. Net Security optimization solution

. Net has many advantages, such as standard integration, simplified applications, and support for mobile devices. HoweverProgramThere is a fatal drawback: it is easy to decompile and takes up a large amount of resources during running. Therefore, in order to better reflect. net, we must. at the same time, to ensure that the program is not decompiled, an effective and feasible security policy must be implemented.

. Net Security optimization methods include source code obfuscation, shelling, and authorization management.

1.1 source code obfuscation

Source code obfuscation meansCodeIt becomes obscure. Effective obfuscation generally increases the complexity of the code and makes the transformed code irreversible. Of course, the purpose of obfuscation is not to achieve non-decompilation, but to make the decompilation cost more than the benefits obtained from it.

1.1.1 obfuscation method

Common source code obfuscation methods include:

1. Name Obfuscation

That is, name the variables, constants, classes, methods, and other identifiers in the program. For example:

2. Control Flow Obfuscation

That is to say, it breaks down the logical relationship of a piece of code, disperses related statements to different positions of the program, and obfuscation of certain functions and hides the obfuscation of real execution paths. Simply put, it is to disrupt the original sequence of the program, and then use the jump statement to connect to the original process logic and achieve the correct execution. For example:

3. Data Obfuscation

That is, obfuscation of the data structure in the program. It can be subdivided:

① Storage obfuscation-changes the way data is stored in the memory. For example, change a local variable to a global variable.

② Obfuscation encoding method -- change the data parsing method. For example, you can resolve variable A to M * 2 + N.

③ Obfuscation of clustering methods -- change the original data grouping method. The simplest example is to split a long array into multiple short arrays.

④ Order obfuscation-change the data order. The array is also used as an example. For example, the f (I) function can be used to determine the new position of the I element in the array.

4. prevent confusion

It mainly targets some specialized anti-compiler design defects and actively prevents the anti-compiler from reversely restoring the obfuscated code.

1.1.2 product example

Dotfuscator supports name obfuscation and control flow obfuscation. Compared with other obfuscators, codes that use dotfuscator obfuscation are irreversible. The method name and class name are reduced to 1 ~ when the names are mixed ~ 2 characters, which greatly reduces the size of the entire file. At the same time, dotfuscator adopts overload induction to better enhance the obfuscation effect.

Compared with dotfuscator, xenocode postbuild can select the method or identifier to be confused when name obfuscation is performed. The level of obfuscation can be selected when control flow obfuscation is performed. The biggest advantage of xenocode postbuild is that it can run. net programs out of the. NET Framework. However, obfuscation will slow the program startup and increase the file size.

1.1.3 criteria

Dotfuscator and xenocode can both implement code obfuscation. How can we determine which product is better or more suitable for us? First, we need to know that the obfuscation effect is generally determined by four aspects: intensity, tolerance, overhead, and concealment.

① Intensity: it refers to the difficulty or complexity of obfuscation-transformed programs compared with the original programs for malicious users to understand programs.

② Tolerance: the resistance of obfuscation-transformed programs to attacks using automatic obfuscation tools.

③ Overhead: the overhead of the execution time and storage space required by the obfuscation transformation during execution of the program.

Compare dotfuscator and xenocode postbuild:
It can be seen that after the xenocode postbuild obfuscation, the characters become longer and more storage space is required. The programs obfuscated by xenocode postbuild can be separated.. NET Framework, which also increases the execution time to a certain extent.

⑤ Concealment: Try to useSource codeSimilar Syntax structures are obfuscated to enhance concealment.

Through the above introduction, it is not difficult to see that the intensity and tolerance must be guaranteed. The purpose of obfuscation is to increase the complexity of the program and prevent malicious users from using it. Overhead and concealment are considered when the first two standards are ensured.

2.1 shelling

Shelling compresses and encrypts executable program resources, which is a common method to protect files. The shell program can be executed directly, but the source code cannot be viewed. You can view the source code only after shelling.

Shelling actually uses specialAlgorithmTo Compress and encrypt Resources in the EXE and DLL files. Similar to using WinZip to compress a file, it is a file that can be executed independently, and the decompression process is hidden, all completed in the memory. They are attached to the original program after loading the memory through the windows loader, and are executed before the original program to obtain control. During the execution, the original program is decrypted and restored, after the restoration, return the control to the original program and execute the original code. After the shell is added, the original program code usually exists in the encrypted form in the disk file and is restored only in the memory during execution, this effectively prevents the hacker from making illegal modifications to the program file, and also prevents the program from being statically decompiled.

