SmartAssembly skipping obfuscation

Question

I was experimenting with SmartAssembly obfuscation tool on a compiled website. It works on most of the code but any class in App_Code is not being obfuscated. e.g. I have following class in App_Code

public class Helper
{
    public Helper()
    {
    }

    public static String GetData()
    {
        String text = DateTime.Now.ToString();
        return text;
    }

    ---Other methods----
}

This Helper class is skipped. It does not do name mangling on Helper class and its methods. Can anybody using SmartAssembly help in this regard? Are there some other cost effective tools (free or paid) better than SmartAssembly.

score 10 · Accepted Answer · answered Jul 29 '11 at 16:28

10

Disclaimer: I work for RedGate on SmartAssembly *

SA (SmartAssembly) automatically excludes public members in DLLs from obfuscation and pruning, because it assumes they will be used externally. You can override this behaviour by editing the saproj file to make the obfuscation line look like:

<Obfuscation ExcludePublicMembers="0" Obfuscate="1">

This will obfuscate all members, regardless of their public status.

This may cause problems because IIS may use reflection to look for specific public members with specific names. In this case, you will need to exclude those items from pruning/obfuscation.

As for obfuscation tools, SmartAssembly is quite a powerful obfuscator (hackers agree!), and has a lot of extras in it (error-reporting, feature-usage reporting etc). But, of course, there are a number out there beyond SmartAssembly, e.g. Dotfuscator or Deep Sea Obfuscator. Some are rather good, some are very bad.

If you've got any more problems, come ask us at: http://www.red-gate.com/products/dotnet-development/smartassembly/support

answered Jul 29 '11 at 16:28

Jason Crease

1,896
17
17

1

Thanks. I need to have full control which one to obfuscate or not. For example I can turn ON for all public members but exclude those which has [WebMethod()] attribute applied. Is it possible? – kumar Jul 29 '11 at 18:53
1

I tried using the settings . it did not work. test my example. Put the code in Classlibrary, build it, change the saproj but it still cannot obfuscate. Another thing is that it always override my saproj file. There must be a way to control the settings in UI. I tried Crypto Obfuscator and it seems much better both in obfuscating and price also. – kumar Jul 29 '11 at 19:21
1

I should have said: make sure it's under the relevant node, e.g.: – Jason Crease Aug 01 '11 at 15:59
I'm afraid that we don't automatically exclude [WebMethod] methods from the ExcludePublicMembers override. But you can exclude them using the obfuscation exclusion in the UI. Anything further, please email support@red-gate.com and we'll be happy to help. – Jason Crease Aug 01 '11 at 16:04
1

I tried ExcludePublicMembers="0" Obfuscate="1" under merging node. It did not work. Anyway thanks for your time. – kumar Aug 02 '11 at 18:21
Ignore my previous comment, I tried ExcludePublicMembers="0" Obfuscate="1" under merging node. It seems to work but involves significant labour if no. of files are large. Thanks – kumar Aug 02 '11 at 18:30

score 2 · Answer 2 · edited Jul 02 '14 at 16:05

2

public methods do not get obfuscated by default (in DLLs- they do in exes). You can force obfuscation but you need to use code decorations. More details can be found here.

edited Jul 02 '14 at 16:05

hichris123

10,145
15
56
70

answered Jul 29 '11 at 16:20

user741944

41
2

SmartAssembly skipping obfuscation

2 Answers2