Securing .NET applications – Code Security and Trial Versions

August 30, 2007 in Software Development

Well, I just finished work on developing a new product. It is a Windows application. And the deployment part took much more time than we had estimated. Deployment is a different kind of programming altogether. People use different kinds of technologies for deployment, but we used .NET. Here I just summarize some of the issues we ran into before we could proudly say that the product is now available for people to use.

Protection from decompilation: .NET applications decompile very easily. People mostly use .NET Reflector for that. If you send out your code without securing it, anybody can read the code. To secure an application most people use “Code Obfuscation”. Code Obfuscation changes class and variable names to trivial names. So code that looks like

    class Menu

    {

        public bool NewProject()

        {

            //Open New Project Dialog Box

            NewProjectDialog NewProjectDialogObj = new NewProjectDialog();

            NewProjectDialogObj.ShowDialog();

        }

    }

may become

    class A

    {

        public bool B() //For creating a new Project

        {

            //Open New Project Dialog Box

	    C D = new C ();

            D.ShowDialog();

        }

    }

This means that anybody who is trying to reverse engineer your code cannot understand it, but he can still use the code as it is. Another way to do it is by preventing any kind for decompiling of your .NET assemblies. You can do that by various tools. Most decompilers use the CLI header to get back the source code. Removing the CLI header makes decompiling so much more difficult. Many commercial products are available for this purpose. I haven’t used all of them as are not free! Some of them are

DotFuscator

CodeVeil

Salamander

And .NET Reactor

Limited Time Trial Version Security: In case you want distribute a limited time version of your application for evaluation; the critical task is to prevent it from running after the trail period has expired. To do this you can use the above applications. .NET Reactor has excellent support for making limited time trial versions. Or you can pretty much write your own code to do the same. You can do some of these:

Place N number of flags in the computer about

1. Installed Flag (IF) – This can be used to prevent a fresh installation your demo software if this flag is present. Hence the hacker can’t make multiple installations of the same software.
2. Install date (ID)- This will give the information of the installed date.
3. Expiry Date (ED) – This gives information of expiry date.
4. Last Access date (LAD) – The date on which the program s last accessed. If the user is trying to meddle with system date in order to run it for ever, you could probably use this flag to catch him.

Here is one of the ways you could use the flags

1. During installation set IF = true, ID = LAD = System Date, ED = ID + Trial Duration
2. During Load check
   • If Decryption of flags fails, user is hacker
   • If System Date < ED then continue else Trial Period expired, exit
   • If LAD > System date or LAD< ID or LAD>ED The person is a hacker. Else if everything is fine, LAD = System Date and continue
3. During exit LAD = System date

In reality you can use just one flag to act as ID, ED and IF. But the more flags you use it will be so much more difficult for the hacker to break into your installation. In fact you could use more than one flag for ID, ED and IF individually all having the same values but encrypted differently. You could put these values in the Registry or somewhere else in the file system. That is really left to you. Remember to encrypt thee values before you put them on the system. If the encryption is broken, you’ll probably know that you are dealing with a hacker. So you can either break your installation or do whatever you choose.

There are also other scenarios your installation will have to beat the hacker:

1. Installed files are copied to another location on the same system after expiry date.
2. Installed files are copied to a new system. Though this not a big problem since, this being trail version, you should encourage more people use it.

After all this done, please don’t forget to include a license file to put hackers under legal risk as well.

PS: The author makes no claims that the information above is foolproof. Use this information at your own risk.