2.2 shell Classification

Currently, many shell products have their own characteristics. But in general, it is mainly divided into the following categories:

1. compress the shell-reduce the volume of software, encryption protection is not the focus

But currently. net is relatively small. Currently, it is popular and stable, such as ASPack. It supports Microsoft Visual C ++, Visual Basic, Delphi and other Win32 compilers, with a compression rate of more than 50%.

2. Encryption shell-the anti-tracking debugging and shelling technology are used, but the file volume is not paid too much attention.

Currently, there are many encryption shells and better compression functions, such as winlicense and asprotect.

3. Camouflage shell-replace the OEP of the program with other code, so that the shell checking software cannot find out what shell it is and what language it is written in. For example, winlicense.

4. Multi-layer shell: Add a multi-layer shell to the program on the premise that the shell does not conflict with each other. For example, ASPack.

2.3 product example

Developed by oreans, winlicense integrates functions such as shelling and authorization management. From the attacker's perspective, winlicense uses a completely different protection mechanism. It uses the virtual machine protection mechanism to protect key code with virtual machines, so there is no corresponding shelling tool in China. However, currently, the winlicense version only supports shelling. Net EXE files. Currently, it does not support shelling. DLL files (recently released versions that support shelling. Net DLL files ).

Developed by star-force, asprotect focuses on compatibility and stability, and integrates the strong compression function of ASPack. It provides protection measures such as compression, encryption, anti-tracking, disassembly code, CRC checksum and flower instructions, and uses rsa1024 as the registration key generator. Because it is powerful and widely used, there are also a lot of researchers who currently have corresponding shelling software for earlier versions.

Supported

Merit

Product

Dotfuscator

Xenocode postbuild

X86 and x64 support

√

√

Development Platform

Visual Studio (2003,200 5, and 2008) and earlier vs2010

Visual Studio)

. NET Framework

Supports. net1.0 to 3.5 and earlier 4.0 versions.

Supports. net2.0,. net3.5, and new. net3.5.

Command Line Support

√

√

Name Obfuscation

√

√

Control Process Obfuscation

√

√

Data Obfuscation

√

√

Prevent confusion

×

×

Break away from the. NET Framework

×

√

Source code obfuscation and shelling can improve program security, but the two are different:

Source code obfuscation is to modify the Code itself, increasing the complexity of the program, so that malicious users cannot understand the original code. shelling is equivalent to adding a layer shell to the program for the whole program, this prevents malicious users from seeing the original appearance of the program. The two have different focuses and different effects. Source code obfuscation prevents malicious users from understanding the source code, but the original code can still be seen. If the source code is shelled, only the application can be executed and the original code cannot be viewed.

3.1 authorization management

Authorization management reflects the protection of software copyrights. Common methods include: generate a trial version with time limit, number of times limit, or function limit. Once the trial version meets the restrictions, it cannot be used. On the other hand, authorization management manages the use of authorization keys by binding hardware and IP binding.

At present, some authorization management software can customize the expiration prompt information. For example, asprotect.

Generally, the authorization can be unlocked in either of the following ways:

(1) enter the authorization ID or use the authorization File

(2) Online Registration

Online registration management is more effective than authorization files. Every time software is used, corresponding records are recorded on the server, so that software developers can more effectively control the use of software. To make the authorization file more effective, it can be generated by binding with the hardware, so that each authorization file can only be used on one machine, to prevent the use of multiple machines with one ID.

3.2 Product example

Winlicense is a combination of shelling and authorization management, with powerful functions. You can bind hardware and generate a trial version of the limitation. Winlicense can also limit the number of hardware changes while binding the hardware. That is, we use the CPU, HDD, bios, and so on to generate a unique hardware ID for users to use, but users may change their hardware facilities, so we need to limit the number of changes.

Serialshield is dedicated for authorization management. It can use its special algorithms to generate serial IDs to restrict the use of them. At the same time, it can control software authorization issues through online management and customize prompt information.

