Skip to content

Latest commit

 

History

History
31 lines (30 loc) · 4.26 KB

matrix.md

File metadata and controls

31 lines (30 loc) · 4.26 KB

Matrix of things that mattered to me

Feature Obfuscator (obfuscate) Obfuscator (merge) Obfuscator (embed) ILMerge Costura.Fody LibZ
Can obfuscate Y N N N N N
Dead code elimination Y Y N N N N
Very large projects Y1 Y1 Y N1 Y Y
Safe to reference assemblies by name N N Y N Y Y
Safe to use reflection on objects N2 N2 Y Y Y Y
Sharing assemblies between executables N N N N N Y
Does not alter compiled assemblies N N N N N Y3
Compress assemblies Y4 Y4 Y N Y Y
Compress resources Y Y Y N N5 N5
Use alternative compression algorithms N6 N6 N6 N N7 Y8
Merge assemblies with conflicting resources N9 N9 Y N Y Y
Mixing 32-bit and 64-bit assemblies N N Y10 N Y Y
MEF discovery11 N N N N N Y
Risk that it just won't work High Medium Low Medium Low Low
Intellectual property protection12 Medium None Low None None None
  1. It's yes, but I've seen ILMerge and commercial obfuscator crashing with OutOfMemoryException on 15MB executable (actually ILMerge could crash much earlier)
  2. With obfuscation and pruning it's not safe. Obfuscation changes member names, pruning can remove member completely when they are not used "conventionally". You need to do some mumbo-jumbo with attributes and/or configuration files to prevent that. But you need to know upfront which classes are you going to use reflection on. If you don't know on compile time it makes the whole obfuscation/pruning useless. Please note that Dapper uses reflection on anonymous classes. You can't add attributes to anonymous classes. There are workarounds but the whole thing requires some (up to "a lot of") work.
  3. The standard approach to LibZ does alter compiled assemblies (so it should be 'No' like the others). There is a way, though, requiring dropping one file into a project to avoid post-processing completely.
  4. Pruning is king of compression (removing redundancy). It has some disadvantages (again: reflection), but it's quite useful to remove code which does not get called at all. Additionally you can create mini-bootstrap application which embeds (and compresses) merged/pruned assembly. It's two stage process, but gives best results.
  5. Resources are compressed because assemblies are compressed. It's not real resource compression.
  6. The obfuscator I know uses zlib.
  7. Costura.Fody uses built-in deflate.
  8. By default LibZ uses built-in deflate, but you can plug in any algorithm you want.
  9. To be honest I actually don't know (never tried) but it doesn't seems possible as you could build resource names to load dynamically in your code.
  10. Unless you handle it yourself I'm not sure if it is able to decide which one to load.
  11. Of course, with all those solutions you can get MEF catalogues knowing the assembly, but this is about discovery.
  12. Some may say that "all of them give zero protection". But, let's face it, wannabe hacker can be stopped by good obfuscator. With protection is like with encryption: you can call protection unbreakable if cost of breaking it is greater than price of the thing it is protecting.