混淆与加密——.NET REACTOR的使用

创建时间：2020/9/1 16:54

ByPrin@UWA

混淆与加密——.NET REACTOR的使用
- 原理与Definitions
  - 关于.NET的CIL等
  - Anti-
    - Anti Debug
    - Anti ILDASM
    - Anti Tampering
  - 混淆与加密
    - Code Virtualization
    - Naming Convention
      - Standard
      - Incremental
      - Stealth
      - Strange
      - Unprintable Characters
    - Native EXE File
      - Pre-JIT Methods
    - Compress & Encrypt Resources
    - Control Flow Obfuscation
    - Hide Methods Calls
    - NecroBit
    - String Encryption
  - Merge & Embed
    - Embed Assemblies
    - Merge Assemblies
  - License
    - EvaluationLock
    - HardwareLock
- UI
  - The Main Menu
  - The Main Panel
    - Files
      - Additional Files
    - Settings
      - General Settings
      - Protection Settings
      - Lock Settings
      - Dialog Settings
    - License Manager
      - License File Settings
    - .NET Inspector Tab
  - The Tasks Panel
- Licensing System
- SDK
  - License.dll
  - LicenseGen.dll
  - StackTraceDeobfuscator.dll
- Tools
  - ```
      * License Examiner Tool
```
  - License Invalidation Tool
  - License Reactivation Tool
  - Stack Trace Deobfuscator
- 制作软件许可证
- 实际操作经验
- Command Line Parameters
- Ref

对一些目前有用的功能进行整理

原理与Definitions

关于.NET的CIL等

The Common Intermediate Language (CIL) is a set of instructions that are platform independent and are generated by the language-specific compiler (C#, VB.NET…) from the source code. The CIL is platform independent and can be executed on any of the Common Language Infrastructure supported environments such as the .NET runtime or Mono. The way how the CIL and other metadata is stored must follow a specific standard (ECMA-335). This way tools like .NET Reflector or ILSpy are able to read the CIL instructions and translate the code back to its source language (C#, VB.NET…).

Anti-

Anti Debug

This option will enable anti-debugger detections inside the protected assembly. In case a debugger is attached the current process will be terminated.

Anti ILDASM

suppresses decompilation using decompilation tools

Anti Tampering

prevents your protected assembly from being tampered/modified by hacker tools. At runtime your protected assembly performs several binary integrity checks.

混淆与加密

Obfuscation mangles type and member names. The obfuscation process converts a program into an equivalent one that is much more difficult to reverse engineer. The advantage of this method is that it runs on standard hardware and without any changes to virtual machines or available interpreters.

Code Virtualization

converts the CIL code into a set of randomized intructions which are intepreted at runtime by our own virtual machine. As there is no standardized procedure to correctly interprete the new instruction set the original CIL instructions can’t be reconstructed. Consequently the virtualized code can’t be translated back to its source language.

缺点： As the performance of virtualized methods is significantly decreased , code virtualization should be only applied on selected methods.

To enable code virtualization you need to decorate the corresponding methods with the following attribute:

string str1 = &quot;test&quot;;
string str2 = &quot;test&quot;;

Naming Convention

various schemes

Standard

This is the default scheme.

Incremental

If you want .NET Reactor always to generate the same obfuscation strings for your type and member names, you need to enable this option.

Stealth

Generates random meaningful names for obfuscated classes and members. This way it is less obvious which parts are obfuscated. For most cases ‘Stealth’ is the recommended option.

Strange

Uses weird and displaced characters which confuses most decompiler code views. Only enable this feature if you don’t want to use the protected assembly in a development environment(Visual Studio etc).

Unprintable Characters

Uses unprintable strings to obfuscate type and member names. Only enable this feature if you don’t want to use the protected assembly in a development environment

Native EXE File

.NET Reactor is able to generate a native x86 EXE file stub for your application. This way it is not possible to directly open your protected application in a decompiler. The decompiler recognizes your protected application as a native EXE file.

Pre-JIT Methods

In combination with the Native EXE File feature and NecroBit, .NET Reactor is able to convert managed methods into REAL x86 native code. Only methods which don’t affect the runtime and platform behavior (mostly small methods like property getters/setters…) are converted into native code.

