|
my assembly is .NET user control in C#. after I obfuscate it, I want to check how good is the obfuscation. So I used Red-gate Reflector to check class, method etc.
What is your way to check the quality of obfuscation of a .net assembly?
diligent hands rule....
|
|
|
|
|
That wouldn't really work, unless you have Reflexil and deobfuscate first. Also try some stand-alone deobfuscators.
If the decompiled code still sucks after that, then ok. If not, then any script kiddie can undo the obfuscation that you hopefully didn't pay too much for.
|
|
|
|
|
great info. thanks a million.
could you name a few stand-alone deobfuscators?
diligent hands rule....
|
|
|
|
|
From what I've read, de4dot[^] is probably the top dog deobfuscator or at least among them.
|
|
|
|
|
thanks. it is great tool.
diligent hands rule....
|
|
|
|
|
|
|
i think that's a viewer, not a deobfuscator.
|
|
|
|
|
ILSpy is the open-source .NET assembly browser and decompiler.
If you have a c# DLL File or EXE, you can save decompiled assembly as .csproj and Assembly as C# Project.
NKS
|
|
|
|
|
I am using it right now besides some others..
diligent hands rule....
|
|
|
|
|
Most code I've seen doesn't need to be obfuscated by programs. The original authors obviously did a lot of work to make it as hard to read as possible... 
|
|
|
|
|
|
|
The site had a critical system error, causing all sorts of grief for people (I couldn't log in, and the forgot password Captcha didn't work at all. I contacted Chris, and he mentioned the issue).
What do you get when you cross a joke with a rhetorical question?
---
The metaphorical solid rear-end expulsions have impacted the metaphorical motorized bladed rotating air movement mechanism.
---
Do questions with multiple question marks annoy you???
|
|
|
|
|
kmoorevs wrote: BTW, a few hours ago I checked in here and found the lounge completely empty!
Saturday? A lot of us here don't post during the day on the weekends, I'm guessing.
|
|
|
|
|
kmoorevs wrote: the lounge completely empty
I figure, there is no lounge 
kmoorevs wrote: no soapbox, no hall of shame weird and wonderful...QA
What do you mean? They're not real...
kmoorevs wrote: good to see all is back to normal
Alright, this has gone on long enough. There is no lounge, no QA, no CodeProject... They're all figments of your imagination.
What you experienced was one of your brighter moments where you almost realized you live in a fantasy world and was about to snap out of it
We're increasing your therapy.
|
|
|
|
|
Another example of self-obfuscation I'd seen in a program:
There's a variable named distance, signifying distance.
A few lines later, this is converted to a 'rate-per-unit-time' entity, and the same distance now represents velocity/speed.
Few more lines later, this gets further converted similarly, and it represents acceleration; variable name is still distance.
In essence, I need to understand the significance of distance based on the line of code I am currently seeing.
|
|
|
|
|
Just use Java. Its objectfuscation makes it impenetrable to even the most valiant code-breakers.
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
I once used an obfuscator that prevented both ILDasm and Reflector from even opening the assemblies. It removed the headers. I'm not sure how it got to bind the assemblies without the headers, but I think it would go further on making it harder to unobfuscate the assemblies.
To alcohol! The cause of, and solution to, all of life's problems - Homer Simpson
----
Our heads are round so our thoughts can change direction - Francis Picabia
|
|
|
|
|
Hopefully it really did that and didn't just slap [SuppressIldasmAttribute] on everything..
|
|
|
|
|
It feels funny to me to obfuscate a user control. What is there to keep secret? Usually people obfuscate important algorithms. Admitted, to break an obfuscation, an attacker will try to start fooling around with user controls and see what modifications that does to the execution of the application.
People with need for strong obfuscations normally do not obfuscate byte code languages. These have a tendency to be easy to de-obfuscate. Strong obfuscations are done on machine code programs.
I'm doing obfuscations for business. Like the original poster I would love to know the quality of obfuscations. I bet my obfuscations are unbreakable by amateurs. But how can you find out security against sophisticated attackers? The solution is to pay a readteam. However,for my startup, I would not have the slightest idea where to take the money from. Maybe somebody might try it as a challenge or a crackme, just for bragging rights.
But then. if somebody posts an opinion, how much would you believe it?
Chris
Chris Jacobi
Founder White Hawk Software
www.whitehawksoftware.com
|
|
|
|
|
inside my user control I do have some algorithms to protect.
I checked your website, but not see product yet...
diligent hands rule....
|
|
|
|
|
I open the binaries in ILSpy and if ILSpy doesn't throw an exception then the obfuscation is not good enough
|
|
|
|
|
|
I decided to cook a gammon joint for supper tomorrow, so I checked my "recipes" folder to see if I had anything.
Yes: "Slow Cooker Gammon Joint.docx" - perfect!
Ingredients:
Gammon
Method:
Place gammon in slow cooker, fat side down.
Cook on high for 4 hours (800g joint) or 8 hours (1.5kg joint)
Now, why did I type up the ingredients list?
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
...or maybe it was just me? 
