How is obfuscation done?

Question

Hi, How is obfuscation done? Can someone plzz give simple explanation...... Thanks....

Vulpes · Answer

It's a complex subject but this old article ( http://www.drdobbs.com/184416569 ) explains it well.

Suthish Nair · Answer

If the query got resolved, then mark the post that helped you as Answer so will be helpful for others. Otherwise if you got the solution please share with us.

Vulpes · Answer

That's right, it doesn't - though personally I prefer to use the function's ordinal number rather than its mangled name. For example, in the DllAttribute you could specify: EntryPoint="#1" for a function with an ordinal of 1.

Sam Hobbs · Answer

As explained in How to Marshal a C++ Class , use of CallingConvention.ThisCall does not eliminate the necessity of using mangled function names; that author chose to use extern "C" . Use of C++ for this is not for a beginner. In addition to learning C++, there are abundant technical details to learn about .Net interop with C++. I have a book about it and all the details makes my head spin.

Vulpes · Answer

'CallingConvention.ThisCall' is what it's called when using the DllImport attribute though it's called __thiscall in Visual C++. As you say, we're getting off-topic here. The only point I was trying to make is that it's much easier when using P/Invoke to call 'C-style' functions (whether those are produced by a C or C++ compiler) rather than member functions of C++ classes. I agree that rather than writing the whole application in C++/CLI, you could hive off the 'secret' bits into unmanaged code embedded within or called by a C++/CLI managed dll which could then be consumed by the C# application.

Sam Hobbs · Answer

Is it ThisCall or thiscall ? I assume thiscall but if that is not what you meant then perhaps I am missing something. I have not yet used either. I think we are getting off-topic for the thread but for discussion of C/C++ we need context. If the entire application is written in C++ then the calling convention is insignificant. If portions of an application are developed using C++ then C++ functions can be called as if they were C functions simply by using extern "C". C++ is not like C#; C++ does not require everything to be in a class. The C++ compiler can be used for a program that has no class. There is not a " C subset of C++ ". There are two language specifications each of which are compiled by separate compilers (at least that is what Microsoft and the Gnu compilers do) and it is not possible to switch languages within a compilation unit. It is possible to use extern "C" in the manner above to specify that the C calling convention should be used. The reason that is needed is to eliminate the use of decoration of the function name. Certainly it is possible to make a COM object server in C++ that managed code could use. Is it not possible to make a managed object in C++ that can be called by managed code and then the managed C++ code calls unmanaged code?

Vulpes · Answer

The advantage of using C (or the C subset of C++) rather than C++ classes is that you don't have to worry about getting pointers to C++ objects when using P/Invoke to call instance functions. Although there are ways to do this (using ThisCall), none of them is particularly pleasant compared to simply calling a C function. An alternative approach would be to use C++ to create a COM object which you could then interact with from C#.

Sam Hobbs · Answer

In reply to the suggestion to " cloak them within C functions " there is no advantage in using C for anything; new development should be done using C++. Use of C++ for the purpose discussed here can be most effective, except it would not have the portability of pure managed code.

Vulpes · Answer

I was reading an article the other day ( http://jcooney.net/post/2010/06/06/The-sad-(but-inevitable)-state-of-NET-Obfuscation.aspx ) which makes one wonder whether .NET obfuscation is worthwhile at all nowadays, apart from to prevent casual code inspection. To do the latter, you could just use the free edition of DotFuscator. If you have any commercial secrets, then it's probably best not to use .NET at all or (where feasible) cloak them within C functions, which are much harder to disassemble, and then P/Invoke those from your .NET application. Alternatively, you could write your application using C++/CLI which allows you to intermingle managed and unmanaged code.

Sam Hobbs · Answer

I assume it is a secret. It needs to be a secret.

How is obfuscation done?

Answers (10)