Exe file security

It's actually even worse than that, Marek.

If you use a free tool such as .NET Reflector (link below), you can recover the entire source code of your C# application! The only thing that can't be recovered is local variable names and comments, which are lost when the application is compiled to intermediate language - the former just become numbered storage locations.

http://www.red-gate.com/products/reflector/

This is a big problem if you are using .NET to develop commercial applications.

It's possible to use an obfuscator to make the code very difficult to read and there's a free one, Dotfuscator Community Edition, which is packaged with Visual Studio:

http://msdn.microsoft.com/en-us/library/ms227240.aspx

You should also look for ways to avoid hard coding strings. However, for protection against professional hackers, you need the Professional edition or similar very expensive tools which include string encryption facilities.

One other thing you can do which costs nothing is to put sensitive stuff in a C dll and then P/Invoke it from C#. It's much harder to crack unmanaged code, particularly if you use obfuscation tools on that as well.

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Marek18y ago
thanks a lot. I'll have a look around. thank you.
Alan18y ago
It's actually even worse than that, Marek.

If you use a free tool such as .NET Reflector (link below), you can recover the entire source code of your C# application! The only thing that can't be recovered is local variable names and comments, which are lost when the application is compiled to intermediate language - the former just become numbered storage locations.

http://www.red-gate.com/products/reflector/

This is a big problem if you are using .NET to develop commercial applications.

It's possible to use an obfuscator to make the code very difficult to read and there's a free one, Dotfuscator Community Edition, which is packaged with Visual Studio:

http://msdn.microsoft.com/en-us/library/ms227240.aspx

You should also look for ways to avoid hard coding strings. However, for protection against professional hackers, you need the Professional edition or similar very expensive tools which include string encryption facilities.

One other thing you can do which costs nothing is to put sensitive stuff in a C dll and then P/Invoke it from C#. It's much harder to crack unmanaged code, particularly if you use obfuscation tools on that as well.