Complex .NET code protection

It is not a secret the programs written for .NET are easy to reverse engineer. This is not in any way a fault in the design of .NET. It is simply a reality of modern, intermediate-compiled languages. There are few techniques of software protection against unauthorized reverse-engineering:

1. Code obfuscation – it is a technique when .NET assembly is converted into the form which is hard to read after de-compiling to the languages like C# or VB.NET.
2. Code encryption – it is a technique when binary file (DLL) of the .NET assembly is encrypted and stored somewhere in your application. In runtime your application decrypt, load and use it.
3. Convert .NET application from the IL form into the processor-specific binaries.

We will not consider #3 in this article, because it creates binaries which actually aren’t a .NET code already. We will take a look into the combination of the #1 and #2 for better protection of your intellectual property.
Manco Software produces products which support both code obfuscation (Manco .NET Obfuscator) and code encryption (Manco .NET Licensing System). Both techniques give you a good level of the code protection itself. But the best level can be achieved when they are used in combination.
At the beginning we should create project files for code encryption and code obfuscation. Process of the complex .NET code protection consists of the 4 steps, so you should have 4 project files:

1. Project file to create loader and wrapper class. The License Manager uses reflection when creates these files, so it is close to impossible to do it after code obfuscation. So this process must use original (not obfuscated) assembly binary file.
2. Project file to obfuscate assembly DLL.
3. Project file to encrypt obfuscated DLL.
4. Project file to obfuscate your application which uses encrypted DLL.

Create project file for loader and wrapper

This project file will be used to create loader and wrapper class for encrypted only.

1. Run License Manager and select “Products” tab.
2. Right click license type node.
3. Select “Encrypt File” in the context menu.
4. If you’ve not generated crypto parameters and cryptographic key for file encryption, then click “Generate Crypto Params” button. In other case, select in the “Cryptographic Key” combo box name of the custom value where cryptographic keys are stored. NOTE: If you created new cryptographic parameters then you MUST re-create license file to include these parameters to it.
5. Enter name of the DLL file that contains assembly to be encrypted to the “File to encrypt” text box.
6. Enter name of the file that will contain encrypted assembly to the “Save encrypted to” text box.
7. Check “Create Loader and Wrapper for encrypted assembly” check box.
8. Select programming language that will be used to create loader and wrapper in the “Language” combo box. C# and Visual Basic .NET are currently supported.
9. Enter name of the file to save generated code to the “Save loader to” text box.
10. By default public methods and properties from encrypted DLL has same access modifier (public) in the wrapper class. We suppose that you need not to access these methods and properties outside your application, and you would like to have wrapper class obfuscated by Manco .NET Obfuscator. In this case it is reasonable to use ‘internal’ access modifier for these methods and properties. Check the “Set internal access modifier in the wrapper class for public properties and methods” checkbox to change access modifiers in the wrapper class.
11. Click "Save settings"  button and enter name of the project file. For example: CreateLoaderAndWraper_EncryptSettings.xml.
12. Click "Encrypt"  button. File with loader and wrapper classes will be created.
13. Click "Close" button.

Create project file for obfuscation of the encrypted assembly

This project file will be used to obfuscate original assembly (DLL).

1. Run Manco .NET Obfuscator.
2. Click “Open Assembly” button. In the open file dialog select .NET binary file (DLL or EXE) you’d like to obfuscate. Manco .NET Obfuscator will load assembly information and make default obfuscation settings. You can browse the classes, fields and methods are supposed to be obfuscated in the assembly tree view. If checkbox in the tree view is checked then correspondent item (class, property or field) will be obfuscated. By default Manco .NET Obfuscator mark private and internal classes and members for obfuscation.
3. By default Manco .NET Obfuscator do not mark any strings to encode. You can simple force obfuscator to encode all strings in assembly by check “Encode all strings” check box, or you can switch to the “Strings for encoding” tab and select strings which should be encoded. By default Manco .NET Obfuscator uses “Raw” method to encode strings. It is a fastest way to encode and decode strings, but it is less secure than other options.
4. Set desirable level of the control flow protection.
5. Click “Save” button and enter name of the obfuscation project. For example:  ImportantFunctionality.moproj.

Create project file to encrypt obfuscated DLL

This project file will be used to encrypt obfuscated DLL. 

