how to protect .NET executable from de4dot or similar tools?

deobfuscation
Shivraj picture Shivraj · Jan 29, 2013 · Viewed 12.5k times · Source

I have tried obfuscation with following obfuscators but none is successful against de40 tool [https://bitbucket.org/0xd4d/de4dot/]

It's really painful to see how easy this is.. just drag the obfuscated .net exe on de4dot.exe and you will get the source code..

Obfuscators tried are:

Agile.NET (aka CliSecure) Babel.NET CodeFort CodeVeil CodeWall CryptoObfuscator DeepSea Obfuscator Dotfuscator .NET Reactor Eazfuscator.NET Goliath.NET ILProtector MaxtoCode MPRESS Rummage Skater.NET SmartAssembly Spices.Net Xenocode

All are useless.. that's really frustrating..

Can you give some better solution for protection against this tool?

Answer

Phenomite picture Phenomite · Mar 1, 2013

de4dot will be compatible with most obfuscators/protectors out there very soon, and if not, something else will.

What I'd do is download Confuser from codeplex and use the advanced feature tab in that.

What I do that ALWAYS works and can't be reversed, is I:

Confuse everything but 'reduce meta' in 'Advanced' in confuser. I then, Compress the assembly with RPX packer. I then, Re-Confuse the compressed assembly with 'Resource encryption' in Confuser.

This makes the assembly almost entirely irreversible (there are always those people who are good crackers). I'd also suggest adding md5/sha-1 encryption to your strings IN the source code.

With all these methods of protection, I'd officially say your .net assembly is very severely protected.

Related questions

De-obfuscate Javascript code to make it readable again

I hate to bring this here, while doing the learning of obfuscating the JS code, I encoded my code and then over wrote the orginal one without any backup :) Following is my obfuscated code. var _0xf17f=["\x28","\x29","\x64\…

Read More
Obfuscated C Code Contest 2006. Please explain sykes2.c

How does this C program work? main(_){_^448&&main(-~_);putchar(--_%64?32|-~7[__TIME__-_/8%8][">'txiZ^(~z?"-48]>>";;;====~$::199"[_*2&8|_/64]/(_&2?1:8)%8&1:10);} It compiles as it is (tested on gcc 4.6.3). It prints the time when compiled. On …

Read More
How to get rid of eval-base64_decode like PHP virus files?

My site (very large community website) was recently infected with a virus. Every index.php file was changed so that the opening php tag of these files it was changed to the following line: <?php eval(base64_decode('ZXJyb3…

Read More