--- title: "混淆与加密Dotfuscator的使用" author: "Perrin Yong" author_profile: https://www.pystone.net/profile/ published_by: "Perrin Yong" canonical: https://www.pystone.net/notes/dotnet-obfuscation-dotfuscator/ type: note content_role: unspecified visibility: public id_stability: rename-stable source_path: "10-计算机、信息技术与工程/02-编程语言与运行时/.NET与CSharp/混淆与加密Dotfuscator的使用.md" content_hash: cc416c41446aa6cffdee24b489a489bd4b7598fa0ccae20c924cad77da8638ab knowledge_version: 224c990773de.5fa8af6e39fa site_commit: 224c990773de166d23a886306577dd90379529ce notes_commit: 5fa8af6e39fa3891d1b9b4832bfa6c4e0ecaaf0a --- # 混淆与加密Dotfuscator的使用 > 创建时间：2020/9/1 16:40 * 混淆与加密Dotfuscator的使用 * 概述 * 功能 * 我使用应该注意 * 作用 * Intellectual Property Protection * Application Integrity Protection * Application Monitoring * GUI说明 * Configs * Settings * General Tab * Properties Tab * Assembly Load Paths Tab * Feature Map Strings Tab ? * Signing Tab (Professional )? * Renaming Configuration * Exclusions Tab（重要） * Built-in Rules Tab * Options Tab * Injection Configuration * Checks Tab * Building * Check Results * Decoding Obfuscated Stack Traces * Obfuscation * Overview * Library Mode * Smart Obfuscation? * Declarative Obfuscation * Suppress Ildasm Global Option * Renaming * Overload Induction * Map File * Exclusions * Exclusion Rules * Namespace Options * Property and Event Removal(随后研究一下) * Checks和Instrumentation没有看，以后再研究 * Attributes * Obfuscation Attributes * Properties * ObfuscateAssemblyAttribute ## 概述 PreEmptive Protection - Dotfuscator A post-build system for .NET applications. It operates on compiled .NET assemblies, not source code. 文档： ## 功能 * obfuscate assemblies * inject active defense measures into the application ## 我使用应该注意 1. 非库程序 2. Rule类名不能混淆 3. 字符串不能轻易混淆 ## 作用 > Use it to **harden, protect, and prune** desktop, mobile, server, and embedded applications to help **secure trade secrets and other intellectual property (IP)** , **reduce piracy and counterfeiting** , and **protect against tampering and unauthorized debugging**. > Works on compiled assemblies without the need for additional programming or even access to source code. ### Intellectual Property Protection **Obfuscating** your code with Dotfuscator reduces the risk of unauthorized access to source code through reverse engineering, as important naming information will no longer be public. A bad actor may attempt to attach a debugger to a running instance of your application in order to understand the program logic. Dotfuscator can inject anti-debug behavior into your application to obstruct this. ### Application Integrity Protection It’s also important to ensure your application is **used as designed**. Attackers can attempt to hijack your application in order to circumvent licensing policies (that is, software piracy), to steal or manipulate sensitive data handled by the application, or to change the behavior of the application. ### Application Monitoring Track how frequently the application is used and how it is used, including what errors customers experience. Dotfuscator can inject exception-tracking, session-tracking, and feature-tracking code into your application. When run, the processed application will transmit telemetry to a configured PreEmptive Analytics endpoint. ## GUI说明 ### Configs setting up a new Dotfuscator config(XML文件保存配置)by navigating to the Inputs screen. The config defines the assemblies that will be read by Dotfuscator, how those assemblies will be modified, and where the modified assemblies will be written out. ### Settings #### General Tab Destination directory Inherit obfuscation attributes ? Smart obfuscation ? Suppress Ildasm: If enabled, the SuppressIldasmAttribute will be added to all of your output assemblies. Smart obfuscation reporting #### Properties Tab Properties can be thought of as simple **string substitution macros** that may be used wherever a **filename or path** is required. case sensitive(大小写敏感) #### Assembly Load Paths Tab custom locations to look for **referenced assemblies**. #### Feature Map Strings Tab ? As part of Declarative Obfuscation, Dotfuscator recognizes various strings that can be used in the Feature property of the ObfuscationAttribute: “renaming” indicates to Dotfuscator that the attribute specifies instructions for the renaming feature of Dotfuscator. #### Signing Tab (Professional )? the ability