I'm going to write a Client/Server application. There are some ambiguous concepts in this that I was not able to get answer to after many hours of searching.

As we all know one of the major caveats of the .Net framework is that the DLL files can be decompiled and reverse-engineered on the client's machine.

Now my question is can I put some of the DLL files required by the Client on the Server?

And if true, will it be completely secure or it will still be open to getting reverse-engineered/decompiled by crackers?

  • 1
    How would the client retrieve/use the DLLs remotely? – RoraΖ May 6 '15 at 11:39
  • 1
    If you really want to hide your code, I can think of two options 1) obfuscate 2) use some sort of service, WCF or WebAPI – sprocket12 May 6 '15 at 12:26
  • Can you please how WCF works in this case? – Vahid May 6 '15 at 12:30
  • What is your concern @Vahid? Are you afraid that the user will steal your IP by viewing your code or are you afraid that your app won't be secure if the user views your code? – Neil Smithline May 6 '15 at 18:09
  • @NeilSmithline I'm trying to keep my IP safe. – Vahid May 6 '15 at 18:28

As mentioned in a comment above, there are two basic strategies for protecting the IP in your source code:

  1. Make your source code more difficult to understand. This is typically done through obfuscation. Obfuscators attempt to make the source code difficult to reverse compile and/or difficult to understand once they've been reverse compiled. I'm no expert on obfuscation tools so all I can do is point you to this list and suggest you research and post follow-up questions if any arise. Obfuscation is "easy" in the sense that you get the tool, possibly paying for it, and then incorporate it into your build process.
  2. Keeping your code on the server. This involves moving some of your application logic to from the client to the server. There are many reasons to move code to the server. Protecting IP is one. Having logic that requires the server's hardware could be another (common for mobile solutions with low processing power). This is more difficult to implement than obfuscation as it affects your application's architecture. The new architecture would have the client, rather than making a local function call, making a RPC to the server to perform some calculations. SOAP may be the most common technology but there are many others. The exact technology will depend on many factors including the client's and server's platforms (eg: is it a native .NET app, a browser app accessing a .NET server, mobile app, etc...) and you're coding skills.

Hope this helps.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.