.NET 中的序列化和混淆
我有一个二进制文件，我想对其进行混淆并分发给用户。假设我使用二进制文件的未混淆版本来使用现成的 .NET 二进制格式化程序来序列化数据。然后我们可以用混淆的二进制文件反序列化数据吗？
我想分发混淆的二进制文件和序列化数据。如果上述问题的答案是肯定的，我可以在用户之间共享序列化数据。否则，我将不得不向每个用户提供单独的序列化数据。
I have a binary that I want to obfuscate and hand out to users. Let us assume I use an unobfuscated version of my binary to serialize data using the off-the-shelf .NET binary formatter. Could we then deserialize the data with the obfuscated binary?
I want to hand out obfuscated binaries along with serialized data. If the answer to the question above is yes, I could share the serialized data among the users. Otherwise, I would have to provide individual serialized data to each user.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
混淆的二进制数据和序列化数据之间似乎存在混淆。如果您使用默认序列化器序列化您的类，则类名称和属性/字段值将用作该序列化数据中的字符串 - 因此，如果您混淆二进制文件，则使用该二进制文件的序列化数据将具有混淆的名称和非混淆名称。如果执行以下任一操作，模糊二进制文件将无法读取由模糊二进制文件创建的序列化数据：
以下是一些选项解决这个问题：
我已经有一段时间没有使用它了（所以你需要验证它在你的情况下是否有效），但是如果你使用二进制格式化程序，那么你可以控制数据如何存储在序列化中通过提供处理 SerializationInfo 和 StreamingContext 的构造函数来创建文件。如果您通过谷歌搜索示例，您应该会找到一个（这是我找到的一个：将对象序列化到文件）。您可能找不到很多关于使用此方法的新文章，因为大多数人觉得它不是很有趣，但是它确实是指定类如何使用二进制格式化程序保存自身和重新填充自身的最简单方法。
在您必须实现的构造函数中，您使用键/值对的字符串来进行序列化 - 在混淆中，这些字符串可能会被加密（这是可以的），并且属性设置语句将被重命名并与您的混淆类/成员名称 - 因此它应该适用于混淆和非混淆程序集。
另一个选项可以从混淆中排除您正在序列化的类，并且只加密数据文件。
There seems to be a confusion between the obfuscated binary and serialized data. If you serialize your class using default serializers, then the class name and property/field values are used as strings in that serialized data - so if you obfuscate your binary, then the serialized data using that binary will have the obfuscated names and your non-obfuscated binary will not be able to read the serialized data created by your obfuscated binary if you do any of the following:
Here are some options to work around this:
I have not used this for awhile, (so you'll want to verify it works in your situation) but if you are using the binary formatter, then you can control how the data is stored in the serialized file by providing constructors that handle the SerializationInfo and StreamingContext. If you google around for a sample you should find one (here is one I found: Serialize Objects to File). You may not find a lot of new articles out there on using this method since most people don't find it very interesting, however it really is the easiest way to specify how your class saves itself and repopulates itself using the binary formatter.
In the constructor you have to implement, you use strings for key/value pairs to get serialized - in obfuscation those string will probably get encrypted (which is OK), and the property setting statement will get renamed and stay in sync with your obfuscated class/member names - so it should work for both obfuscated and non obfuscated assemblies.
Another option in to exclude the class you are serializing from the obfuscation and just encrypt the data file.
看错问题了。当二进制文件被混淆时，当类名/命名空间发生更改等时，您需要小心。这不仅会在混淆/非混淆的二进制文件之间中断，而且通常也会在不同版本之间中断。
该产品显然不包括标记为： http://www.ssware.com/cryptoobfuscator /obfuscator-net.htm （这不是推荐，我从未使用过 - 您必须对其进行测试，看看成本是否值得）。
除此之外，您可以根据要序列化的数据量编写自定义序列化器。
[原始答案]
为什么要混淆数据？我只能想象这是为了阻止某人编辑它或阻止某人阅读内容。
如果是为了防止某人编辑它，那么我可以建议您包含数据的哈希值，然后不要费心去混淆它。
如果是为了防止有人阅读它，那么我建议您在数据序列化后对其进行加密。
两者都有很多例子，但如果您想要一个例子，请告诉我。
Misread the question. When the binary is obfuscated you need to be careful when class names/namespaces get changed etc. This will break not only between obfuscated/non-obfuscated binaries, but also between different versions generally.
This product apparently excludes classes that are marked as: http://www.ssware.com/cryptoobfuscator/obfuscator-net.htm (This is not a recommendation, I have never used - you will have to test it and see if the cost is worth it).
Apart from that you could write a custom serializer depending on how much data you are serializing.
[Original Answer]
Why are you obfuscating the data? I can only imagine it's to prevent someone for editing it or to prevent someone from reading the content.
If it's to prevent someone from editing it then can I suggest you include a hash of the data, and then don't bother obfuscating it.
If it's to prevent someone from reading it then I suggest you encrypt the data instead after it's been serialised.
There are plenty of examples of both but if you would like an example let me know.
您是否尝试过使用EazFuscator？它允许一些自定义重命名方案，以便您在某些情况下保留确切的名称，例如外部方法。但它并未与最新版本的 .NET 4.0+ 或 WCF 保持同步。
您还可以使用 .NET Reactor，这是另一种混淆器服务，其功能远远超出了 EazFuscator 和 Dotfuscator，但它确实有成本。
.NET Reactor 还允许代码加密，而不是混淆，正如之前所建议的，这将解决问题。
Have you tried using EazFuscator? It allows for some custom renaming scheme's to allow you to preserve exact names in certain cases, for instance, external methods. It's not up to date with the newest versions of .NET 4.0+ or WCF though.
You could also use .NET Reactor, another obfuscator service that goes well beyond both EazFuscator and Dotfuscator in capabilities, but it does have a cost.
.NET Reactor also allows code encryption, instead of obfuscation, which as previously suggested will solve the problem.