapper perhaps?

The *main* reason is to obtain a dll that is more difficult to reverse engineer than the .net style dll/runtime model.

tia,

plumsauce

Xoc

8:02 am on Jul 1, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Regardless of the language that the web site is developed in, the code is compiled into a DLL and placed on the web server, along with the .aspx files (but not the .cs, .vb., .cpp, etc) files. The DLL is never accessible directly from the web, so there is no way that it can be decompiled unless the server is hacked. So C++ has no advantage over C#.

Microsoft is unlikely to completely abandon classic ASP. However, it is unlikely that there will be any enhancements to the language, environment, or development tools.

plumsauce

10:31 pm on Jul 1, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



XOC,

The DLL is never accessible directly from the web, so there is no way that it can be decompiled unless the server is hacked. So C++ has no advantage over C#.

I agree that this is the case from the perspective of end user visibility and access.

The problem arises when the application has high value, and the potential client asks to install a copy on their server instead of using a remotely hosted service. For an example of the value, the current single server license of my competitors who are using open source 'LAMP' platforms is in the range of 100k to 500k USD depending on the country served. There is huge incentive at these levels to reverse engineer competitors products to gain an edge.

I have missed sales opportunities because I require that the software be hosted on my servers.

This is why I am casting about looking for a safe alternative.

There is *some* safety in that much of the logic is in
encrypted stored procedures, but unencryption of tsql is somewhat trivial.

Is c++.net usable as the codebehind .dll?

And does it use the CLR in the same way?

I have searched for this many times, however *G* resolves "c++" as being equal to "c#" due to dropping the non-alpha characters.

Can I tie c++ classic, ie. VC 6.0, dlls to aspx pages and thus avoid the CLR?

Anyone here ever tried C++ Server Pages from micronovae?

++

Xoc

8:38 pm on Jul 3, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



How is C++ going to be any better than a .NET program that has been obfuscated? I can get into a disassembler for C++ and get essentially the same information that you get after running ildasm on a .NET assembly. Even if I didn't have that kind of expertise, if you make it valuable enough, then I'd hire to get it done.

There is no magic in compiling programs. If you can lay your hands on the executable, in any form, then the logic expressed in that executable can be extracted with enough effort.

In my opinion, people get overly hung up on protecting code. I don't need source code to reverse engineer products. I just need to see what the product does and how it reacts. There are very few algorithms that can't be reverse engineered if you can supply inputs and see the outputs, especially in real time.

Look at how much effort is placed here on reverse engineering Google's algorithms, with different degrees of success--and Google has huge incentive not to let their algorithms be known. If there were real-time changes to Google's results when you made a change to a web page, then the algorithm could be reverse engineered in a matter of days. The only reason it hasn't been completely reverse engineered is because Google only lets you see the results of changes infrequently, and changes the algorithm constantly.

I've frequently stated: There are six algorithms in the world worth protecting, and yours isn't one of them.

The proper technique is to make them sign a license agreement saying they won't reverse engineer the product. Specify liquidated damages in the contract that they will have cough up x thousand dollars should they violate the agreement.

plumsauce

1:05 am on Jul 5, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Xoc,

I asked for certain clarifications about the interaction of the CLR environment. The considerations in your lecture are already known to me. However, there is some value in not making the job any easier.

Xoc

1:44 am on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



To answer your question specifically, yes, .NET can call C++ code. Check out Adam Nathan's .NET and COM: The Complete Interoperability Guide for all the details on how to call legacy stuff from .NET. BTW, this book is somewhat misnamed, because a good third of the 1500 page book is on calling stuff that isn't COM using pinvoke.

plumsauce

6:05 am on Jul 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member




Once I was able to combine a couple of search terms from the earlier discussion, I was luckier in my new searches for specific information.

The *flavour* of what I am reading is that there is a definite price to pay in trying to use C/C++ in the world of iis and asp.net. The cpu cycle cost is mostly in either marshalling or pinvoke. If I am wrong I would love to hear about it because that is the cost I have been looking to avoid for ages. A low cost method of transitioning from managed to unmanaged code would be ideal in these circumstances.

The framework looks very appealing. The problem, in addition to the CLR/idasm matter, is that isapi in C has been my environment of choice in the past. But for things that require very little in the way of html manipulation.
Now, I want the same advantages, but need the dynamic pages.

I will mention csp from micronovae again, and encourage everyone to look at it. I have *no* connection to the product other than being *very* curious about it. This poor guy slaving away in Greece somewhere has a concept that should have flown.

webdevsf

12:46 am on Jul 12, 2004 (gmt 0)

10+ Year Member



You should look at ATL Server (VC7) (Google for it or look on msdn). Its a C++ template library for doing unmanaged dynamic C++ hooking into IIS.

Much more full-featured than plain ol' ISAPI and should be fast and obfuscatable. All that template code should obfuscate it a fair amount anyway. ;)

plumsauce

4:44 am on Jul 12, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member




Thanks for the ATL suggestion.

All those curly braces sprinkled through the html templates make me dizzy. I *know* that sounds very silly, but past experience has taught me that if a particular syntax gives me the heaves, then I will eventually abandon it.

Maybe I just have to have a go at reformatting some of the example code.