Visual Studio Obfuscation

We’ve started to use SmartAssembly to obfuscate the code for some of the SharePoint products that we’ve been working on, and I’d had a few problems with it.

SmartAssembly’s manual describes how to include the SmartAssembly project file (.saproj) into your build process. This is basically simple:

Hello Satal, Thanks for your post. You could try PreEmptive Solutions’ Dotfuscator which is the leading.NET Obfuscator, Compactor and Watermarker that helps protect programs against reverse engineering while making them smaller and more efficient. Obfuscation can complicate debugging, patch generation and management, distributed development practices and the reuse of libraries, components and Web services. These challenges can be mitigated. Tight integration with development platforms (such as Visual Studio), the inclusion of tools and utilities that can unwind and/or reuse obfuscation. CSharp Obfuscator protects your.NET application code through obfuscation transforms, while maintaining debugging abilities for quality assurance testing. It can be seamlessly integrated with the existing development cycle. Symbol files are.pdb files for Visual Studio applications that show how the compiler converted source code into machine code. They contain mappings from CIL elements and method body offsets to the original source code files. These symbol files are required to use a debugger on the assembly. Extension for Visual Studio -.NET Obfuscator is an in-app protection tool that protects your brand, improves compliance and hinders attacks against your.NET, Xamarin, UWP,.NET Core, and.NET 5 apps. Our obfuscator secures.NET apps for thousands of companies providing both passive and active protection.

Add the .saproj file to your Visual Studio Project
Right click on your project within Solution Explorer and select ‘Unload Project’
Right click on your project within Solution Explorer and select ‘Edit projectname.csproj’
Scroll down to the bottom of the file – we now need to add some additional lines to the file to tigger obfuscation during the build process.
Add the following lines to the bottom of the file, just before </Project>. You will need to modify the .saproj filename accordingly:

This is what worked for my colleagues – but not for my projects. I kept receiving an error:

SmartAssembly build failed: The system cannot find the file specified (Exception from HRESULT: 0x80070002)

There wasn’t much clue what that meant. Looking on the Redgate forums, it seems like I wasn’t the first person with this issue. The suggestion seemed to be to run from the command line, rather than using Redgate’s MSBuild task. That seems a shame, but I tried it:

This seemed to work nicely. I know that the command has a fixed path in it, but this command should only be run on the build server (hence the bit about $(BuildingInsideVisualStudio) ). More on why I did that in my next post.

A string obfuscation system that integrates in a Visual Studio C++ solution

Michael Haephrati, CodeProject MVP 2013

Introduction

The purpose of obfuscators in general is to hide program code, flow, and functionality. If your program uses an algorithm that is a trade secret, obfuscation will make it harder to reverse engineer it and reveal this trade secret. But what about hiding the data inside the executable? Some people say that is almost impossible to achieve. Since the problem needs to be able to read this data, the data must be there, and if it is there, it can be revealed eventually. In my opinion, a well obfuscated program, can make it next to impossible to guess where the data is kept (encrypted), and even if the data is found, to obfuscate it using strong encryption.

The Solution

The set of tools I will introduce in this article, were developed for the purpose of encrypting strings within applications.

Usually, an application can reveal a great deal of information about itself, even without having to reverse engineer it. When you open an application such as Calc.exe from a Hex editor (or from Notepad as a text editor), you can find strings like:

An example of strings that create a risk if kept non encrypted, is passwords. If your software connects to an Internet service, SMS gateway or a FTP server, and send a password, this password will be visible to anyone who opens the executable of your application with any textual editor.

Background

I have read Chris Losinger's excellent article and wanted to take it to the next level by creating a stronger encryption (AES-256) and to support more variations and string types, including UNICODE, double and single byte strings.

The purpose of this tool is professional use, and not just being a proof of concept.

The Source Code

The encryption / decryption mechanism integrate as two separate projects which need to be added to your Visual Studio solution. The two projects are in the main folder:

a. The obfisider project.
b. The obfuscase project.

The Obfisider and the Obfuscate Projects

The Obfisider project contains the AES encryption part. The Obfuscate project contains the necessary parts to scan a solution, and each project it contains, and to encrypt the strings found.

Scanning a Solution

Solutions are scanned using parseSolution which calls another function named parseProject .

The parseProject function extract the relevant files from a given project. Relevant files means : .c, .cpp, .h and .hpp files.

