C# 您是否应该混淆商业 .Net 应用程序？

Should you obfuscate a commercial .Net application?

提问by lowglider

I was thinking about obfuscating a commercial .Net application. But is it really worth the effort to select, buy and use such a tool? Are the obfuscated binaries really safe from reverse engineering?

我正在考虑混淆商业 .Net 应用程序。但是，选择、购买和使用这样的工具真的值得付出努力吗？混淆的二进制文件真的可以避免逆向工程吗？

采纳答案by Blair Conrad

You may not have to buy a tool - Visual Studio.NET comes with a community version of Dotfuscator. Other free obfuscation tools are listed here, and they may meet your needs.

您可能不必购买工具 - Visual Studio.NET 附带一个社区版本的 Dotfuscator。此处列出了其他免费混淆工具，它们可能会满足您的需求。

It's possible that the obfuscated binaries aren't safe from reverse engineering, just like it's possible that your bike lock might be breakable/pickable. However, it's often the case that a small inconvenience is enough to deter would be code/bicycle thieves.

混淆的二进制文件可能无法避免逆向工程，就像您的自行车锁可能会被破坏/撬开一样。然而，通常情况下，一个小小的不便就足以阻止代码/自行车窃贼。

Also, if ever it comes time to assert your rights to a piece of code in court, having been seen to make an effort to protect it (by obfuscating it) may give you extra points. :-)

此外，如果有时间在法庭上主张您对一段代码的权利，已经有人看到努力保护它（通过混淆它）可能会给您加分。:-)

You do have to consider the downsides, though - it can be more difficult to use reflection with obfuscated code, and if you're using something like log4net to generate parts of log lines based on the name of the class involved, these messages can become much more difficult to interpret.

但是，您必须考虑缺点 - 将反射与混淆代码一起使用可能会更加困难，并且如果您使用 log4net 之类的东西根据所涉及的类的名称生成部分日志行，这些消息可能会变成更难解释。

回答by kemiller2002

No, obfuscation has been proven that it does not prevent someone from being able to decipher the compiled code. It makes it more difficult to do so but not impossible.

不，混淆已被证明不会阻止某人破译编译后的代码。这使得这样做变得更加困难，但并非不可能。

回答by Martin

It's quite simple to reverse engineer a .net app using .net reflector- since the app will generate VB, VC and C# code straight from the MSIL, and it's possible to pull out all kinds of useful gems.

使用.net 反射器对 .net 应用程序进行逆向工程非常简单- 因为该应用程序将直接从 MSIL 生成 VB、VC 和 C# 代码，并且可以提取各种有用的 gem。

Code obfuscators hide code quite well from most reverse engineering hacks, and would be a good idea to use on proprietary and competitive code that adds value to your app.

代码混淆器可以很好地隐藏大多数逆向工程黑客的代码，并且将其用于为您的应用程序增加价值的专有和竞争性代码是一个好主意。

There's a pretty good article on obfuscation and it's workings here

有一篇关于混淆的很好的文章，它在这里有效

回答by Magnus Johansson

...snip... these messages can become much more difficult to interpret

...剪断...这些消息可能会变得更加难以解释

Yes, but the free community edition that comes with Visual Studio has a map functionality. With that you can back track the obfuscated method names to the original names.

是的，但 Visual Studio 附带的免费社区版具有地图功能。有了它，您可以将混淆的方法名称回溯到原始名称。

回答by harriyott

I've had success putting the output from one free obfuscator into a different obfuscator. In Dotfuscator CE, only some of the obfuscation tricks are included, so using a second obfuscator that has different tricks makes it more obfuscated.

我已经成功地将一个免费 obfuscator 的输出放入另一个 obfuscator。在 Dotfuscator CE 中，只包含了一些混淆技巧，因此使用具有不同技巧的第二个混淆器会使其更加混淆。

回答by Vinko Vrsalovic

The fact that you actually can reverse engineer it does not make obfuscation useless. It does raise the bar significantly.

您实际上可以对其进行逆向工程这一事实并不会使混淆变得无用。它确实显着提高了标准。

An unobfuscated .NET assembly will show you all the source, highlighted and all just by downloading the .NET Reflector. Add obfuscation to that and you'll reduce very significatively the amount of people who'll be able to modify the code.

未经混淆的 .NET 程序集将向您显示所有源代码，突出显示，并且只需下载.NET Reflector 即可。对此添加混淆，您将显着减少能够修改代码的人数。

It depends on you are you protecting yourself from. If you'll ship it unobfuscated, you might as well open source the application and benefit from marketing. Shipping it obfuscated will only allow people to relatively easily generate modified binaries through patches instead of being able to steal your code and create a direct competitor. Getting the actual source from obfuscated code is very hard, depending on the obfuscator, of course.

