--- title: "混淆与加密——.NET REACTOR的使用" author: "Perrin Yong" author_profile: https://www.pystone.net/profile/ published_by: "Perrin Yong" canonical: https://www.pystone.net/notes/dotnet-obfuscation-net-reactor/ type: note content_role: unspecified visibility: public id_stability: rename-stable source_path: "10-计算机、信息技术与工程/02-编程语言与运行时/.NET与CSharp/混淆与加密——.NET REACTOR的使用.md" content_hash: b487db95c7c9b5127be403592d05428df5ce553566f4fb22ae21ec03f3410e28 knowledge_version: 224c990773de.5fa8af6e39fa site_commit: 224c990773de166d23a886306577dd90379529ce notes_commit: 5fa8af6e39fa3891d1b9b4832bfa6c4e0ecaaf0a --- # 混淆与加密——.NET REACTOR的使用 > 创建时间：2020/9/1 16:54 ByPrin@UWA * 混淆与加密——.NET REACTOR的使用 * 原理与Definitions * 关于.NET的CIL等 * Anti- * Anti Debug * Anti ILDASM * Anti Tampering * 混淆与加密 * Code Virtualization * Naming Convention * Standard * Incremental * Stealth * Strange * Unprintable Characters * Native EXE File * Pre-JIT Methods * Compress & Encrypt Resources * Control Flow Obfuscation * Hide Methods Calls * NecroBit * String Encryption * Merge & Embed * Embed Assemblies * Merge Assemblies * License * EvaluationLock * HardwareLock * UI * The Main Menu * The Main Panel * Files * Additional Files * Settings * General Settings * Protection Settings * Lock Settings * Dialog Settings * License Manager * License File Settings * .NET Inspector Tab * The Tasks Panel * Licensing System * SDK * License.dll * LicenseGen.dll * StackTraceDeobfuscator.dll * Tools * * License Examiner Tool * License Invalidation Tool * License Reactivation Tool * Stack Trace Deobfuscator * 制作软件许可证 * 实际操作经验 * Command Line Parameters * Ref 对一些目前有用的功能进行整理 ## 原理与Definitions ### 关于.NET的CIL等 The Common Intermediate Language (CIL) is **a set of instructions that are platform independent** and are **generated by the language-specific compiler** (C#, VB.NET…) from the source code. The CIL is platform independent and can be executed on any of the **Common Language Infrastructure supported environments** such as the **.NET runtime** or **Mono**. The way how the CIL and other metadata is stored must follow a specific standard (ECMA-335). This way tools like .NET Reflector or ILSpy are able to read the CIL instructions and translate the code back to its source language (C#, VB.NET…). ### Anti- #### Anti Debug This option will enable **anti-debugger detections** inside the protected assembly. In case a debugger is attached the current process will be **terminated**. #### Anti ILDASM suppresses decompilation using decompilation tools #### Anti Tampering prevents your protected assembly from being tampered/modified by hacker tools. At runtime your protected assembly performs several binary integrity checks. ### 混淆与加密 > Obfuscation mangles type and member names. The obfuscation process converts a program into an equivalent one that is much more difficult to reverse engineer. The advantage of this method is that it runs on standard hardware and without any changes to virtual machines or available interpreters. #### Code Virtualization converts the CIL code into a set of **randomized intructions** which are **intepreted at runtime** by our own virtual machine. As there is no standardized procedure to correctly interprete the new instruction set the original CIL instructions can’t be reconstructed. Consequently the virtualized code **can’t be translated back to its source language**. 缺点： As the **performance** of virtualized methods is **significantly decreased** , code virtualization should be only applied on selected methods. To enable code virtualization you need to decorate the corresponding methods with the following attribute: ```csharp string str1 = "test"; string str2 = "test"; ``` #### Naming Convention various schemes ##### Standard This is the default scheme. ##### Incremental If you want .NET Reactor always to generate the same obfuscation strings for your type and member names, you need to enable this option. ##### Stealth Generates random meaningful names for obfuscated classes and members. This way it is less obvious which parts are obfuscated. For most cases ‘Stealth’ is the recommended option. ##### Strange Uses weird and displaced characters which confuses most decompiler code views. Only enable this feature if you don’t want to use the protected assembly in a development environment(Visual Studio etc). ##### Unprintable Characters Uses unprintable strings to obfuscate type and member names. Only enable this feature if you don’t want to use the protected assembly in a development environment #### Native EXE File .NET Reactor is able to generate a native x86 EXE file stub for your application. This way it is not possible to directly open your protected application in a decompiler. The decompiler recognizes your protected application as a native EXE file. ##### Pre-JIT Methods In combination with the Native EXE File feature and NecroBit, .NET Reactor is able to convert managed methods into REAL x86 native code. Only methods which don’t affect the runtime and platform behavior (mostly small methods like property getters/setters…) are converted into native code. #### Compress & Encrypt Resources improve protection and assembly size #### Control Flow Obfuscation makes it extremely difficult for human eyes and decompilers to follow the program logic #### Hide Methods Calls 与动态代理是一个概念？ Hide calls to external and/or internal methods. Method calls are redirected through delegates which are dynamically built at runtime. Normally it is sufficient to hide only external method calls. 示例详见