to automatically re-sign these types of assemblies ### Renaming Configuration #### Exclusions Tab（重要） Exclude code items from renaming. This may be necessary when those code items are used by reflection, among other scenarios. Elements which are already excluded by Declarative Obfuscation will be listed in blue text. Preview button——显示exclude效果 #### Built-in Rules Tab #### Options Tab configure the renaming process at the config level. **Introduce explicit method overrides when renaming** : If enabled, methods that override other methods may be renamed differently than the overridden method. **Namespace handling** : Choose how namespaces are to be handled for renamed types. Incremental obfuscation(Professional) **Output map** ### Injection Configuration add attributes to your config. These attributes will be saved in the Dotfuscator config file, not in your source code. These attributes are known as extended attributes. #### Checks Tab ### Building Once you have **created your Dotfuscator config** , you can **build**. Dotfuscator Community will **read the input assemblies** , **modify them according to the config(the obfuscation and injection settings)** , **write the modified assemblies** to the output path specified. #### Check Results * Results Screen * Build > Open output directory * Renaming Map File will be located at the configured path. * View Decompiled Assemblies ### Decoding Obfuscated Stack Traces Tools -> Decode Obfuscated Stack Trace. An integrated tool that allows you to use your output mapping files to recover the original symbols from obfuscated stack traces. Some methods in the obfuscated stack trace might be ambiguous. (due to the use of Overload Induction) The tool displays all the possibilities. ## Obfuscation Dotfuscator’s Renaming Obfuscation changes the names of types, fields, properties, methods, and parameters within the input assemblies. > * Library assembly: This assembly will be referenced by other assemblies not included in the Dotfuscator config. > > * Non-library assembly: This assembly is either stand-alone or is only referenced by other input assemblies. > > ### Overview #### Library Mode The public types and publicly-accessible members of a library assembly are never renamed, because external assemblies may be referencing those code elements by name. 关掉 ，增加混淆程度。 #### Smart Obfuscation? #### Declarative Obfuscation Dotfuscator also obeys configuration specified declaratively in the assembly via **standard .NET attributes**. 1. Annotate your code with obfuscation attributes as appropriate. 2. Ensure that, for each relevant input assembly, the Honor obfuscation attributes option is enabled. We strongly recommend you also enable the Strip obfuscation attributes option, as these attributes are not needed after Dotfuscator has processed the assemblies. 3. Build your Dotfuscator config. Invoked via Reflection, Excluded from Renaming: ```csharp string str1 = "test"; string str2 = "test"; ``` #### Suppress Ildasm Global Option Dotfuscator can prevent Visual Studio from using this feature on your assemblies by adding the SuppressIldasmAttribute to all output assemblies. This will also stop the official .NET disassembler, ildasm, from operating on your assemblies. Will not affect third-party tools. ### Renaming #### Overload Induction giving as many code elements as possible the same new name, even if they have no relationship to one another. 勾选 Use Enhanced Overload Induction 。 Dotfuscator 利用了 c# 的重载特效，将完全不同的方法重命名为同一个方法，被称为 Overload Induction。 #### Map File Renaming makes diagnosing the issue much more difficult. Map File maps the original code element names to the new names. By preserving, but not distributing publicly, this map file with your application releases, you can **decipher** issues reported in production. #### Exclusions requires that certain code elements not be renamed. * when an assembly is to be used as a dependency of other assemblies (such as a library) * when reflection is used to find a code element. 方法: 1. By explicitly excluding code elements from renaming, either in the user interface or by declarative obfuscation. 2. By defining custom exclusion rules. 3. By enabling built-in rules. 