.net Dotfuscator 社区版有多好？什么是“足够好的混淆器”？

How good is Dotfuscator Community Edition? What is "good enough obfuscator"?

提问by zendar

I plan to release one small, low priced utility. Since this is more hobby than business, I planned to use Dotfuscator Community Edition that is shipped with VS2008.

我计划发布一个小型、低价的实用程序。由于这更像是一种爱好而不是商业，我计划使用 VS2008 附带的 Dotfuscator Community Edition。

How good is it?

它有多好？

I could also use definition of "good enough obfuscator" - what features are missing from Dotfuscator Community Edition to make it good enough.

我还可以使用“足够好的混淆器”的定义 - Dotfuscator Community Edition 缺少哪些功能使其足够好。

Edit:

编辑：

I checked pricing on number of commercial obfuscators and they cost a lot. Is it worth it?

我检查了商业混淆器数量的定价，它们的成本很高。这值得么？

Are commercial versions that much better protecting from reverse engineering?

商业版本是否能更好地防止逆向工程？

I'm not very afraid of my application being cracked (it will be disappointing if application is so bad that no one is interested in cracking it). It's not heavily protected anyway, not overly complex serial key and licence checks on few places in code. It just bugs me that without obfuscation, somebody can easily get source code, rebrand it and sell it as its own.

我不是很害怕我的应用程序被破解（如果应用程序如此糟糕以至于没有人有兴趣破解它，那将是令人失望的）。无论如何，它并没有受到严格的保护，在代码中的几个地方没有过于复杂的序列密钥和许可证检查。只是让我感到烦恼的是，如果没有混淆，有人可以轻松获取源代码，重新命名并将其作为自己的产品出售。

Does this happens a lot?

这种情况经常发生吗？

Edit 2:

编辑2：

Can somebody recommend commercial obfuscator. I found lots of them, all of them are expensive, some even don't have price listed on web site.

有人可以推荐商业混淆器。我发现了很多，它们都很贵，有些甚至没有在网站上列出价格。

Feature wise, all products seem more or less similar.

功能明智，所有产品似乎或多或少相似。

What is minimal set of features obfuscator should have?

混淆器应该具有的最小功能集是什么？

采纳答案by CraigTP

In a nutshell, the main difference between Dotfuscator Community Edition and the other "professional" editions is that Community Edition will only really obfuscate and change your namespaces, method names, and other "public" accessible aspects of your classes. It won't delve into the functions themselves and obfuscate the "private" code within the function.

简而言之，Dotfuscator Community Edition 与其他“专业”版本之间的主要区别在于 Community Edition 只会真正混淆和更改您的命名空间、方法名称和类的其他“公共”可访问方面。它不会深入研究函数本身，也不会混淆函数内的“私有”代码。

Also, the Community Edition doesn't do anything to obfuscate such things as control flow within your application, nor will it "combine" code from multiple assemblies into one assembly. These are features that are available within the "professional" paid-for versions.

此外，社区版不会混淆应用程序中的控制流等内容，也不会将多个程序集中的代码“组合”到一个程序集中。这些是“专业”付费版本中可用的功能。

The best comparison between the Community Edition (the "free" version that comes with Visual Studio) and the "professional", paid-for editions can be found by looking at the following two links:

社区版（Visual Studio 附带的“免费”版本）和“专业”付费版之间的最佳比较可以通过查看以下两个链接找到：

Preemptive Dotfuscator Editions Comparison

抢先式 Dotfuscator 版本比较

Dotfuscator Community Edition 3.0 on MSDN

MSDN 上的 Dotfuscator 社区版 3.0

The MSDN link is slightly out of date, however, gives a much better explanation of the actual features that are available within the various editions of Dotfuscator.

然而，MSDN 链接稍微过时了，它对 Dotfuscator 的各种版本中可用的实际功能提供了更好的解释。

EDIT:

编辑：

Commercial obfuscators do cost a lot of money, and as to wether they are worth the money? Well, that's a judgement call that really only you can make. Personally, I would say that it isn't worth it in your scenario. Firstly, because you're only wanting to protect one application ("I plan to release one small, low priced utility.") and secondly, you say that you're not overly concerned with the application being "cracked" ("I'm not very afraid of my application being cracked.").

商业混淆器确实要花很多钱，至于它们是否物有所值？嗯，这是一个真正只有你才能做出的判断。就个人而言，我会说在您的情况下不值得。首先，因为您只想保护一个应用程序（“我计划发布一个小型、低价的实用程序。”），其次，您说您并不过分担心应用程序被“破解”（“我”我不是很害怕我的应用程序被破解。”）。

I understand how it can bug you that compiled .NET applications, without any obfuscation, can be easily reverse engineered to their original source code, and that someone may make use of this to steal your software and sell it as their own, however, the fact remains that software piracy does exist and you will probably never stop it.

我知道编译 .NET 应用程序会如何让您感到困扰，没有任何混淆，可以轻松地对其原始源代码进行逆向工程，并且有人可能会利用它来窃取您的软件并将其作为自己的软件出售，但是，事实仍然是软件盗版确实存在，您可能永远不会阻止它。

Trying to stop software piracy has been debated ad-nausem both on here (Stack Overflow) and all over the internet.

试图阻止软件盗版在这里 (Stack Overflow) 和整个互联网上都被争论不休。

The general consensus seems to be that you need to focus your time and energies more on making your product as great as it can be rather than using this same time trying to protect something that, given enough time/money, an "attacker" can "crack"/steal your software anyway, despite your best efforts to prevent him from doing so.