1. Run License Manager and select “Products” tab.
2. Right click license type node.
3. Select “Encrypt File” in the context menu.
4. Select in the “Cryptographic Key” combo box name of the custom value where cryptographic keys are stored.
5. Enter name of the DLL file that contains OBFUSCATED assembly to the “File to encrypt” text box. For example: “D:\Manco\Licensing\EncryptAssemblyCS\ImportantFunctionality\bin\Debug\Output\ImportantFunctionality.dll”
6. Enter name of the file that will contain encrypted assembly to the “Save encrypted to” text box.                              
7. Click "Save settings" button and enter name of the project file. For example: EncryptObfuscated_EncryptSettings.xml.
8. Click "Encrypt" button. File with loader and wrapper classes will be created.
9. Click "Close" button.
10. Remove reference to the encrypted assembly from your project.
11. Add encrypted assembly and loader class to your project. We would recommend you to add these 2 files to your project as link. This way you always will be sure that you are using latest version of the encrypted assembly and loader class.
12. Select file with encrypted code in the solution explorer (“ImportantFunctionality.dll.enc” in our case) and set Build Action for it to “Embedded Resource”.                
13. Add following code right after initialization of the license object:

[C#]

            _EncryptedBinaryLoader.Load(license);

[VB.NET]

           _EncryptedBinaryLoader.Load(license)

Create project file to obfuscate your application

This project file will be used to obfuscate your application which uses encrypted DLL. The process is absolutely similar to one described for encrypted assembly. You just need to select executable file of your application. Pay attention, because of the settings made for the loader and wrapper classes both have internal access modifier, so Manco .NET Obfuscator marks both classes for obfuscation:

Click “Save” button and enter name of the obfuscation project. For example:  EncryptedAssembly.moproj.

Using of the project files

If you are using “Standard Edition” of the Manco .NET Licensing System then you can encrypt your assembly using License Manager only. In this case build sequence looks like the following:

1. Build Visual Studio project for encrypted assembly.
2. Run License Manager.
3. Use CreateLoaderAndWraper_EncryptSettings.xml project file to create loader and wrapper.
4. Run Manco .NET Obfuscator.
5. Use   ImportantFunctionality.moproj project file to obfuscate encrypted assembly.
6. From License Manager use EncryptObfuscated_EncryptSettings.xml project file to encrypt obfuscated assembly.
7. Build Visual Studio project for your application which uses encrypted assembly.
8. From Manco .NET Obfuscator use EncryptedAssembly.moproj project file to obfuscate your application.

“Professional Edition” (and high) of the Manco .NET Licensing System includes license for Encryptor. This is console application which performs encryption operations from the command line. It makes possible automation of the encryption during application building process (from the Visual Studio, for example). You can call Encryptor and command line mode of the obfuscator from the Post-build event:

1. Run Visual Studio and open solution with your application and encrypted assembly project. For example:                                           
2. Open properties page of the ImportantFunctionality project and go to the “Build Events” tab.
3. In the “Post-build event command line” text box enter commands to call Encryptor and obfuscator:
1. "C:\Program Files (x86)\Manco Software\Manco .NET Licensing System\Tools\Manco.Licensing.Encryptor.exe" $(ProjectDir)Encrypted\CreateLoaderAndWraper_EncryptSettings.xml
2. "C:\Program Files (x86)\Manco Software\Manco .NET Obfuscator\Manco.Obfuscator.Console.exe" $(ProjectDir)ImportantFunctionality.moproj
3. "C:\Program Files (x86)\Manco Software\Manco .NET Licensing System\Tools\Manco.Licensing.Encryptor.exe" $(ProjectDir)Encrypted\EncryptObfuscated_EncryptSettings.xml
4. Open properties page of the EncryptedAssemblyCS project and go to the “Build Events” tab.
5. In the “Post-build event command line” text box enter command to call obfuscator:
   "C:\Program Files (x86)\Manco Software\Manco .NET Obfuscator\Manco.Obfuscator.Console.exe" $(ProjectDir)EncryptAssemblyCS.moproj

Now all necessary encryption and obfuscation things are automated in the Visual Studio build process. So you need not to run License Manager and/or Manco .NET Obfuscator GUI to encrypt and obfuscate your code. It will be done automatically when Visual Studio build your solution.

Version 6.1 of the Manco .NET Licensing System released

Manco .NET Licensing System version 6.1 is available now. You can get 15-days trial version at the http://www.mancosoftware.com/licensing/download.htm

List of the most significant changes made in new version:

1. Added {d} Unlock Key format string. It includes Subscription Days and Override Id to the Unlock Key. The protection library check Override ID and set subscription expiration date rule using current date and subscription days set in the Unlock Key. In this case date when subscription expires will be calculated during license validation. This licensing schema provides best results in conjunction with license activation.

