Obfuscator which supports WPF properly

Question

What options exist for a good obfuscator tool for .NET which propertly support WPF in .NET 4.0?

In particular, which obfuscation tools handle rewriting of BAML within WPF assemblies, and handle cross-assembly references within BAML?

While most obfuscators list "WPF" and ".NET 3.5" or ".NET 4" support, in practice, they fail to rewrite the embedded BAML references, causing cross-assembly calls using WPF to be handled improperly. This prevents their usage in large-scale WPF applications.

Pruter

It might be helpful if you post which options you've already tried (just so we don't all repeat ourselves). – Shoebill

@Justin: The only one I've found, so far, is Dotfuscator - however, the last time I tried it (which was a while back), it had issues, still. At this point, I don't know of a single, good option. :( – Pruter

Since I haven't tried it personally, I'll post this here...but have you tried RedGate's SmartAssembly? It handles BAML in a specific way that might work for you...depending on your needs: red-gate.com/supportcenter/Content?c=SmartAssembly\help\5.5\SA_wpf.htm&p=SmartAssembly – Shoebill

@Justin: Yeah, I've tried it. It does not handle this, at all, unfortunately. This causes it to basically force you to not obfuscate any of your WPF assemblies you use as a library. They're considering it as an addition for version 7, but it will not be included in version 6, either. – Pruter

Damn Microsoft and their proprietary BAML format anyway. Heh. – Shoebill

Answer 1

Eazfuscator.NET does a proper WPF renaming since version 3.5. We put extensive R&D efforts to create a solution that just works. XAML renaming is powered by a dedicated analyzer that takes bindings, commands and every other aspect of XAML into account to deliver the precise results. You can give it a try.

Rani

Answer 2

Well WPF depends heavily on Reflection and changing your property names may not work correctly as binding will not function correctly. Obfuscator tools will not detect string references in code that may be there inside your ViewModel and so on. And whatever you do. Tools like Blend can anyway create copy of templates and styles from BAML and that is the reason BAML was introduced instead of creating executable code from xaml.

And as it is BAML is just a graphical representation, at runtime people can also use Snoop tools to identify your runtime view of controls.

However, there is a free tool which generates WPF code behind file as a pure CLR object graph representation instead of BAML, http://xamlgenerator.codeplex.com/ (Disclaimer: this xamlgenerator is free tool created by my company)

Glorify

The goal here is to be able to use WPF development without having to rework the development cycle in order to provide protected assemblies. This tool is interesting, but it pretty much changes the rules when using WPF - which kind of defeats the purpose in my scenario. – Pruter

Answer 3

Disclaimer: I work for PreEmptive Solutions (the makers of Dotfuscator).

If you tried Dotfuscator a while back you should probably give it another try. We are constantly improving our XAML/BAML parsing & rewriting capabilities. You should be able to get a new free evaluation version easily from the PreEmptive website (or by contacting sales).

Most of our customers are able to obfuscate the majority of their WPF/Silverlight/WP7 applications without significant exclusions. Even if the BAML obfuscation breaks something in your application you should be able to selectively exclude only those items than should not be renamed.

If you do have a specific scenario of something that we break during obfuscation please go ahead and send it in, we're always looking to make our product better.

At this time the only other .NET obfuscator (that I know of) that claims to be able to modify XAML or BAML is CodeFort. I am obviously biased so I'll let you investigate the products and make your own judgment :)

Rutter

I tried Dotfuscator community edition and my application failed to open after obfuscation. – Gorgerin

same happened to me. obfuscates fine, then does not open – Tommi

Yeah, but it is incredibly slow! – Barbed

Answer 4

ConfuserEx is as an Open Source obfuscator which does pretty good job making code very difficult to follow.

If WPF exe doesn't work properly after using one of the presets, try adding protections manually (I found that in my case 'Name Protection' (rename) was breaking event handling):

Scoville

Answer 5

I tried CodeFort in a multi-assembly Silverlight 4 application with partial success. Reference scrambling and string encryption work great and bring some degree of protection.

Renaming feature in CodeFort is a big mess though. Enabling renaming (with XAML support) in all my assemblies broke the application. I tried then to exclude all types (including all members) from renaming, which was very time consuming due to bad UX. That didn't bring the app to life.

Debugging and troubleshooting doesn't work well either. CodeFort doesn't respect PDB files. The only way to debug the problem was to enable debugger to break upon all thrown exceptions. Now I see the XAML parser complaining about app.xaml, which looks OK.

As for now I just stick to reference scrambling and string encryption.

Squeeze

I am still deciding between Babel and CodeFort. Thanks for your review. Your review is quite recent so I wonder if CodeFort has fixed the issues you have mentioned in the meanwhile. Have you tried Babel? Do you have any recommendations? Thanks – Perished

Code fort still has these issues and I think it's a dead product at this point. I like it, works great but no support/updates available. – Earthiness

Answer 6

In our company we use Agile.NET Obfuscator - it supports WPF application and can protect/encrypt managed resources including BAML files.

Decompiling using ILSpy:

Before (with only code encryption)

After (with Resource encryption)

Hannahhannan