Visual Studio Obfuscation

by

Mar 28, 2019 Dotfuscator Professional is the industry standard.NET Obfuscator and is suitable for enterprise developers requiring ongoing support, maintenance, and product updates. Additionally, Dotfuscator Professional offers tighter integration with Visual Studio and is licensed for commercial use. For more information about the advanced application. Obfuscation is a very helpful tool, and the free version included in Visual Studio can secure and protect your code to such an extent that reverse engineering it, becomes a laborious and fruitless task. I have created single layer windows form application and added one Visual Studio Install Setup Project to create the installation wizard using Visual Studio 2013. So my application contains one.exe file and number of.dll files (SQLite, EntitiyFramework, etc) and other publish items. I am trying to Obfuscate my code using ConfuserEx.

Dotfuscator is a .NET Obfuscator and In-App Protection solution that helps companies with apps 'worth protecting' secure trade secrets (IP), reduce piracy/counterfeiting, and protect against tampering and unauthorized debugging. Dotfuscator works with all flavors of .NET including Xamarin, .NET Core, .NET 5, ASP.NET, and UWP apps. PreEmptive Protection also supports Java/Android, JavaScript, and iOS apps.

Patented obfuscation technology

Advanced renaming, control flow, string encryption, metadata stripping and other transformations provide the highest degree of protection.

Seamless integration with Visual Studio

Dotfuscator integrates directly into your Visual Studio project file (e.g. '.csproj') on Windows or Mac. The initial integration is easy and automatically protects your app on every release-mode build.

Support for the complete secure development lifecycle (SLC)

From mapping to Agile, continuous integration, support for debugging, patch management and distributed development, Dotfuscator is a reliable component of your manufacturing process.

Tamper & debug detection, response and alerts

Terminate or modify the execution of tampered applications or unauthorized debugging and customize other responses.

Powerful compaction, linking and watermarking

Compaction can significant reduce app size. Linking consolidates multiple assemblies into one easy to manage executable. Watermarking hides copyright and other unique information in your app.

Incorporation into Microsoft's development process

PreEmptive has been the sole supplier of obfuscation technology to Microsoft since Visual Studio 2003. Dotfuscator is a formal component of Microsoft's internal Visual Studio development process. Dotfuscator is subject to all of Microsoft's quality, regression, audit and control gates.

World-class support

Our dedicated professional support team is available by phone and email and supported by our extensive online documentation and knowledgebase. Given the critical nature of software, it is no wonder that 9 of the 10 largest technology suppliers use PreEmptive Protection on their apps worth protecting.

Development Compliance and the Law

Security standards bodies, regulators, legislators, and the courts recognize the necessity to secure data in use. In addition to increasing your risk of a data-related breach, failure to implement appropriate, well-understood and accepted app protection-security controls could result in increased liability, fines, and brand damage.

Is your app worth protecting?

  • Does it contain innovation?

  • Does it access sensitive data?

  • Does it perform a critical function?

  • Is it shipped internationally?

Through a combination of binary hardening, detection, defense and alert controls, we offer material risk mitigation against the following threats:

  • Intellectual Property Theft

  • Fraud and Unauthorized Access

  • Trust and Brand Damage

  • Confidential Data Theft

  • Revenue Loss

PreEmptive Protection - Dotfuscator is available in two editions:

The Community Edition (CE) is included with all versions of Visual Studio and offers basic application protection features such as the ability to obfuscate method names, etc.

The Professional Edition is available for evaluation or purchase and includes enterprise-grade protection, dedicated support, and commercial licensing. To learn more, please compare editions.

solutions@preemptive.com | www.preemptive.com | 1-440-443-7200A string obfuscation system that integrates in a Visual Studio C++ solution

Michael Haephrati, CodeProject MVP 2013


Introduction

The purpose of obfuscators in general is to hide program code, flow, and functionality. If your program uses an algorithm that is a trade secret, obfuscation will make it harder to reverse engineer it and reveal this trade secret. But what about hiding the data inside the executable? Some people say that is almost impossible to achieve. Since the problem needs to be able to read this data, the data must be there, and if it is there, it can be revealed eventually. In my opinion, a well obfuscated program, can make it next to impossible to guess where the data is kept (encrypted), and even if the data is found, to obfuscate it using strong encryption.

The Solution

The set of tools I will introduce in this article, were developed for the purpose of encrypting strings within applications.

Usually, an application can reveal a great deal of information about itself, even without having to reverse engineer it. When you open an application such as Calc.exe from a Hex editor (or from Notepad as a text editor), you can find strings like:

An example of strings that create a risk if kept non encrypted, is passwords. If your software connects to an Internet service, SMS gateway or a FTP server, and send a password, this password will be visible to anyone who opens the executable of your application with any textual editor.


Background

I have read Chris Losinger's excellent article and wanted to take it to the next level by creating a stronger encryption (AES-256) and to support more variations and string types, including UNICODE, double and single byte strings.

The purpose of this tool is professional use, and not just being a proof of concept.


The Source Code

The encryption / decryption mechanism integrate as two separate projects which need to be added to your Visual Studio solution. The two projects are in the main folder:


a. The obfisider project.
b. The obfuscase project.

