dotNET

There are many great .NET obfuscators available on internet, however, I didn't find one that really suit my needs so I create this list. I want to gather all over .NET Obfuscator so that it'll be the last one you ever need.

Certain languages like Java and .NET can be easily decompiled into readable source code. Code obfuscation is a process that makes your application binaries harder to read with a decompiler. It’s an important tool for protecting your business’s intellectual property.

Compiled languages like C++ get converted directly to bytecode. The only way to reverse engineer how they work is with a disassembler, which is an arduous and complicated process. It’s not impossible, but trying to infer high level application logic from a stream of assembly language is hard.

On the other hand, languages like C# and Java aren’t compiled for any particular operating system. Rather, they’re compiled to an intermediary language, like .NET’s MSIL. The intermediary language is similar to assembly, but it can be easily converted back into the source code. This means that if you have a public DLL or executable that your business is distributing, anyone with a copy of your executable can open it up in a .NET decompiler like dotPeek, and directly read (and copy) your source code.

Code obfuscation can’t prevent this process—any .NET DLL can be plugged into a decompiler. What obfuscation does do is use a number of tricks to make the source code annoying as hell to read and debug.

The simplest form of this is entity renaming. It’s common practice to properly name variables, methods, classes, and parameters according to what they do. But you don’t have to, and technically there’s nothing stopping you from naming them with a series of lowercase L’s and I’s, or random combinations of Chinese unicode characters. To the computer, there’s no issue, but it’s completely illegible to a human:

像c++这样的编译语言可以直接转换为字节码。逆向工程的唯一方法是使用反汇编器，这是一个艰巨而复杂的过程。这并非不可能，但试图从汇编语言流推断高级应用程序逻辑是困难的。

另一方面，像c#和Java这样的语言并没有针对任何特定的操作系统进行编译。相反，它们被编译成一种中间语言，比如。net的MSIL。中间语言类似于汇编语言，但它可以很容易地转换回源代码。这意味着，如果您有一个公共DLL或可执行文件，您的业务正在分发，任何人都可以在。net反编译器中打开它，如dotPeek，并直接读取(和复制)您的源代码。

代码混淆不能阻止这个过程——任何. net DLL都可以插入到反编译器中。混淆所做的是使用一些技巧使源代码非常讨厌阅读和调试。

最简单的形式是实体重命名。通常的做法是根据变量、方法、类和参数的作用来正确地命名它们。但你没有必要这样做，而且从技术上讲，你可以用一系列小写的L和I或者中文unicode字符的随机组合来命名它们。对电脑来说，这是没有问题的，但对人类来说却是完全无法理解的:

An basic obfuscator will handle this process automatically, taking the output from the build, and converting it to something that’s a lot harder to read. There’s no performance hit compared to non-obfuscated code

More advanced obfuscators can go further, and actually change the structure of your source code. This includes replacing control structures with more complicated but semantically identical syntax. They can also insert dummy code that doesn’t do anything except confuse the decompiler. The effect of this is that it makes your source look like spaghetti code, making it more annoying to read.

Another common focus is hiding strings from decompilers. In managed executables, you can search for strings like error messages to locate sections of code. String obfuscation replaces strings with encoded messages, which are decrypted at runtime, making it impossible to search for them from a decompiler. This usually comes with a performance penalty.

一个基本的混淆器将自动处理这个过程，从构建中获取输出，并将其转换为更难以阅读的内容。与没有混淆的代码相比，没有性能影响

更高级的混淆器可以更进一步，实际上改变源代码的结构。这包括用更复杂但语义相同的语法替换控制结构。它们还可以插入假代码，除了让反编译器感到困惑外，这些假代码什么也不会做。这样做的结果是，它使你的源代码看起来像意大利面条代码，使它更讨厌阅读。

另一个常见的焦点是对反编译器隐藏字符串。在托管可执行文件中，您可以搜索诸如错误消息之类的字符串来定位代码段。字符串混淆将字符串替换为已编码的消息，这些消息在运行时被解密，因此无法从反编译器中搜索它们。这通常会带来性能损失。

Converting one programming language to another isn’t an entirely crazy idea—Unity uses IL2CPP, a converter that transforms .NET code into compiled C++ bytecode. It’s a lot more performant, but it also helps secure games against easy cracking, which is crucial for an environment plagued by piracy and cheaters.

Microsoft has CoreRT, an experimental .NET Core runtime using Ahead-Of-Time compilation, though it isn’t ready for production use.

将一种编程语言转换成另一种编程语言并不是一个完全疯狂的想法——unity使用IL2CPP，这是一个将。net代码转换成编译过的c++字节码的转换器。它的性能更高，但它也有助于确保游戏不易被轻易破解，这对于饱受盗版和作弊困扰的环境至关重要。

微软有coret，这是一个实验性的。net Core运行时，使用的是提前编译，不过还没有准备好投入生产使用。

If you’re deploying code in untrusted environments where you want to protect your source code, you should almost always use at least a basic obfuscator to rename functions, methods, and properties to make decompiling take a bit more effort.

If you really need nobody to be able to decompile your app, you can use a more intrusive obfuscator, but really you should consider if the problem would be better solved by switching to a language that doesn’t have this issue, such as C++ or Rust.

如果您将代码部署在不受信任的环境中，并且希望保护源代码，那么您几乎总是应该至少使用一个基本的混淆器来重命名函数、方法和属性，以使反编译花费更多的精力。

如果你真的不需要任何人来反编译你的应用程序，你可以使用一个更具侵入性的混淆器，但你真的应该考虑，如果切换到一种不存在这个问题的语言，如c++或Rust，这个问题是否会得到更好的解决。

See the open issues for a list of proposed features (and known issues).

Contributions are what make the open source community such an amazing place to be learn, inspire, and create. Any contributions you make are greatly appreciated.

Distributed under the MIT License. See LICENSE for more information.

What is Code Obfuscation, and Should you use it? by Anthony Heddings