4. By indicating an assembly is a library assembly, therefore excluding all publicly-accessible types and members. Certain code items are never renamed: * Assemblies * Modules * Names reserved by IL (such as .ctor for constructors) #### Exclusion Rules exclude multiple code elements with a set of logical criteria. **Namespace rules** Regular Expression **Type rules** A type’s full name includes its namespace A generic type’s full name includes its type specification The type’s attributes contain every attribute listed with a + prefix in the rule’s Attribute specifier property The type’s attributes contain no attribute listed with a - prefix in the rule’s Attribute specifier proper The type is a subtype of at least one type matched by one of the rule’s child Supertype Rules The type matches one of the rule’s child Custom Attribute Rules A type also matches a Type Rule if it is a subtype of another matching type and the rule’s _Apply to Derived Types_ property is true. If you only want to exclude the names of members, but not the name of the type, then you will still need a Type Rule, but you should set the Exclude Type property to false. **Member rules** : Method rules, Field rules, Property rules, and Event rules If a member matches a Member Rule, then it is excluded from renaming. If the member is a method, its parameter names are also excluded from renaming. **Supertype rules** 根据父类来限定，但不Exclude父类 **Custom Attribute rules** type or member is annotated with a custom attribute #### Namespace Options **Flatten and rename** : The namespaces will be removed entirely. **Rename only** : The namespaces will be renamed, preserving the hierarchy of namespaces. **Preserve** : The namespaces will not be renamed. Any types that are excluded will retain their original namespaces. #### Property and Event Removal(随后研究一下) If a property or event is not excluded from renaming, then it will be removed from the output assembly. ## Checks和Instrumentation没有看，以后再研究 ## Attributes Because of this, most options for how Dotfuscator protects an application are stored in a Dotfuscator config file, separate from the source code. However, if you do have access to the source code, you can also configure some Dotfuscator features with .NET attributes. Dotfuscator recognizes certain attributes when it processes assemblies, which configure how Dotfuscator will process the code elements the attributes annotate. By default, Dotfuscator also strips (removes) these attributes during processing, so that the shipped application does not contain sensitive configuration information. The attributes that Dotfuscator recognizes are: * Obfuscation Attributes which configure Declarative Obfuscation * Injection Attributes, further subdivided into: * Check Attributes, which tell Dotfuscator how to inject Checks * Instrumentation Attributes, which tell Dotfuscator how to inject Instrumentation features Using attributes makes it easier to see, when looking at the source code, how code elements will be affected by Dotfuscator. ```csharp string str1 = "test"; string str2 = "test"; ``` ### Obfuscation Attributes Applies to: Assembly, type, or member Requirements: 1. the Honor obfuscation attributes input option for the input assembly that contains this attribute must be enabled 2. at least one of the following must be true: Strip obfuscation attributes input option for the input assembly that contains this attribute The StripAfterObfuscation property of the attribute must be true #### Properties **Feature** : The name of the obfuscation transform to specify. all, an alias of renaming. default: an alias of renaming. renaming: Use to specify Renaming exclusions. **Exclude** **ApplyToMembers** : If annotating a type, indicates whether the attribute’s obfuscation feature should be applied to all of the type’s members and nested types. **StripAfterObfuscation** : If true, Dotfuscator will remove this attribute usage from the output assembly. > Dotfuscator will always strip all attribute usages from an input assembly, regardless of this property, when Strip obfuscation attributes setting input option is enabled, which it is by default. ### ObfuscateAssemblyAttribute **AssemblyIsPrivate** : If true, Dotfuscator will consider the assembly to be a non-library assembly, and therefore obfuscate more aggressively. If false, Dotfuscator will consider the assembly to be a library assembly, and therefore preserve the public contract of the assembly. > Defaults to false **StripAfterObfuscation** > 中文教程：