是否可以防止 .NET MSIL DLL 的反编译？
几乎所有 .net 程序集都可以使用 Reflection 进行反编译。这意味着所有 . NET 产品是开源的，因为代码可以很容易地被其他开发人员使用。 有没有一种方法可以让我们对代码进行加密（至少对于某些安全逻辑），以便它不会被轻易破解或滥用。
编辑
老问题winforms .net真的等于开源吗？已根据有关正确使用开源一词的评论进行了编辑
Almost all the .net assemblies can be de-compiled using Reflection .Which means that all .net products are open source since the code can be easily be used by other developers.
Isnt there a way so that we can encrypt the codes (at least for some security logic) so that it cannot be easily cracked or misused.
Edit
Old question Is winforms .net really equal to open source? was edited considering comments regarding proper use of the word Open Source
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
有些工具可以加密 .NET 程序集，防止使用 Reflector 和类似工具进行反编译。它们还执行许多相关服务，例如模糊处理、嵌入式资源保护等。我知道其中两个：
RemoteSoft Salamander 套件
XHEO DeployLX
There are tools that can encrypt .NET Assemblies, preventing decompilation with Reflector and similar tools. They also perform a number of related services such as obfuscation, protection of embedded resources, etc. Two I know of:
RemoteSoft Salamander Suite
XHEO DeployLX
否
所有代码都可以进行逆向工程、复制、克隆、重用、重新链接等。 开源的意思是它在法律意义上不受限制，因此人们可以从代码中学习。这也意味着技术可以发展，并且可以创造更强大的长期科技经济，而不是短期主义。阅读“大教堂和集市”以获得有偏见但相关的观点。
我不知道有足够强大的代码保护方法，它不仅仅是高度混淆，而且只是通过模糊实现安全性。仅就您的问题而言，您需要通过阅读和研究问题意图的技术、逻辑和可能哲学品质来更多地了解您所询问的主题。
No
All code can be reverse engineered, copied, cloned, reused, relinked and other things. What open source means is that it is free in the legal sense from restrictions, so people can learn from the code. This also means technology can grow and a stronger long-term tech economy can be created, rather than short-termism. Read the "Cathedral and the Bazaar" for a biased but relevant point of view.
I am not aware of a sufficiently strong code protection method that isn't just high obfuscation and is only security through obscurity. Your question alone says you need to know more about the topic you are asking about by reading and researching the technical, logical and possibly the philosophical qualities of the question's intent.
其他人已经接触过代码混淆器，但问问自己您真正想要实现的目标是什么：
您是否想让您的代码更加“安全”？通过隐藏来实现安全不仅是一个相对较弱的策略，而且无论如何您都不应该将敏感数据放入源代码中！将密码、连接字符串等从代码中移出并移至配置文件中。
据推测，只要没有人能够访问您的物理计算机，应用程序就是安全的。您可以假设，如果攻击者拥有物理机器，那么所有希望都消失了。
您是否试图保护专有算法？如果您不想花钱获得专利，那么最好的、最有效的策略就是通过您控制的服务器上的 Web 服务公开您的 API。该应用程序调用网络服务 - 这意味着性能会下降，并且您依赖于具有互联网连接的用户，但至少您的代码是绝对安全的。
您是否试图阻止用户盗版软件？ SO 上有关于许可密钥系统的很多帖子。
Other people have touched on code obfuscators, but ask yourself what you're really trying to accomplish:
Are you trying to make your code more "secure"? Not only is security through obscurity a relatively weak strategy, you shouldn't be putting sensitive data in source code anyway! Move passwords, connection strings, etc out of code and into a config file.
Presumably, then, the application is secure so long as no one has access to your physical machine. You can assume if the attacker has the physical machine, all hope is gone anyway.
Are you trying to protect proprietary algorithms? If you don't want to shell out the money to get a patent, then the best tried and true strategy would be exposing your API through a web service on servers you control. The app makes a call into the web service -- meaning performance degrades and you have a dependency on your users having an internet connection, but at least your code is absolutely secure.
