Preventing .NET reverse engineering/decompilation

Question

Is there any way to stop .NET Reflector working at a program?

For example: I am developing a program that has confidential data (like gMail address and password), and I don't want to someone can see them.

How can I do this?

Answer 1

There are various tools that promise this, via different techniques.

For example, many commercial obfuscators will, in addition to encrypting strings and obfuscating the source, also introduce things into the IL that allow the program to run but which break (most/all) of the current reverse engineering tools like .NET Reflector.

That being said, keeping this type of data within the application will never be safe. The best a tool can do is make it more difficult to get the information, but never make it impossible.

A tool which "masked" it and breaks obfuscation tools is still not perfect - with enough time and energy, somebody can get that information out of your program. If the information is available to the runtime, it's available to somebody with enough determination and drive to find it. As such, important, private information like passwords should not be kept in the executable.

Answer 2

Yes, search for '.NET obfuscator'. There are several tools available.

However, you should never embed your email username / password in the code. This is just wrong. Putting security aside, what would you do if you need to change your email password? Can you upgrade all the copies of your software out there?

Answer 3

Obfuscators tend to offer little in defense of data such as what you are keeping in your application. They are mainly meant to protect the code and logic from being reverse engineered, not literals. A better way would be to have your client application talk to a server-side app that feeds it the data it needs instead of having your client negotiating with the secure servers directly. With this way, you can set up secure method of encryption between your server and client application.