3

There are numerous tools that offer to obfuscate .NET code. (Dotfuscator etc.)

Question is simple, those who are experienced with such tools, what it the level of protection such tools offer? Against what kind of attackers can they protect? yeah I know everything is breakable. But there are plethora of such tools, so they must give "some" protection right?

What is the effort needed to read back the source that was obfuscated? Even if one uses deobfuscator?

Improve this question

2 Answers 2

Reset to default
4

Not a easy answer unfortunately since it depends on a large number of factors. Skill level of the attacker is very relative when you consider that using a hex editor or ollydbg against something that has been obfuscated by nearly any tool can be very time consuming regardless of your skill level. Yet switching to tools such as IDA Pro or using de4dot that recognise popular obfuscater software signatures and have automatic routines to "ignore" them can make it a lot easier for people who know how to use these tools. E.g. de4dot claims to support the following:

Agile.NET (aka CliSecure)
Babel.NET
CodeFort
CodeVeil
CodeWall
CryptoObfuscator
DeepSea Obfuscator
Dotfuscator
.NET Reactor
Eazfuscator.NET
Goliath.NET
ILProtector
MaxtoCode
MPRESS
Rummage
Skater.NET
SmartAssembly
Spices.Net
Xenocode

Bottom line, any obfuscation is useful since it makes the task harder and therefore the number of potential attackers less due to skill/time requirements. You can also attempt to write your own obfuscation tools that would prevent someone from just using a tool such as those mentioned above. However, this is similar to saying you could just write your own encryption library. Not a easy task to accomplish without years of experience.

If you are really serious about protecting your software it will require a fair amount of additional work/money from your side since you would need to use multiple methods of protection. E.g. Using a obfuscater, cryptor, packer and then using a solution such as a USB dongle for verification.

If you do find a list comparing the difficulty of solutions to each other, please post it, would be really interesting.

Improve this answer
4
  • I tested de4dot against eazfuscator - still it seems not original code is recovered some names are still hidden.. you could also experiment
    – user91560
    Nov 26, 2015 at 9:00
  • @user200312 I really like the subtle insult "you could also experiment". I use de4dot quite a lot for RE tasks, have not used it specifically against eazfuscator. Apologies if you feel that I should not post unless I have tested every single claim they made. Also consider that it does not matter if it does not perfectly restore all variables and code names. Any de-obfuscation can aid quite a lot depending on where the critical piece of code is located.
    – Joe
    Nov 26, 2015 at 9:08
  • "Apologies if you feel that I should not post unless I have tested every single claim they made" - I never implied that. Why did you deduce that? That's the point.. I was interested how much protection tools like eazfuscator offer... etc
    – user91560
    Nov 26, 2015 at 9:43
  • my point was it was still bit obfuscated even though i deobfuscated the code using de4dot. i used eazfuscator
    – user91560
    Nov 26, 2015 at 9:45
-2

There is a detailed comparison sheet for several .Net obfuscator tools. This sheet can give an idea about the difficulty to break/reverse the corresponding tool.

enter image description here

Screenshoot taken from obfuscators.io

Improve this answer

You must log in to answer this question.