2. Activation Web Service has been extended with ability to identify subscription state when activate and validate license online. If subscription expired license will not activated. During product activation subscription end date is included to the Activation Key and passed to the protection library for local validation.

3. Added command line tool to encrypt files and source code (Encryptor). This tool is awailable in professional edition and high.
 
4. Added support for relative pathes in the file encryption and source code encryption projects.
 
5. Added {l} and {c} Unlock Key format strings to allow including of the not encrypted license type ID and customer ID to the Unlock Key.
 
6. Allowed binding of more then 1 letter of every type to the version node.
 
7. Allowed using of the "Product Edition" license rule from the non-Unlock Key based licenses.
 
8. Implemented support of the custom user data editor in the "License Shop" with ability to load external DLLs.
 
9. Added support of the C++ for "Create Loader and Wrapper" operation in "Encrypt File" window.
 
10. Added ability to fill "Subscription Date", "Subscription Days" and "Override ID" fields in the "Generate Unlock Key Bundle" dialog.
 
11. Added ability to preview e-Mail body using specified e-Mail configuration.
 
12. Added ability to get raw e-Mail data for the specified sale. It is useful for debugging e-Mail XSLT.
 
13. Added few UI extensions to the License Manager.

14. Added few UI extensions to the License Shop.

15. Few bugs have been fixed.

Running License Shop

License Shop is the web-based (Silverlight) tools for complete customer and license management. Using it you can issue licenses and keys outside your office just using any Silverlight-ready PC. You even can setup a bunch of sale persons around the world who will do it for you 24x7 just using single “License Shop” license. Just manage your sale persons to use “License Shop” on 1 in a time basis. We don’t allow concurrent using of the single license. But “License Shop” is not bound to the particular PC (it is bound to the AWS installation), so you can use single license anytime anywhere on 1 license - 1 concurrent connection basis.

To start instance of the “License Shop” you should have Microsoft Silverlight installed into your PC. Open your favorite browser and enter URL for the “License Shop”. It is located in the virtual directory where Activation Web Server is located.  So start URL can look like the following:
http://www.yourdomain.com/ActivationService/LicenseShop.aspx
You will see “License Shop” login window:

Enter user name and password (the default user name and password for License Shop are license/license) and click “Login” button. The UI of the “License Shop” is similar to the License Manager, so you can use same approaches to issue licenses and manage clients.

When you need close “License Shop” window you should follow this instruction, otherwise active connection will not be closed and you will not be able to enter “License Shop” again. To close “License Shop” window do following:

Close browser window. When you close browser with “License Shop” you will see standard close dialog. Wait while you will see this window:

Then click “OK” in the close dialog.

If you changed data in the “License Shop” and didn’t save changes you will see additional dialog about unsaved data:

 

In this case you should do following:

1. Click “Cancel” in the standard close dialog.
2. Click “Yes” to save data or “No” to bypass changes.
3. Wait while you see “It is safe to close browser now.” Message.

Close browser with “License Shop” and click “OK” in the standard close dialog.

Manco .NET Licensing System version 6.0.1 released

Manco .NET Licensing System version 6.0.1 is available now. You can get 15-days trial version at the http://www.mancosoftware.com/licensing/download.htm

List of the most significant changes made in the new version:

1. In this version we added new part of the Manco .NET Licensing System. We call it “License Shop”. This is web-based (Silverlight) tools for complete customer and license management. Using it you can issue licenses and keys outside your office just using any Silverlight-ready PC. You even can setup a bunch of sale persons around the world who will do it for you 24x7 just using single “License Shop” license. Just manage your sale persons to use “License Shop” on 1 in a time basis. We don’t allow concurrent using of the single license. But “License Shop” is not bound to the particular PC (it is bound to the AWS installation), so you can use single license anytime anywhere on 1 license - 1 concurrent connection basis.

UI of the License Shop is similar to the UI of the current version of the License Manager. So it will be easy to you to switch between these 2 tools.

Starting from version 6.0.1.0 of our licensing system Activation Web Service license will include 1 free license for “License Shop”. So you can start your web-based licensing experience without any extra charge. All customers who bought version 6.0 or have active subscription will get upgrade to version 6.0.1.0 for free.

Note: this version of the License Shop does not support custom user data edit controls.

