How to prevent reverse engineering of a C# .NET program

.net-framework c#

07
2014-07

spokane-dude

I have a C# .NET program that I believe has been compromised (reverse-engineered). Is there any way to prevent this?

Answers

Atropo

You need a C# code obfuscator, check these questions:

question 1

question 2

allquixotic

Technically, there is no way to prevent something that has already happened, unless you have a time machine. Your question stated that you believe your program has been compromised (past perfect tense) -- this is an action which has already occurred. Preventing an action which has already occurred would involve time travel, because there is no other way that we can conceive of to do this.

The reason why this seemingly silly argument is relevant is that, even if you were to implement an obfuscation technique in your code today that makes it utterly impossible for anyone to ever reverse engineer your code again, it is still the case that at least one copy of your code without the obfuscation has already been released in some fashion, and has already been returned to a usable source format (or so you believe).

Since I don't know anyone on Earth who's ever created a working time machine, I doubt there is any possible way that you can properly handle this situation through technical means. If your software was freely available for download, then it is very likely that thousands or millions of people have copies of the unobfuscated binaries, and can at any time share those binaries between eachother and reverse engineer them at will. Even if you sold your software for a fee, if that fee wasn't extremely high, then it's probably already been reverse engineered by more than one person, whether paying customers or pirates.

You will probably have to resort to the only institution on Earth that can (in an extremely imperfect way) attempt to re-mediate erroneous or immoral actions which have occurred in the past: the legal system. You see, even if someone were doing something really nasty such as releasing a competing product using your code as a base, you don't strictly need a time machine to stop them from doing that: you can simply target the worst offenders with a lawsuit, and allow the justice system to play itself out. You won't necessarily get the ideal outcome, and you probably won't get all the money you're due (legal fees and all that); but it'll be better than sitting here wishing you had a time machine.

Of course, going forward, any new code developments you release should be obfuscated, if your goal is to prevent others from being able to conveniently reverse engineer the .NET assemblies. But I'll leave that topic to the other answerers; I just wanted to be a pedant.

user1301428

You can't avoid it completely, but you can do something to make it more difficult for an attacker to do it, as explained in the following article:

An Anti-Reverse Engineering Guide

Basically, you need to apply some obfuscation techniques to slow down the process. There are several tools that help you do that, depending on the programming language you are using. If you search Stackoverflow you can find many answers, a quick search returned the following link about Javascript, for example:

How can I obfuscate JavaScript?

Related Answers

gridzbi

If the machines are this grossly under-powered then I'd make the argument to your superiors that the problems lie in the companies IT provision to staff. I'd say any development time spent on this would be ill-spent.

sventevit

Maybe a bit naive, but still... format & reinstal Windows :-)

Rick

What do you mean strongly loaded?

From your symptoms the problem might be that they do not have enough RAM. In which case when you start your applications they will have to swap previously running applications into virtual memory.

When you close that application and restart it straight away, you will have free RAM so it will restart quickly.

But it will do no good if you do something else in the meantime, i.e. open Outlook, close Outlook, open Excel - do some work, then if you open Outlook again it will not open quickly, i.e. your original suggestion to try and automatically open and close your application (at bootup?) won't help.

David Basarab

Here is a nice article about speeding up an application start time.

Improving Application Startup Time

Over the few past months, the CLR performance team met with several customers to investigate performance issues in some of their applications. One recurring problem was client application startup time. So in this column, I'll present lessons we learned analyzing these applications.

Planning for Performance Your success in reaching your performance goals depends on the process you will be using. A good process can help you achieve the level of performance you need. These four simple rules will help:

Florian Doyon

Perhaps this is a roaming profile issue? I don't know about your program, but Excel and Outlook make significant use of the User folder, which is probably stored somewhere on your corporate network for each Active Directory account. My guess is that either the network or the storage system is too slow for your 300+ users.

Klay

You or someone with some influence should be able to make a solid case to management for lost productivity because of the exorbitant startup times. It should be clear that in a very short time the cost of upgrading RAM would pay for itself in increased productivity. Heck, if you have to wait 15 minutes four times a day (a conservative estimate, I'm sure), you lose 12.5% of your workday EVERY DAY. Multiply this by 300 laptops, and...

Oh--you must work for a federal agency!

Psycogeek

What are the metrics you see via Task Manager ?

Which Process is consuming the most CPU ?

Which Processes are consuming RAM ?

Is there an anti virus running in the background doing a full scan every time a computer starts ?

how many Page Faults by which processes ?

Whats the Configuration of Computers and which Softwares ?

Seasoned Advice (cooking)

As Simon hinted at above, this shouldn't be the type of issue you try to work around using a warmup script. I'd suggest serious hardware and software upgrades. I mean 15 minutes to start outlook?

Home

How to prevent reverse engineering of a C# .NET program