The Obfisider and the Obfuscate Projects

The Obfisider project contains the AES encryption part. The Obfuscate project contains the necessary parts to scan a solution, and each project it contains, and to encrypt the strings found.


Scanning a Solution

Solutions are scanned using parseSolution which calls another function named parseProject .


The parseProject function extract the relevant files from a given project. Relevant files means : .c, .cpp, .h and .hpp files.

The AES_Encode function

This function handles the encryption of the strings using AES-256:


The AES_Decode function

This function handles the decryption of the strings back:



Decoding the strings backVisual studio obfuscation download

ASCII strings are decoded using the following function ( __ODA__ ):


When the string is UNICODE, the following function (__ODC__) is used:

How to use

Set project dependencies so the main executable or DLL your solution is generating depends on the 'obfinsider' project.

The 'obfinsider' project must depend on the other project – the 'obfuscate' project. This will automatically include obfinsider.lib, but in case you make changes that break this dependency, please add obfisider.lib manually.

How it works


Visual Studio Obfuscation Settings

The Process

'obfuscate' is built first and after build is completed, a Post Build event takes place. The Post Build event calls obfuscate along with the entire solution file as its parameter.


The Files Scan

Obfuscate scans the given solution and works on each relevant file in it. The current version requires that no spaces will exist in this path, and if there are spaces, the proper way 'obfuscate' should be called would be:


'$(TargetPath)''$(SolutionPath)'

'obfuscate' scans the solution for all project files, but process the following file types: .c, .cpp, .h and .hpp.


The Work
Per each file, the following checks are made:
a. Obfuscated files are skipped

b.'obfuscate' doesn't process itself, so its own files are skipped.

c. Comments are skipped. This includes:

// this is a comment

Microsoft Visual Studio Download

and

/* this a another comment */

d.#include and #pragma declarations are skipped.

e.Initialized global strings are ignored. If you look at the following example:


Static char c[]='test string';

f. For all other strings, 'obfuscate' looks for the original declaration and replaces it with a calls to the decryption function, along with the encrypted string as its parameter.

For easy maintenance, the original line is preserves as kept as a commented line above the new line.


ASCII vs. Unicode

The system distinguishes between ASCII and Unicode text. Two separate sets of functions are used per each type.

Obfuscation
The following statement:
wcscpy(mystring, 'my text');

or

wcscpy(mystring, _T('my text'));

will be detected as Unicode type and will be replaced with a call to __ODC__ while similar ASCII statements:


strcpy(mystring, 'my text');

will be detected as such as will be replaced with a call to __ODA__.


Encryption and Encoding Scheme

1. Each string is encrypted separately with an ad-hoc generated encryption key.

2. This key is generated randomly, while the SEED value for the random number generated is set at the start of the application.

3. All strings are padded with NULL characters to round them so their length match an entire number of encryption blocked, which are required by the AES-256 encryption scheme.

4. The result, is in a binary form, and is represented as a printable set of characters using the following algorithm:


  • Each byte is split by half. Higher half is encoded first and then the 2nd half. For example: 0xAF is split into: 0xA and 0xF.
  • The encoded value is the Delta between the preview value and the new value (initial value is 'A').

    • For example: value 0x3 is set as a result of shifting from character 'A' and 'D' (0x40+0x30x43).

    5. When the shifted value reaches 0x7E, the initial value of 'A' is subtracted from this value.

    For example: if Last value was 'z' (code 0x7A) and encoded value is 0xF, then the new value will be encoded as character '+' ( code 0x2B 0x7A + 0xF - (0x7E-0x20) )

Example

The following statement:


wprintf(L'This is a testn' );

will be replaced with the following lines:

Visual studio code

Limitations

It is impossible to cover all variations in which strings may appear in a C / C++ project, even though I have done my best to cover most of them. Since one can initialize a one-dimensional character array by specifying:

  • A brace-enclosed comma-separated list of constants, each of which can be contained in a character
  • A string constant (braces surrounding the constant are optional)

    • Visual Studio Obfuscation Tutorial

    For example:
    staticchar a[]='some_string';

    When the size of the array is not set, it is impossible to encrypt the predefined contents as the real size isn't know at the time of compilation.

    Another example where such system will not be able to encrypt is referred to as 'Hidden Merging':


    License

    This article, along with any associated source code and files, is licensed under The Common Development and Distribution License (CDDL)


    About the Author

    Michael N. Haephrati, is an entrepreneur, inventor and a musician. Haephrati worked on many ventures starting from HarmonySoft, designing Rashumon, the first Graphical Multi-lingual word processor for Amiga computer. During 1995-1996 he worked as a Contractor with Apple at Cupertino. Worked at a research institute made the fist steps developing the credit scoring field in Israel. He founded Target Scoring and developed a credit scoring system named ThiS, based on geographical statistical data, participating VISA CAL, Isracard, Bank Leumi and Bank Discount (Target Scoring, being the VP Business Development of a large Israeli institute).
    During 2000, he founded Target Eye, and developed the first remote PC surveillance and monitoring system, named Target Eye.
    Other ventures included: Data Cleansing (as part of the DataTune system which was implemented in many organizations.
    Follow on Twitter, Google, LinkedIn
    Article Top