🔒 Locked

How secure is compiled C# code?

Started by Cebu Apr 23, 2003 at 8:28 PM 7 replies 650+ views

Original Post

Apr 23, 2003 at 8:28 PM

I did a search on this subject with both google and these forums but could not find an answer. Basically, I am deciding between C# and C++ to write a simple game. There are plenty of other factors that go into this decision, but for the purposes of this thread, I just want to address one factor: how hard will it be for people to "hack" compiled C# code? Yes, all code is hackable in one way or another (given enough time). However, it can be made much easier to be hacked with different scenarios. What I mean in this scenario is how easy is it for people to get source code out of compiled C# code? As an example, I know Java bytecode is extremely easy to reverse engineer. There are little programs that will take Java bytecode and give you the source code for that program exactly as it was written (minus the formatting). The best you can do with compiled C++ code is assembly. It would take a rather knowledgeable person to do much with a large amount of assembly. As such, the potential field of people messing with your code is much smaller. Since the C# managed code isn''t compiled into native code until it is run on the client''s machine, there is some intermediate code in there (I don''t know what it is officially called). Is this intermediate code going to be as easy to convert into source code as Java bytecode is? I hope this wasn''t too spammy. I am just trying to be as clear as possible on my question.

CoffeeMug

147

CoffeeMug

Apr 23, 2003 at 8:34 PM

If you''re THAT worried about decompilation of your code you can use ngen utility to precompile it and ship native code instead of IL.

Arild Fines

138

Arild Fines

Apr 23, 2003 at 8:42 PM

quote:
Original post by CoffeeMug
If you''re THAT worried about decompilation of your code you can use ngen utility to precompile it and ship native code instead of IL.

Wont help one damn bit - even if you ngen it, you still need the original assemblies present. ngen''ed images don''t contain any metadata, which is essential to the operation of the managed environment.

The way to go is to use an obfuscator. There are several available(some for free), and I believe VS.NET 2003 ships with one(Can someone confirm this?).

"Laughter means distance. Where laughter is absent, madness begins. The moment one takes the world with complete seriousness one is potentially insane. The whole art of learning to live means holding fast to laughter; without laughter the world is a torture chamber, a dark place where dark things will happen to us, a horror show filled with bloody deeds of violence."
-- Jens Bjørneboe

TSwitch

Apr 23, 2003 at 8:43 PM

Well, as it is, the .net compilier takes IL and puts it onto a stub executable. ILDASM produces some pretty verbatim output... right down to including comments marking up different sections of the code - namespaces, classes, globals, etc.

a sample:

    
//  Microsoft (R) .NET Framework IL Disassembler.  Version 1.0.3705.0

//  Copyright (C) Microsoft Corporation 1998-2001. All rights reserved.


.assembly extern mscorlib
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..

  .ver 1:0:3300:0
}
.assembly HelloWorld
{
  // --- The following custom attribute is added automatically, do not uncomment -------

  //  .custom instance void [mscorlib]System.Diagnostics.DebuggableAttribute::.ctor(bool,

  //                                                                                bool) = ( 01 00 01 01 00 00 ) 

  .hash algorithm 0x00008004
  .ver 0:0:0:0
}
.module HelloWorld.exe
// MVID: {F842D3E6-A080-4A48-BCEC-4B97FDDD3982}

.imagebase 0x00400000
.subsystem 0x00000003
.file alignment 512
.corflags 0x00000001
// Image base: 0x03810000

//

// ============== CLASS STRUCTURE DECLARATION ==================

//

.namespace HelloWorld
{
  .class public auto ansi beforefieldinit HelloWorld
         extends [mscorlib]System.Object
  {
  } // end of class HelloWorld


} // end of namespace HelloWorld



// =============================================================



// =============== GLOBAL FIELDS AND METHODS ===================



// =============================================================



// =============== CLASS MEMBERS DECLARATION ===================

//   note that class flags, 'extends' and 'implements' clauses

//          are provided here for information only


.namespace HelloWorld
{
  .class public auto ansi beforefieldinit HelloWorld
         extends [mscorlib]System.Object
  {
    .method public hidebysig specialname rtspecialname 
            instance void  .ctor() cil managed
    {
      // Code size       17 (0x11)

