Check if .dll's are obfuscated!

Article
2006-08-14

Question

_{Monday, August 14, 2006 6:42 PM}

Hi all!

Our company currently obfuscate our .dlls before shipping to our clients. The QA Team must verify if each .dll are obfuscated before shipping to the client. Right now, the only to achieve this, is by loading the .dll file inside the Reflector.exe tool.

I would like to create a tool that you simply browse for a particular folder(the one were all the .dlls are) and "scan" them. I'd loop inside the giving foler and sub folders for files with the .dll extension. Then scan that .dll file.

Is there an easy way to do this without the use of the Reflector.exe tool?

How would/could I check for obfuscated .dlls code wise?

Thanks in advance!
Sincerely

Vince

All replies (5)

_{Monday, August 14, 2006 8:08 PM}

Hi Vince,
As far as I remember, dotfuscator renames private methods and properties to "$".

You could write a very simple console application with something like:

bool IsObfuscated (string assemblyPath) {
Assembly asm = Assembly.LoadFrom (assemblyPath);
Type [] types = asm.GetTypes ();
foreach (Type t in types) {
    MethodInfo [] methods = t.GetMethods (BindingFlags.Public| BindingFlags.NonPublic| BindingFlags.Instance);
foreach (MethodInfo m in methods) {
    if (m.Name == "$") {
      Console.WriteLine ("Obfuscated!");
        return true;
    }
}
}

Console.WriteLine ("Not Obfuscated!!!!!!");
return false;
}

It would work for dotfuscator. I don't know how other obfuscators mangle the private method names...

HTH
--mc

_{Monday, October 9, 2006 7:56 AM}

Hello,

Is it possible to obfuscate both Main application and referenced .dll and the main application still reamain able to call methods from the library.

For instance in the .dll we have a Show() method that becomes a() after obfuscation.

In the main application we are calling Show(). How does the main application knows that the Show method is now named a() inside the dll ?

Thank you

_{Monday, October 9, 2006 8:36 AM}

@Mitica:

You have to obfuscate the main application and all its libraries at the same time. That way, the obfuscator can fix up at the same time all the libraries and the application that calls into them.

_{Monday, October 9, 2006 8:41 AM}

@VLince:

For dotfuscator, you can check that the names of all types in the assembly are 2 characters or less (except for a special type called "DotfuscatorAttribute").

A command-line program to check this is:

internal class Program
{
    //—————————————————————————————————————————————————————————————————————————————————————————————————————————————————————
    // Returns 0 if not obfuscated, 1 if obfuscated, -1 if error.

    [STAThread]
    static int Main( string[] args )
    {
        if ( args.Length != 1 )
        {
            Console.WriteLine( "Usage: IsObfuscated <exe or dll name>" );
            Console.WriteLine( "Returns 0 if not obfuscated, 1 if obfuscated." );
            return -1;
        }

        if ( !File.Exists( args[0] ) )
        {
            Console.WriteLine( "File does not exist: " + args[0] );
            return -1;
        }

        return IsObfuscated( args[0] ) ? 1 : 0 ;
    }

    //—————————————————————————————————————————————————————————————————————————————————————————————————————————————————————

    static private bool IsObfuscated( string filename )
    {
        try
        {
            Assembly assembly = Assembly.LoadFrom( filename );

            foreach ( Type type in assembly.GetTypes() )
            {
                if ( ( type.Name.Length > 2 ) && ( type.Name != "DotfuscatorAttribute" ) )
                {
                    Console.WriteLine( "*******************************************************************************" );
                    Console.WriteLine( filename + " is NOT obfuscated, because it contains a type called " + type.Name );
                    Console.WriteLine( "*******************************************************************************" );
                    return false;
                }
            }

            return true;
        }

        catch ( System.Exception ex )
        {
            Console.WriteLine( "Exception occured when inspecting assembly " + filename );
            Console.WriteLine( "Message is: " + ex.Message );
            return true;
        }
    }
}

_{Tuesday, September 24, 2013 6:15 AM}

I have an situation where my WinForm EXE and their dependent DLLs are obfuscated . Now the exe runs with no issues . I have another DLL say 1.DLL which is loaded into my Winforms at runtime by reflection , this process fails after obfuscating the DLLs

Share via

Check if .dll's are obfuscated!

Question

All replies (5)

Additional resources