Compress & Encrypt Resources

improve protection and assembly size

Control Flow Obfuscation

makes it extremely difficult for human eyes and decompilers to follow the program logic

Hide Methods Calls

与动态代理是一个概念？ Hide calls to external and/or internal methods. Method calls are redirected through delegates which are dynamically built at runtime. Normally it is sufficient to hide only external method calls. 示例详见<a href="https://www.eziriz.com/help/hidecalls.html?ms=AAA%3D&st=MA%3D%3D&sct=ODMy&mw=Mjc0 “>文档

NecroBit

NecroBit is a powerful protection technology which provides complete protection for your sensitive intellectual propert by replacing the CIL code within methods with encrypted code. This way it is not possible to decompile/reverse engineer your method source code.

String Encryption

String encryption makes it difficult for a hacker to understand your code and to attempt a code patch of your assembly, as he will be unable to identify the text of messages or other useful strings, making it much more difficult to identify where to patch your code. This feature has a built-in protection against assembly manipulation.

Merge & Embed

Embed Assemblies

deploy and maintain your software as you can embed all dependencies into a single efficient executable file. At runtime the embedded dependencies are directly loaded from memory and are not extracted to the hard drive.

.NET Reactor doesn’t apply any protection to the embedded assemblies. If you want to protect embedded assemblies you should merge them with the main assembly or protect them first.

Merge Assemblies

.NET Reactor takes your assemblies (Main Assembly and assemblies listed in Additional Files) and merges them into one target assembly. Merging dependencies improves the protection of your software. The merged dependencies are no longer visible to the user and as they are a real part of the main assembly they are automatically protected as well. In case the main assembly is an executable, the target assembly is still an executable with the same entry point.

3rd party libraries are often already protected and it is not recommend to merge them with the main assembly. If you have troubles merging assemblies you should embed them inside the main assembly instead.

License

EvaluationLock

if you want your protected assembly only to be used for a limited time.

HardwareLock

Enable Hardware Lock if you want to link a license file to a specific machine. The created license file is only valid on a machine with the defined hardware ID. To get the hardware ID please use the .NET Reactor SDK library License.dll.

UI

Tools Generate Command-line Switches - Generates command-line parameters based on the current project settings. Stack Trace Deobfuscator - Uses a mapping file to deobfuscate stack traces and error messages.

Protection Presets - Applies typical configuration values to your configuration. Visual Studio - Here you can install the .NET Reactor Add-in for various Visual Studio versions.

The Main Panel

Files

Additional Files

If you want to protect more than one assembly at the same time or merge/pack assemlies you need to add the corresponding assemblies to this list.

Settings

General Settings

Automatic Exception Handling ?? - If you don’t want your protected application to catch exceptions automatically, set this option to False. Compression

Dead Code Removal - As the size of your assemblies are reduced it improves performance and loading time.

Digital Certificate ??

Embed / Merge Settings Advanced Settings Emded All Assemblies?? Merge All Assemblies?? Merge Assembly Attributes??

Enable Visual Styles?? Strong Name Key Pair File?? Project Targets Mono Framework - Enable this option if your assembly targets Mono. Basically a less aggressive protection approach is used which is compatible with the Mono Framework. Target File : the path and name of that file

Protection Settings

Anti Debug - In case a debugger is attached the current process will be terminated. Anti ILDASM / Suppress Decompilation - Enable this option to suppress decompilation using decompilation tools. Anti Tampering - This option prevents your protected assembly from being tampered/modified by hacker tools. Code Virtualization?? Control Flow Obfuscation Hide Method Calls

Native EXE File NecroBit - NecroBit replaces the CIL code within methods with encrypted code. This way it is not possible to decompile/reverse engineer your method source code.

Obfuscation Create Mapping File Enabled - Set to True to obfuscate all non public class and member names. Exclusions Generate Short Strings?? Inclusions - enforce obfuscation Incremental Obfuscation?? - If you want IntelliLock always to generate the same obfuscation strings for your type and member names, you need to enable this option. Merge Namespaces?? Naming Convention - Rename方案约定 Obfuscate All Method Parameters Obfuscate Public Types Library DLL不适用(By default only non public types and members will be obfuscated. ) Pre-JIT Methods Public Types Internalization - convert all public types of an application into internal ones. Resource Encryption & Compression String Encryption - making it much more difficult to identify where to patch your code.

