Given a C#.NET assembly, what information can you get?

[Jon Skeet [C# MVP]]

Re: Given a C#.NET assembly, what information can you get?

Curious <fir5tsight@yah oo.comwrote:

In addition to using their server, I also use their program which
loads my .dll each time I run it from my machine. That's why I think
they can get the content of it.

Do you have any evidence that that program transmits the data anywhere?
If not, it's hard to see how they could get your code.

--
Jon Skeet - <skeet@pobox.co m>
Web site: http://www.pobox.com/~skeet
Blog: http://www.msmvps.com/jon.skeet
C# in Depth: http://csharpindepth.com

[Curious]

Re: Given a C#.NET assembly, what information can you get?

>

Do you have any evidence that that program transmits the data anywhere?
If not, it's hard to see how they could get your code.
>

I have no evidence that the program transmits data. But I talked to
someone there and asked if he could see my code. He said he was only
able to see the names of the methods in my assembly. I imagine that it
must be something similar to Reflector.

I vaguely recall that when I did training there, the instructor showed
us how to find out more about an assembly uploaded in that program.

[Cor Ligthert[MVP]]

Re: Given a C#.NET assembly, what information can you get?

Or like the famous words of somebody in past very active in the VB language
newsgroup.

I don't know it more exactly, but it was something in a thread with the same
discussion as this:

"I cannot even understand my own code after some days. It is obfuscated
directly".

Cor

"Alun Harford" <devnull@alunha rford.co.ukschr eef in bericht
news:O0BTrZQ8IH A.3624@TK2MSFTN GP05.phx.gbl...

Curious wrote:

>>If you're serious about protecting your code, don't provide the object
>>code to your adversaries!

>>
>I never intended to provide my .dll to anyone. But I'm put in this
>client-server type of environment where I am a client. Although
>my .dll file is on my location machine, when I run it against a server
>that belongs to another company and located remotely in their office,
>I believe that they are able to see my .dll.

>
In that case, you need to either trust them with the code (because you
think they're not an adversary; because its not in their interest to
attack you; because you'll go to court and win lots of money; because
they're not clever enough to reverse engineer your code, etc...) or don't
give them the code.
>

>One more question for you gurus: Do you believe that they can get
>my .dll file when I run it against their server database ? Could
>anyone explain how can they get my .dll through the server?

>
If you're just connecting to their database server, they shouldn't be able
to see your code.
>

>>Against an adversary who can run your code in a debugger, I'm yet to see
>>an obfuscator that is worth bothering with the debugging pain.

>>
>What do you mean by saying this? Please explain.

>
It's trivial to reverse engineer any realistic class. Lets take something
kind-of-like System.Drawing. Color as an example (simply because it's
self-contained).
>
This is 'obfuscated' code I've written manually and does not represent any
particular product:
>
namespace System.Drawing
{
public struct Color
{
public byte R{get;private set;}
public byte G{get;private set;}
public byte B{get;private set;}
>
public static Color Black = FromArgb(0,0,0) ;
public static Color White = FromArgb(0,0,0) ;
public static Color FromArgb(int a, int b, int c)
{
A(a, "red");
A(b, "green");
A(c, "blue");
return new Color(){R = a, G = b, B = c};
}
private static void A(int a, string b)
{
if(a < 0 || a 255)
{
throw new ArgumentExcepti on(b + " value is out of range");
}
}
}
}
>
I've removed all non-public names, and thrown away as much information as
I can while still maintaining the same interface. It's still easy to
understand.
>
There are a few more silly tricks. For example, we could make 3 functions
that evaluate to "red", "green" and "blue" so we don't have to put those
literals in the code, but anybody with a debugger is just going to put a
watch on the result of those functions and see what the result is. Another
silly trick is to change all variables to have the same or similar names
(because this is supposedly harder to read - you can write a tool to parse
the code and change them back to a,b,c,... in less than 2 minutes with
Mono Cecil).
>
And for this 'security', you've lost the information from your stack trace
so it's not clear (if an exception were thrown) that the exception
happened in the CheckByte function (called A here). You've also probably
added some extra bugs from the obfuscation layer. Reflection doesn't
always work any more either, because you might have thrown away the name
of what you're looking for.
>
Alun Harford

[Jon Skeet [C# MVP]]

Re: Given a C#.NET assembly, what information can you get?

Curious <fir5tsight@yah oo.comwrote:

Do you have any evidence that that program transmits the data anywhere?
If not, it's hard to see how they could get your code.

>
I have no evidence that the program transmits data. But I talked to
someone there and asked if he could see my code. He said he was only
able to see the names of the methods in my assembly. I imagine that it
must be something similar to Reflector.
>
I vaguely recall that when I did training there, the instructor showed
us how to find out more about an assembly uploaded in that program.

What product is this? I'd be pretty wary of any client/server
architecture which required you to upload your code from the client to
the server, unless there was a *really* good reason.

--
Jon Skeet - <skeet@pobox.co m>
Web site: http://www.pobox.com/~skeet
Blog: http://www.msmvps.com/jon.skeet
C# in Depth: http://csharpindepth.com

[Alun Harford]

Re: Given a C#.NET assembly, what information can you get?

Cor Ligthert[MVP] wrote:

Or like the famous words of somebody in past very active in the VB
language newsgroup.
>
I don't know it more exactly, but it was something in a thread with the
same discussion as this:
>
"I cannot even understand my own code after some days. It is obfuscated
directly".

If you *really* want to obfuscate your code, get a student to write it
for you.

On a serious note, I've found it useful to think about how easy it would
be to understand my code without meaningful variable, method or class
names, formatting or comments - and not just for non-public members. If
it's clear then, it's probably good code. If it's not, it's almost
certainly not worth refactoring but it is worth thinking about what went
wrong.

Alun Harford

[Curious]

Re: Given a C#.NET assembly, what information can you get?

Jon,

Since people on this forum have been so helpful to me, I want to share
the name of the product so that I can get your valuable input.

However, it will hurt our partner relationship in case someone from
that company sees my post . They'll interprete that as distrust.

[Jon Skeet [C# MVP]]

Re: Given a C#.NET assembly, what information can you get?

Curious <fir5tsight@yah oo.comwrote:

Since people on this forum have been so helpful to me, I want to share
the name of the product so that I can get your valuable input.
>
However, it will hurt our partner relationship in case someone from
that company sees my post . They'll interprete that as distrust.

I would ask them directly then, and ask them to provide technical
justification for why they need your code if they do in fact upload it.
That's just due diligence, IMO.

--
Jon Skeet - <skeet@pobox.co m>
Web site: http://www.pobox.com/~skeet
Blog: http://www.msmvps.com/jon.skeet
C# in Depth: http://csharpindepth.com

[Chris Dunaway]

Re: Given a C#.NET assembly, what information can you get?

On Jul 28, 1:44 pm, Curious <fir5tsi...@yah oo.comwrote:

What does "decompile" mean? Does it reverse the assembly back to the
source code in C#.NET? Do you believe that Reflector can go that far?

Yes it can.