检查 C# 代码混淆的效率
我正在评估几个用于保护 WPF 应用程序中的代码的混淆器。
为了检查给定程序集上每个混淆器完成的工作结果，我使用 Red Gate 的 .Net Reflector。每次混淆之后，我都会使用 .NET Reflector 打开程序集，看看它是什么样子。
是否足够？ .NET Reflector 的结果是否可以被视为混淆质量的指标，或者我应该尝试一些其他工具？ （不是任何可能的此类工具，而是从实际常识的角度来看）。
I'm evaluating several obfuscators for protecting code in a WPF application.
For checking results of job done by each obfuscator on a given assembly I use Red Gate's .Net Reflector. Just after each obfuscation I open the assembly with .NET Reflector and see what it looks like.
Is it enough? Can .NET Reflector's results be treated as an indicator of quality of obfuscation, or should I try some additional tools? (not any possible instrument of such a kind, but from a point of view of practical common sense).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Reflector 的结果应该足以表明任何随意的反编译尝试的结果如何。某些混淆器会将代码混淆到程序集甚至无法在 Reflector 中打开的程度。
任何愿意尝试比这更深入的人都不会轻易被比其他人更高级的混淆所吓倒。
The results from Reflector should be enough on an indication of how any casual attempt at decompiling would fare. Some obfuscatory will obfuscate code to the extent that the assembly will not even open in Reflector.
Anyone who would try any deeper than that will not be easily deterred by more advanced obfuscation than others.
如果 Reflector 和 ILSpy 完全拒绝反编译生成的程序集，那就最好了。我知道存在能够做到这一点的混淆器。
It would be best, if Reflector and ILSpy would outright refuse to decompile the resulting assembly. I know that there exist obfuscators that are capable of that.
我的观点是：“是否足够”取决于您的目标应用程序。混淆从来都不是 100% 安全的代码，它总是让潜在攻击者的代码反汇编变得足够困难，但这一切都取决于“潜在攻击者”会花多少精力来反汇编您的应用程序。而且 .NET Reflector 是一个查看器，就像您提到的那样，因此无论它是否安全，都可以通过查看来推断您，例如：
字符串是否加密
，参数是否加密
，类名和字段是否 加密像（PWD_USER）一样被加密
...
问候。
My opinion is: that "is it enough" or not depends on your target app. Obfuscation is never about 100% secure code, it's always to make the code deassembly difficult enough for potential attacker, but it all depends on how much that "potential attacker" will put effort to deassembly your app. And also .NET Reflector is a viewer, like you mantioned, so if it's ecure or not can deduct you, by looking on, for example:
if strings are encrypted
if parameters are encrypted
if class names and fields like (PWD_USER) are encrypted
...
Regards.