Strong Name Removal Protection??

Lock Settings

specify the licensing controls you want .NET Reactor to build into your assembly when you protect it.

意义：maximising your revenue stream is to ensure your full version application cannot be used without the purchase of a license.

trial versions

software rental

software as a service

Dialog Settings

.NET Reactor will display a default dialog box whenever a message is to be displayed to the user.

License Manager

allows you to distribute your assembly without a license file provided that you have set “Run without license file” to True. When your customer purchases a license, you use the License Manager to build a license file to unlock your application. Lock settings in a license file always override the inbuilt lock settings. To create a valid license file, the same master key must be used for license creation as was used to protect your application.

License File Settings

* Individual Licensing Behaviour* 与use数量有关。为True时，use数量才能叠加

the Hardware Lock allows you to create licenses which can be used only any a particular PC, based on a Hardware ID which identifies the particular combination of hardware in that PC. You can use the .NET Reactor SDK library License.dll to display the Hardware ID from within you apllication.

.NET Inspector Tab

The Tasks Panel

New Project - Creates a new project. Open Project - Opens an existing project. Save Project - Saves the open project. Select Assembly - Loads a .NET assembly for processing by the current project Protect - Processes the current project configuration into protected form. Help - Opens the help.

Licensing System

SDK

License.dll

Check if a valid license file is available Read additonal license information from a license Check the license status of Evaluation Lock Check the license status of Expiration Date Lock Check the license status of Number Of Uses Lock determine the current license status of your locked software at runtime. Check the license status of Number Of Instances Lock Check the license status of Hardware Lock …………..

LicenseGen.dll

It enables you to create license files on the fly without using the .NET Reactor GUI (License Manager). It is not intended to use this library on end user systems. Mainly it is used on license servers.

Create a License File

string str1 = &quot;test&quot;;
string str2 = &quot;test&quot;;

StackTraceDeobfuscator.dll

Using this class and a mapping file your are able to deobfuscate error messages.

string str1 = &quot;test&quot;;
string str2 = &quot;test&quot;;

Tools

License Examiner Tool

License Invalidation Tool

License Reactivation Tool

Stack Trace Deobfuscator

制作软件许可证

OPEN ASSEMBLY打开项目可执行文件(debug文件夹里面exe文件)。
选择SETTINGS选项卡，将RUN WITHOUT LICENSE FILE设为false。
选择LICENSE MANAGER选项卡，这里要注意： MASTER KEY 这就是我们的私钥，它与程序是一对一的，所以一定要保存好它，将来生成许可证时要用到，点击SAVE保存。下面的选项暂时不用管，它们主要是配置生成许可证的。
OK，点击左边的PROTECT，默认会在项目的debug文件夹添加一个文件夹，其中生成一个exe文件。这个路径可以通过SETTINGS TARGET FILE进行更换。
到此点击生成的EXE文件，会有许可验证了。那么我们发布时就用这个EXE文件，而不是原来debug里面的EXE文件。
获取用户机器ID（公钥）。
通过TOOLS Hardware id tool generator 能够取得机器ID生成器（HID.exe）
运行它可得到一个记录着机器ID的TXT文件（hardwareID.txt）。
制作许可证
选择LICENSE MANAGER选项卡，MASTER KEY OPEN打开们上面保存好的私钥。
展开LICENSE FILE SETTINGS LOCK – HARDWARE LOCK，点击HARDWARE ID导入公钥。
其它设置默认就行了。
点击CREATE LICENSE生成许可证书，将其放在可执行文件EXE同级目录，运行程序。这样用户就获得了使用权。

实际操作经验

Protect Unity Editor中使用的DLL时，不能开启Anti ILDASM，否则，Unity加载该程序集的时候会闪退。 Unity加载DLL的时候，可能会进行与ILDASM相同的操作，而被保护的程序，会在检测到这种操作时造成闪退。

Command Line Parameters

https://www.eziriz.com/help/command_line.html?ms=AAA%3D&st=MA%3D%3D&sct=MTMzMg%3D%3D&mw=Mjc0

Ref

https://blog.csdn.net/Sayesan/article/details/80366022