普遍的共识似乎是，您需要更多地将时间和精力集中在使您的产品尽可能出色上，而不是利用这段时间来保护某些东西，如果有足够的时间/金钱，“攻击者”可以“破解”/窃取您的软件，尽管您已尽最大努力阻止他这样做。

Does this happens a lot?

这种情况经常发生吗？

I would say that it probably happens a lot less than you think it does. Sure, software gets cracked, but I don't think too many people actually steal other's source code and completely re-brand it to sell as their own. I'm not saying it doesn't, or hasn't happened, but it's certainly not a common occurrence.

我会说它发生的次数可能比你想象的要少得多。当然，软件会被破解，但我不认为有太多人实际上窃取了其他人的源代码并将其完全重新命名以作为自己的销售。我并不是说它没有发生或没有发生，但这肯定不是普遍现象。

To summarise, I'd say that your best bet would be to focus on making your utility as great as it can be and use the free Dotfuscator obfuscator, since it requires very little investment of time/money, to obfuscate your code from the most obvious prying eyes, but don't lose any sleep over the fact that if someone wants to crack/steal your product/code badly enough, they will do.

总而言之，我认为最好的办法是专注于使您的实用程序尽可能地强大，并使用免费的 Dotfuscator 混淆器，因为它只需要很少的时间/金钱投资，就可以最大程度地混淆您的代码明显的窥探，但不要因为如果有人想要破解/窃取您的产品/代码足够严重，他们会这样做的事实而睡不着觉。

回答by Oleg I.

I think Dotfuscator Community Edition shipped with Visual Studio is quite a naive solution. It provides only symbol renaming and does not obfuscate control flow at all. And if someone decides to stole your code it will only need to refactor back all names, which is quite easy with small amount of classes.

我认为 Visual Studio 附带的 Dotfuscator Community Edition 是一个非常简单的解决方案。它只提供符号重命名，根本不混淆控制流。如果有人决定窃取您的代码，它只需要重构所有名称，这对于少量类来说非常容易。

Also you can rely on not so perfect decompilation provided by Reflector (it usually messes switch blocks, makes lots of gotos, mismatch if-else blocks, etc.).

此外，您还可以依赖 Reflector 提供的不太完美的反编译（它通常会弄乱 switch 块、生成大量 goto、不匹配 if-else 块等）。

But I suggest you try Eziriz .NET Reactor. It costs only $179 (AFAIK best price/features ratio). It provides standard obfuscation techniques such as symbol renaming, string encryption, control flow obfuscation. As a good bonus it creates native launcher for you app, which will contain your main assembly and all third party references encrypted and loaded on demand. Plus it provides some licensing capabilities.

但我建议您尝试Eziriz .NET Reactor。它的成本仅为 179 美元（AFAIK 最佳价格/功能比）。它提供了标准的混淆技术，例如符号重命名、字符串加密、控制流混淆。作为一个很好的奖励，它为您的应用程序创建了本机启动器，其中将包含您的主程序集和所有第三方引用，加密并按需加载。此外，它还提供了一些许可功能。

Anyway reversing .NET application is not so hard, I did it for fun and can say that it's only matter of time and money (and of course common sense) how fast your application will be cracked or reversed.

无论如何，逆向 .NET 应用程序并不难，我这样做是为了好玩，可以说这只是时间和金钱（当然还有常识）您的应用程序被破解或逆向多快的问题。

回答by logicnp

At a minimum, an obfuscator should have:

至少，混淆器应该具有：

1. String encryption
2. Symbol renaming
3. Control flow obfuscation

1. 字符串加密
2. 符号重命名
3. 控制流混淆

Good to have features are:

好有特点是：

1. Resource protection
2. Assembly merging/embedding
3. External method call hiding
4. Ability to auto-sign obfuscated assemblies
5. Support for satellite assemblies
6. Dead-code elimination
7. Meta-data reduction
8. Anti-decompiler (Reflector)
9. Anti-tamper
10. Anti-Debugging

1. 资源保护
2. 装配合并/嵌入
3. 外部方法调用隐藏
4. 能够对混淆的程序集进行自动签名
5. 支持附属程序集
6. 死码消除
7. 元数据缩减
8. 反编译器（反射器）
9. 防篡改
10. 反调试

Take a look at our Crypto Obfuscatorproduct which supports all of these.

看看我们的Crypto Obfuscator产品，它支持所有这些。

回答by bvrwoo

Another way to get around reverse engineering code is where you place your dll's if you cannot really afford obfuscators which do add support. And in your assembies before deployment tell the compiler where to look for them which was an old practice to hinder reverse engineering. But like it was already said, concentrate mostly on developing an excellent product and good coding practices, then you will be able to afford a nice obfuscator application in the future. Also, try not to worry to much about others cracking your code because most hackers crack code just find a way to use the product without paying for it and not to steal code or to learn from for beginning programmer. Yeah, I wish JIT only supported c# and vb.net which would have really cut down on reverse engineering but since jit can read many due to .net being really language friendly that is the price. So code away and make some money, buy some additional securities.

绕过逆向工程代码的另一种方法是，如果您真的负担不起添加支持的混淆器，则将 dll 放置在何处。并且在部署之前的程序集中告诉编译器在哪里寻找它们，这是阻碍逆向工程的旧做法。但是就像已经说过的那样，主要专注于开发出色的产品和良好的编码实践，然后您将能够在未来负担得起一个很好的混淆器应用程序。另外，尽量不要太担心其他人破解你的代码，因为大多数黑客破解代码只是想办法使用产品而无需支付费用，而不是窃取代码或向初学者学习。是的，我希望 JIT 只支持 c# 和 vb.net，这会真正减少逆向工程，但由于 . net 真的语言友好，这就是价格。所以编码并赚钱，购买一些额外的证券。