这取决于你是否在保护自己。如果您不加混淆地发布它，您不妨开源应用程序并从营销中受益。将其混淆后只会允许人们通过补丁相对轻松地生成修改后的二进制文件，而不是能够窃取您的代码并创建直接竞争对手。当然，从混淆代码中获取实际源代码非常困难，这取决于混淆器。

回答by RickL

At our company we evaluated several different obfuscation technologies, but they all had problems. The biggest problem was that we rely a lot on reflection, e.g. to dynamically create grids based upon property names.

在我们公司，我们评估了几种不同的混淆技术，但它们都存在问题。最大的问题是我们非常依赖反射，例如根据属性名称动态创建网格。

So all of the obfuscators rename things, you can disable it of course, but then you lose a lot of the benefit of obfuscation.

所以所有的混淆器都重命名了东西，你当然可以禁用它，但是你会失去很多混淆的好处。

Also, in our code we have a lot of NUnit tests which rely on a lot more of the methods and properties being public, this prevented some of the obfuscators from being able to obfuscate those classes.

此外，在我们的代码中，我们有很多 NUnit 测试依赖于更多公开的方法和属性，这阻止了一些混淆器能够混淆这些类。

In the end we settled on a product called .NET Reactor

最后我们选择了一个叫做.NET Reactor的产品

It works very well, and we don't have any of the problems associated with the other products.

它工作得很好，我们没有任何与其他产品相关的问题。

"In contrast to obfuscators .NET Reactor completely stops any decompiling by mixing any pure .NET assembly (written in C#, VB.NET, Delphi.NET, J#, MSIL...) with native machine code. In detail, .NET Reactor builds a native wall between potential hackers and your .NET code. The result is a standard Windows based, not MSIL compatible, file. The original .NET code remains intact, well protected by native code and invisible for prying eyes. The original .NET code is not copied on harddisk at any time. There is no tool which is able to decompile .NET Reactor protected assemblies."

“与混淆器相比，.NET Reactor 通过将任何纯 .NET 程序集（用 C#、VB.NET、Delphi.NET、J#、MSIL...编写）与本地机器代码混合来完全停止任何反编译。详细来说，.NET Reactor在潜在的黑客和您的 .NET 代码之间建立一道原生墙。结果是一个基于标准的 Windows，不兼容 MSIL 的文件。原始 .NET 代码保持完整，受到原生代码的良好保护，并且不会被窥探。原始 .NET任何时候都不会将代码复制到硬盘上。没有能够反编译受 .NET Reactor 保护的程序集的工具。”

回答by Doron Yaacoby

I think that it depends on the type of your product. If it is directed to be used by developers - obfuscation will hurt your customers. We've been using the ArcGIS products at work, and all the DLLs are obfuscated. It's making our job a lot harder, since we can't use Reflector to decipher weird behaviors. And we're buying customers who paid thousands of dollars for the product.

我认为这取决于您的产品类型。如果它是由开发人员使用的 - 混淆会伤害您的客户。我们一直在工作中使用 ArcGIS 产品，并且所有 DLL 都被混淆了。这使我们的工作变得更加困难，因为我们无法使用 Reflector 来破译奇怪的行为。我们正在购买为产品支付数千美元的客户。

So please, don't obfuscate unless you really have to.

所以请不要混淆，除非你真的需要。

回答by Leigh Caldwell

This postand the surrounding question have some discussion which might be of value. It isn't a yes-or-no issue.

这篇文章和周围的问题有一些可能有价值的讨论。这不是一个是或否的问题。

回答by Jay Bazuzi

Remember that obfuscation is only a barrier to the casual examiner of your code. If someone is serious about figuring out what you wrote, you will have a very hard time stopping them.

请记住，混淆只是对不经意的代码检查者的障碍。如果有人认真想弄清楚你写了什么，你将很难阻止他们。

If you have secrets in your code (like passwords), you're doing it wrong.

如果您的代码中有秘密（如密码），那么您就做错了。

If you worried someone might produce your own software with your ideas, you'll have more luck in the marketplace by providing new versions that your customers want, with technical support, and by being a partner to them. Good business wins.

如果您担心有人可能会根据您的想法制作您自己的软件，那么通过提供客户想要的新版本、技术支持以及成为他们的合作伙伴，您将在市场上获得更多的运气。好生意必胜。