      .maxstack  1
      IL_0000:  ldarg.0
      IL_0001:  call       instance void [mscorlib]System.Object::.ctor()
      IL_0006:  ldstr      "Hello, idiots!"
      IL_000b:  call       void [mscorlib]System.Console::WriteLine(string)
      IL_0010:  ret
    } // end of method HelloWorld::.ctor


    .method public hidebysig static void 
            Main() cil managed
    {
      .entrypoint
      // Code size       7 (0x7)

      .maxstack  1
      IL_0000:  newobj     instance void HelloWorld.HelloWorld::.ctor()
      IL_0005:  pop
      IL_0006:  ret
    } // end of method HelloWorld::Main


  } // end of class HelloWorld



// =============================================================


} // end of namespace HelloWorld


//*********** DISASSEMBLY COMPLETE ***********************

// WARNING: Created Win32 resource file C:\Documents and Settings\Brian\Desktop\C#\HelloWorld\bin\Debug\HelloWorld.res

Ask yourself how hard it would be to manually recreate that code in C#, VB.NET and Managed C++.

[edited by - TSwitch on April 23, 2003 9:47:26 PM]

CoffeeMug

147

CoffeeMug

Apr 23, 2003 at 8:58 PM

quote:
Original post by Arild Fines
Wont help one damn bit - even if you ngen it, you still need the original assemblies present. ngen''ed images don''t contain any metadata, which is essential to the operation of the managed environment.

I stand corrected.

quote:
Original post by Arild Fines
The way to go is to use an obfuscator. There are several available(some for free), and I believe VS.NET 2003 ships with one(Can someone confirm this?).

If it''s anything like java obfuscators, the obfuscated code is more then enough to make keygens and understand critical parts of the code.

Cebu

Author

Cebu

Apr 23, 2003 at 9:06 PM

Thanks for the input so far, guys. I''ve already learned a lot I didn''t know.

It looks like Visual .net does indeed ship with an obfuscator:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetcomp/html/netcfobfuscation.asp

I guess the question is now how effective is this obfuscator?

Personally, I''m not super paranoid about people seeing my source code. I just like to be realistic and take sensible measures to keep the hacking to a minimum. This is especially important for Internet-based games. I am already planning on taking other preventative measures to try to minimize client-side hacking.

Any other ideas/suggestions are greatly welcome.

Arild Fines

138

Arild Fines

Apr 23, 2003 at 9:14 PM

quote:
Original post by TSwitch
ILDASM produces some pretty verbatim output...

Try Anakrino: http://www.saurik.com/net/exemplar/

wyrd

Apr 23, 2003 at 10:11 PM

Microsoft and secure in the same sentence? Wtf?

... seriously though, .NET isn''t all that secure. With reflection it''s actually quite easy to make your own mini-program to hack a compiled .NET program. Heck, even the .NET framework you download compiles with a disassembler program so you can actually look at the compiled code and decipher it easily.

This could be a good thing, though. If you want people to be able to make MODs for your game easily (or be able to change whatever they want), then hey, it''s all good. If not, then I don''t know what else to tell ya. Of course, anyone dedicated enough will hack into your game anyway, so it''s just a question of how much do you really care? If it''s that important then just use C++ and hope someone doesn''t have the time, if it''s not then use whatever, and if you use C# you run the extreme risk of someone making a hacked MOD of your game. But like I said, this can be a good thing. Look at what Counter-Strike did for Half-Life.

cavemanbob

Apr 24, 2003 at 1:07 AM

If someone really wants to hack your program there''s little you can do about it regardless of the language, but you''ve already realized this.

The most important thing you should look at is this: If it''s a single player game, why do you care? If someone wants to ruin the game for themselves let them, they aren''t hurting anyone but themselves. If it''s multiplayer then you''ve got a whole other problem, but the decompilation of your code is the least of them. As an excellent example of a major company that can''t even keep this kind of thing down with code written in c/c++ have a look at sony online entertainment...

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.