Hiding a private field from reflection in .net

Question

I have a class that performs some sensitive I/O operations across an entire disk volume. By sensitive I mean if the operation goes wrong, it can potentially corrupt the target volume.

During some post-release testing, I found that the process can be corrupted using reflection to manipulate private fields. The class is not sealed by design so that consumers of the library can create derivatives.

Is there a way to secure private members to prevent modification via reflection (from derived or consumer code)?

UPDATE: I found a comment from Hans Passant to an old question mentioning [ReflectionPermission]. Looking into that now.

@Arran: Of course not. My question is about whether the CLR provides a safety mechanisms to prevent access to marked private members. — Raheel Khan, Mar 10 '14 at 16:29
If your customers want to corrupt their volumes, they have easier ways to do that than hacking your software. — Anton Tykhyy, Mar 10 '14 at 18:21

score 7 · Answer 1 · answered Mar 10 '14 at 16:29

There is no way to hide your field from Reflection. It can be used to access and manipulate any field on a type. There are steps you can take like obfuscation which make it harder to identify fields and in turn harder to change via Reflection. This is only a speed bump though. A determined developer can use Reflection to beat any work arounds you have

score 4 · Answer 2 · answered Mar 10 '14 at 16:28

4

Short Answer: No.

You cannot stop people from messing with your program if they have the privileges.

answered Mar 10 '14 at 16:28

nvoigt

75,013
26
93
142

score 3 · Answer 3 · edited May 23 '17 at 12:06

3

I believe your best effort is going to be in obfuscating the code. Otherwise, you cannot stop someone from using reflection to mar things up a bit.

There is this post which may give you some idea on how you want to proceed.

edited May 23 '17 at 12:06

Community

1
1

answered Mar 10 '14 at 16:29

IAbstract

19,551
15
98
146

score 2 · Answer 4 · answered Mar 10 '14 at 16:29

2

Private is just private to developers consuming your class. You cannot prevent its access via reflection.

answered Mar 10 '14 at 16:29

Habib

219,104
29
407
436

Hiding a private field from reflection in .net

4 Answers4