The AES_Encode function

This function handles the encryption of the strings using AES-256:

The AES_Decode function

This function handles the decryption of the strings back:

Decoding the strings back

ASCII strings are decoded using the following function ( __ODA__ ):

When the string is UNICODE, the following function (__ODC__) is used:

How to use

Set project dependencies so the main executable or DLL your solution is generating depends on the 'obfinsider' project.

The 'obfinsider' project must depend on the other project – the 'obfuscate' project. This will automatically include obfinsider.lib, but in case you make changes that break this dependency, please add obfisider.lib manually.

How it works

The Process

'obfuscate' is built first and after build is completed, a Post Build event takes place. The Post Build event calls obfuscate along with the entire solution file as its parameter.

The Files Scan

Obfuscate scans the given solution and works on each relevant file in it. The current version requires that no spaces will exist in this path, and if there are spaces, the proper way 'obfuscate' should be called would be:

'$(TargetPath)''$(SolutionPath)'

'obfuscate' scans the solution for all project files, but process the following file types: .c, .cpp, .h and .hpp.

The Work
Per each file, the following checks are made:
a. Obfuscated files are skipped

b.'obfuscate' doesn't process itself, so its own files are skipped.

c. Comments are skipped. This includes:

// this is a comment

and

/* this a another comment */

d.#include and #pragma declarations are skipped.

e.Initialized global strings are ignored. If you look at the following example:

Static char c[]='test string';

f. For all other strings, 'obfuscate' looks for the original declaration and replaces it with a calls to the decryption function, along with the encrypted string as its parameter.

For easy maintenance, the original line is preserves as kept as a commented line above the new line.

ASCII vs. Unicode

The system distinguishes between ASCII and Unicode text. Two separate sets of functions are used per each type.

The following statement:
wcscpy(mystring, 'my text');

wcscpy(mystring, _T('my text'));

will be detected as Unicode type and will be replaced with a call to __ODC__ while similar ASCII statements:

strcpy(mystring, 'my text');

will be detected as such as will be replaced with a call to __ODA__.

Encryption and Encoding Scheme

1. Each string is encrypted separately with an ad-hoc generated encryption key.

2. This key is generated randomly, while the SEED value for the random number generated is set at the start of the application.

3. All strings are padded with NULL characters to round them so their length match an entire number of encryption blocked, which are required by the AES-256 encryption scheme.

4. The result, is in a binary form, and is represented as a printable set of characters using the following algorithm:

Each byte is split by half. Higher half is encoded first and then the 2nd half. For example: 0xAF is split into: 0xA and 0xF.
The encoded value is the Delta between the preview value and the new value (initial value is 'A').

For example: value 0x3 is set as a result of shifting from character 'A' and 'D' (0x40+0x30x43).

5. When the shifted value reaches 0x7E, the initial value of 'A' is subtracted from this value.

For example: if Last value was 'z' (code 0x7A) and encoded value is 0xF, then the new value will be encoded as character '+' ( code 0x2B 0x7A + 0xF - (0x7E-0x20) )

Example

The following statement:

wprintf(L'This is a testn' );

will be replaced with the following lines:

Limitations

It is impossible to cover all variations in which strings may appear in a C / C++ project, even though I have done my best to cover most of them. Since one can initialize a one-dimensional character array by specifying:

A brace-enclosed comma-separated list of constants, each of which can be contained in a character
A string constant (braces surrounding the constant are optional)

Visual Studio Obfuscation Download

For example:
staticchar a[]='some_string';

When the size of the array is not set, it is impossible to encrypt the predefined contents as the real size isn't know at the time of compilation.

Another example where such system will not be able to encrypt is referred to as 'Hidden Merging':

License

This article, along with any associated source code and files, is licensed under The Common Development and Distribution License (CDDL)

About the Author

Michael N. Haephrati, is an entrepreneur, inventor and a musician. Haephrati worked on many ventures starting from HarmonySoft, designing Rashumon, the first Graphical Multi-lingual word processor for Amiga computer. During 1995-1996 he worked as a Contractor with Apple at Cupertino. Worked at a research institute made the fist steps developing the credit scoring field in Israel. He founded Target Scoring and developed a credit scoring system named ThiS, based on geographical statistical data, participating VISA CAL, Isracard, Bank Leumi and Bank Discount (Target Scoring, being the VP Business Development of a large Israeli institute).
During 2000, he founded Target Eye, and developed the first remote PC surveillance and monitoring system, named Target Eye.

Microsoft Visual Studio Download

Configuring Visual Studio For Obfuscation

Other ventures included: Data Cleansing (as part of the DataTune system which was implemented in many organizations.
Follow on Twitter, Google, LinkedIn
Article Top

Paintfox797