2. Added new web-methods to the Activation Web Service which provides functionality necessary for the "License Shop".

3. Few bugs have been fixed.

License Shop will be released soon

We are going to release new part of the Manco .NET Licensing System soon. We call it “License Shop”. This is web-based (Silverlight) tools for complete customer and license management. Using it you can issue licenses and keys outside your office just using any Silverlight-ready PC. You even can setup a bunch of sale persons around the world who will do it for you 24x7 just using single “License Shop” license. Just manage your sale persons to use “License Shop” on 1 in a time basis. We don’t allow concurrent using of the single license. But “License Shop” is not bound to the particular PC (it is bound to the AWS installation), so you can use single license anytime anywhere on 1 license - 1 concurrent connection basis.
Starting from version 6.0.1.0 of our licensing system Activation Web Service license will include 1 free license for “License Shop”. So you can start your web-based licensing experience without any extra charge. All customers who bought version 6.0 or have active subscription will get upgrade to version 6.0.1.0 for free.

Here are few “License Shop” screenshots:

How to debug custom "User Data" edit control.

Sometimes user data or product edition are included to the Unlock Key has complex format. For example, user data can contain specification of the product edition and number of the concurrent sessions allowed for ASP.NET application. In this case using of the simple text box becomes a quite problematic for sales persons. They should remember format of the user data and enter something like “PE043” every time when customer buy Professional Edition with 43 concurrent sessions allowed.

License Manager allows you creation and using of the custom controls to simplify editing of the complex user data. The process of creation of the custom edit control is described in our product documentation. Mostly those controls are quite simple and work without any problems. But sometimes it is necessary to debug functionality of the custom edit control. You can do it using Visual Studio.

Open your solution in the VS2010. Then run License Manager with your control in use. In the VS2010 main menu go to the Debug->Attach to Process:

In the “Attach to Process” dialog select “Manco.Licensing.LicenseManager” process and click “Attach” button:

After that you will be able to debug your control.

Don’t forget to replace DLL near the License Manager every time you change something in your control.

64-bit OS and License Manager database.

In the present days many people are moving to the 64-bit OS and put old versions of the License Manager to this platform. There are not any problems if MS SQL database is in use, but when the License Manager database is MS Access you run into the difficulties. If you run our application on 64-bit platform with MS Access database you get ‘Microsoft.Jet.OLEDB.4.0 provider is not registered on the local machine’ exception.

There is not 64-bit version of Jet and Microsoft has no plans to create a 64-bit version of Jet. So you can’t use License Manager with MS Access database on 64-bit platform. Fortunately our product supports using of the MS SQL database, either Express version or fully functional server. You can find instructions on how to setup License Manager to use MS SQL here: www.mancosoftware.com/licensing/faq.htm

It is not difficult to get License Manager using the MS SQL, but you definitely would like to move your existing data from MS Access database to MS SQL as well. It was a bit problematic before we release version 6.0 of our software.  Now there is a trick which can help you with your old data. There is a part of the version 6.0 which is called Database Manager. Using this application you can copy all data from your MS Access database to the MS SQL Express database even on 64-bit OS. For copy operation Database Manager supports all versions of database starting from 3.2. So you can use it to move your existing data to the new database. This application is free to use. You can download it from our official site at the http://www.mancosoftware.com/licensing/download.htm. Below you can find extraction from the version 6.0 documentation which describes how the Database Manager can be used to copy data from MS Access to MS SQL Express.
Using of the Database Manager

Database Manager is the application which install new or upgrade existing database, and allows copy licensing data from one database to another. Current version of the Database Manager supports MS SQL Server and MS SQL Express for all operations and MS Access as data source for copy operation. Support of the MS Access database makes possible upgrade of your database from any version starting from 3.2 to current version.

There are several scenarios when you need to use Database Manager, but there is one step, which is common for all these scenarios. Before you can perform any operation you should create description of the database connection.

Click "New"  toolbar button. Enter name of the database connection (can be any) and select database type. You can simple enter connection string in the correspondent column, or click "..." button in the edit mode and edit connection string using database connection dialog:

You always can test your database connection by clicking the “Test” button. Click “OK” to finish edition of the connection string.

1. All versions of the Manco .NET Licensing System starting from 3.2 and up to the 5.0 were provided with both MS Access and MS SQL Express database files. The MS SQL Express database file is located at the same place with MS Access one. Create database connections for both: MS Access and MS SQL Express databases:

2. Switch to the “Copy data” tab.
3. Select your Access database as data source.
4. Select your MS SQL Express database as destination.
5. Find “Roles”, “UserName” and “UsersInRoles” databases.
6. Check checkboxes in the “Clear destination” column for these 3 tables.

7. Click "Copy" button to copy data from the MS Access database to the MS SQL Express database. Data from the MS Access database will be copied to the MS SQL Express database.