Are you trying to prevent users from pirating software? There are lots of posts on SO regarding licensing key systems.
任何事物都可以进行逆向工程。虽然 .NET 程序集可以更轻松地反编译，但有 许多混淆器可用于使代码更难理解。
没有任何好的方法来加密您发送给客户的代码。在某些时候，代码必须解密才能运行，这意味着客户端计算机必须有能力执行此操作。如果客户端计算机有能力解密代码，那么有权访问该计算机的其他人也能解密。
这个问题并非 .NET 程序集所独有 - 任何应用程序都容易受到反编译的影响。如果原始来源的安全性是您主要关心的问题，那么基于 Web 的应用程序（如网站或 Web 服务）可能会更好，因为您能够将程序集与外界隔离。
Anything can be reverse-engineered. While .NET assemblies can be more easily decompiled there are many obfuscators available to make the code harder to understand.
There isn't any good way to encrypt the code that you are shipping to customers. At some point the code must be decrypted in order to run and that means that the client machine must have the ability to do this. If the client machine has the ability to decrypt the code then so does anyone else who has access to the machine.
This problem is not unique to .NET assemblies - any application is susceptible to decompilation. If the security of the original source is your main concern then perhaps a web-based application (like a website or web service) would be better as you would be able to isolate the assemblies from the outside world.
默默无闻永远无法帮助你......
你的反编译代码可能有也可能没有有用的变量/类名，它肯定不会有注释，当然版权仍然属于你。
因此，从法律上讲，您无论如何都不能使用反编译的程序（甚至不能反编译它们），并且我确信有一些选项（如果默认情况下未启用）可以用于基本模糊性，例如使用 var1...9999 作为变量名称和类名。
Obscurity can never help you forever...
Your code that is decompiled may or may not have useful variable/class names and it definitely won't have comments, and of course the copyright still belongs to you.
So legally you can't use decompiled programs in anyway(or even decompile them) and I'm sure there is some option(if not on by default) you can use for basic obscurity such as using var1...9999 as the variable names and class names.
如果需要开源，请尝试 mono 框架。尽管其中有一部分尚未由微软作为公共语言基础设施 CLI 的一部分发布。如果您回答“否”，则您不能在任何地方使用或重复使用/发布整个部分的一部分。您还可以查看 转子 共享源通用语言基础设施 2.0，它是开源的，由微软管理，但它不包含 Windows 表单命名空间，仅包含 CLI。仅供学习和研究之用。 Microsoft 还在 codeplex 上发布了 MPL 代码。请仔细阅读许可证，即使是开源软件，GPL 和 LGPL 之间也有区别。用于学习目的的逆向工程我认为可以，例如，如果出现一些不在您的代码中的问题，您可能想对其进行调试。为此，微软允许直接从其符号服务器使用它的框架源。您可以配置 Visual Studio 来下载任何 .NET 框架的源代码和符号，并对其进行调试以了解框架代码中发生的情况和情况。这是一篇非常好的文章，如何做到这一点，位于 肖恩·伯克博客。
If need opensource try mono framework. Although a part of it has portion that has not been publish by microsoft as part of Common language Infrastructure CLI. For you answer NO you cannot use or reuse/publish part of as whole anywhere. You can also look at rotor Shared Source Common Language Infrastructure 2.0 which is open souce and managed by microsoft but it does not contain Window form namespace just CLI. It for learning and research purpose only. Microsoft also publish it code under MPL at codeplex. Please read license carefully even for opensource there is difference between GPL and LGPL too. Reverse engineering for learning purpose it i think ok in case e.g some issue comeup that is not in you code you might like to debug it. For that purpose microsoft have allow use of it framework source directly from its symbol server. Youc an configure visual studio to download source and symbol:t for any .NET framework and debug it to so how and what happen in framework code. Here is a very good article how to do that at shawn burke blog.