Product

Before Obfuscation

After Obfuscation

Dotfuscator

Name1textbox

Eval_a

Xenocode postbuild

Name1textbox

X4b56eb59db89b78

Both have corresponding APIs, which can be easily used in the program. For example, you can use gethardwareid in winlicense to obtain the hardware ID.

Dotfuscator and xenocode postbuild mentioned in this article:

DotfuscatorThe Professional Edition is A. Net obfuscators and compressors that help you prevent your applications from being decompiled. At the same time, it can make your applications more compact and efficient.

Dotfuscator Professional Edition is your best choice for obfuscation and Efficiency Improvement of. NET applications.
Its key features are as follows:
Advanced. Net code security technology:
Rename a namespace/type/method/field using our patented overload-induction TM rename system. It has a powerful "overload sensing" function.

• Control Flow obfuscation-using this product, even the best anti-compiler currently cannot get useful output.
• String encryption.
• Several predefined rename schemes that contain non-printable characters.
• Watermark Software

. Net code efficiency:

• Your application will become smaller.
• Trim/compacting: removes types, methods, and fields that are not actually used.
• Enhance trimming and rename reports.
• Assembly link.

Comprehensive and efficient. Net code development and deployment:

• Fully supports the. NET Framework.
• You can easily use XML-based configuration files.
• The generated map file allows you to trace the stack.
• Added the obfuscation function.
• Includes graphic user interfaces and command line interfaces suitable for integration into the compilation environment.
• Provides more comprehensive and accurate user guide in pdf format.
• Supports hosted C ++ modules.
• Powerful and easy-to-use interface for naming rows.
• Fully supports the lite version. NET Framework.
• Seamless obfuscation of affiliated dynamic link libraries.
• Highly integrated with the Visual Studio "project generation" function.
• Debugging support, including decoding of stack trace information.
• Include/exclude can be implemented through custom property matching.
• Fully supported and integrated with Visual Studio 2005.
• Declarative obfuscation can be achieved through standard custom attributes.
• Supports general types (generic types) and general methods (generic methods ).
• Many graphic user interfaces have been improved, including support for XP themes.
• Pre-build and post-Build Events are supported.
• You can select the library mode for each Assembly element.
• Automatically name the Assembly and release it after generation.
• Improved the algorithm for finding external Assembly Dependencies by "user-specified assembly loading path.
• It can be integrated with msbuild.

Postbuild for. netPowerful, flexible, and easy-to-use code deployment solutions are suitable for. NET developers. Obfuscation, optimization, and compilation of. net programs into Native x86 binary files running on any Windows desktop.

Main advantages
Xenocode postbuild is a powerful, flexible, and easy-to-use code security and Deployment Solution for. NET developers.

Protect your intellectual property rights

• The industry-leading. Net obfuscation and anti-resolution technologies protect. Net-based code from the infringement of decompilation and reverse engineering.
• The Code watermark technology prevents unauthorized copying.

Run the. NET application on any Windows Desktop

• The generation of local x86 executable files enables your. NET applications to run in any location and with a framework or no framework, or with an mismatched Framework version.
• Embed application-specific. NET and DirectX associations to eliminate version conflicts and separate installation steps.

Optimize Application Performance

• It can reduce the size and complexity of applications through executable/DLL connections, metadata reduction, elimination of useless code and metadata, decompression during running, and association and merging.
• Transparent compression greatly reduces the size of executable files without any separate decompression steps.

Virtual File System data, registry items, and Windows Services

• File System and Registry virtualization allows you to execute complex applications without host changes, removing installation steps, managing permission requirements, and Vista UAC prompts.
• The new Service Virtualization allows database and web server processes to be directly embedded into application executable files.

Save it directly to an existing MSI package or generate an independent Executable File

• Directly Save the output binary file to the existing MSI package.
• When the application starts, it automatically generates custom pure image display for independent Executable File deployment.

Supports the latest. Net platforms and technologies

• The xenocode engine has been updated to support the latest. Net platforms and technologies, including. NET Framework 3.0/3.5, WPF and LINQ, Windows Vista, and Windows 2008.
• Xenocode virtualization fully supports the latest Windows parallel (sxs) deployment mechanism.

Applicable platform:. Net
Target customers:All. Net Development Platform Users
Typical customers:Hanwang technology and Jiangsu electronic education hall