How to use obfuscation for ClickOnce?

Question

If one will release a ClickOnce version, how can it be obfuscated by Dotfuscator?

Hyson

Answer 1

You can use the commercial version of Dotfuscator to automatically obfuscate a ClickOnce application by adding the deployment manifest ("foo.application") as an input to your Dotfuscator project. Dotfuscator will allow you to add any necessary exclusions to the assemblies contained in the ClickOnce application and will create updated deployment and application manifests containing the obfuscated assemblies.

The free version of Dotfuscator included in Visual Studio (including Visual Studio 2010) does not have the feature to automatically obfuscate ClickOnce applications. In order to get a functioning obfuscated ClickOnce application you will need to recreate or update the ClickOnce manifests since obfuscation changes the signatures of the assemblies.

You can use mage.exe or mageui.exe (included in the Windows/.NET SDK) to update the ClickOnce manifests. If you are going to use mage.exe you need to be aware that you cannot use the "Use .deploy file extension" option in your ClickOnce options as it does not recognize it.

Assuming your ClickOnce application is named "Foo" and is at version 1.0.0.0 the process you will want to follow is:

1. Publish your ClickOnce application to a directory on disk
2. Run Dotfuscator CE and add the assemblies you want to be obfuscated from the bin directory of your project
3. Obfuscate the assemblies. The obfuscated assemblies will be put into a subdirectory named "Dotfuscated" by default.
4. Resign your obfuscated assemblies with sn.exe (only if you initially strong named them)
5. Copy the obfuscated assemblies over top of the ones in the ClickOnce publish\Application Files\Foo_1_0_0_0 directory

6. Update the application manifest and resign it:

   mage.exe -Update "Application Files\Foo_1_0_0_0\Foo.exe.manifest" -CertFile "c:\Foo\foo.pfx" -Password password

7. Update the deployment manifest and resign it:

   mage.exe -Update Foo.application -AppManifest "Application Files\Foo_1_0_0_0\Foo.exe.manifest" -CertFile "c:\Foo\foo.pfx" -Password password

You now have a valid application and deployment manifest using obfuscated assemblies. You can also use the MageUI.exe tool to accomplish the same tasks (and it knows how to handle assemblies with the .deploy extension) but it is not as easy to automate.

Latria

Hi @Joe, can you explain where the certificate pfx file come from? – Outgo

@Outgo if you are shipping software to external customers then it normally comes from a certificate vendor (Comodo, Thawte, etc). For internal applications I've used certs signed by a domain controller or just self signed certs from makecert.exe – Latria

Hi @JoeKuemerle After doing this all My Application Stopped Working on the Client Machine. It is Checking for update, downloading it and running it. then stopped working. I checked the Event Viewer and Found 1.0.0.0 4f29010f c d System.NullReferenceException C:\Users\interbiz\AppData\Local\Temp\WER22D1.tmp.WERInternalMetadata.xml – Henka

@Henka Sounds like an obfuscation issue and not a ClickOnce problem. If you are using late binding, dynamic invocation of methods with string literals, serialization or some types of reflection renaming of some methods in your application can cause it to crash. You should investigate the stack trace and determine if you need to exclude some symbols from being renamed. – Latria

I don't have a .application file. I've got an xbap and an exe.. one at the same level as the "Application Files" directory and one in the Foo_1_0_0_0 level. Would the xbap at the higher level be equivalent to your .application? It tells me it was successfully signed, but I still get manifest errors trying to run the xbap. – Henriettahenriette

Answer 2

I have a solution similar to Joe Kuemerle's, but before the publish process. This works with publish in Visual Studio and MSBuild command line.

Add the BeforePublish target to the project file.

<ItemGroup>
    <ClickOnceFiles Include="bin\Release\ClickOnce.*"/>
</ItemGroup>
<Target Name="BeforePublish">
    <Exec Command="{path to dotfuscator}\dotfuscator.exe Dotfuscator.xml" />
    <Exec Command="mage.exe -u bin\Release\ClickOnce.exe.manifest" />
    <Exec Command="mage.exe -u bin\Release\ClickOnce.application -AppManifest bin\Release\ClickOnce.exe.manifest" />
    <Copy SourceFiles="@(ClickOnceFiles)" DestinationFolder="obj\Release" OverwriteReadOnlyFiles="True" />
</Target>

The ClickOnce files are ClickOnce.application, ClickOnce.exe, and ClickOnce.exe.manifest. My dotfuscator.xml is in the same folder with the project file. The key is the last command, copy the ClickOnce files to the obj folder.

Halfbound

Umm, which part of the above regenerates the manifest based on the number of files? After all, I may have X files before obfuscation but only one file after obfuscation (not counting the manifest & .vsto files, of course). – Johppah

Answer 3

Yes, these are compatible technologies. ClickOnce simply focuses on the deployment of an application and its associated binaries to a target machine. Dotfuscator offuscates the DLL and EXE files. They will work together so long as you run Dotfuscator before publishing the application.

Epeirogeny

But, in VS2010, if you 'publish' the clickonce, there are no dll/exe. How to 'run Dotfuscator before publishing the application'. – Hyson

Add, 'run Dotfuscator before publishing the application',how to publish? – Hyson

Answer 4

I don't know whether this is only possible in later versions of Visual Studio but for me it works perfectly:

1. Build the executable in Release mode
2. Start the exe-modificator of your choice and modify the file at obj/Release/<filename>.exe (notice: not bin/ but obj/)
3. Push the Publish Now button of Visual Studio which assumes the last build were up-to-date
4. Profit :D

Audly

Publish now always builds for me, so I made a Post-build task but it still didn't work, original .exe is still in the publish location instead of the obfuscated one – Helterskelter

Answer 5

If you are using VS2010, the Dotfuscator that comes with it will obfuscate the files and then re-sign the manifests for you. [Edit -- this is not true unless you buy the full version; it works just like VS2008.]

If you are using VS2008, you will need to publish, then obfuscate the files, and then re-sign the manifests with Mage or MageUI.

Edson

But, in VS2010, if you 'publish' the clickonce, there are no dll/exe. How to 'run Dotfuscator before publishing the application'. – Hyson

See the directions above. Thanks to the Preemptive guys who posted the answer after I asked them for info on twitter. :-) – Edson

Answer 6

The deepsea obfuscator works with clickonce

Ruthenic

Answer 7

The Eziriz .NET Reactor has an excellent ClickOnce integration.

Ruthenic

Answer 8

I got it from an answer to forum post How to deal with ClickOnce.

Hyson

Answer 9

see microsoft onling document:Walkthrough: Manually Deploying a ClickOnce Application

Dellinger