Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
Without buying Remotesoft's Protector (because obfuscating does pretty much nothing), it seems that the best way of keeping code "safe" at least from the lesser experienced code crackers would be to have a client connect to my server and download what to do from there, keep it in memory, execute it, erase it from memory. Where could I learn about implementing something like this? Or is there a better way than obfuscating other than the Protector and other than creating the core code in C/C++ in a DLL and using C# just for the interface?
Thanks much!

"because obfuscating does pretty much nothing"
Pretty much true.
You shouldn't be sending most things to the client anyway. More to the point all input should be checked somewhere at the server level. Preferably this happens before the server performs any action. It is not important to protect the client's code to exotic extent - in any model the client's input cannot be trusted. If you are going to trust, verify.
Obfuscating is security through obscurity in a new skin. It works only until your system is worth cracking. I suggest using the time to improve code and determine better methods to check client content, making manipulation a true task of reverse engineering.
Remember that open source systems exist that are secure while still providing remote services. It can be done even when the crackers have your code.

I don't believe I'm explaining what I mean very well. I mean security of my code as in keeping the code from being viewed via ildasm or a decompiler. What I mean is say I had a program that used an encryption algorithm to protect the end-user's data, however I did not want them to be able to see the code that I used to encrypt and decrypt via ildasm, or a decompiler (this is hypothetical, in this case I would just use the .Net's Cryptography). Obfustcating my code would still keep it possible for someone to get the algorithm. So what I meant by client and server is set up a server at my business that would accept connections from the client and would then send any data (like the encryption algorithm) to the client, which would execute it and then erase the code from memory. Like I said this may not be the best way of doing things so other suggestions are welcome.

"I mean security of my code as in keeping the code from being viewed via ildasm or a decompiler."
I understand that. Just use SSL or SSH. The first link explains SSL and how you can achieve a level of trust in a system such as yours.
I wouldn't worry about a cracker knowing your code or not. Understand SSL and you have a good platform for not worrying about your source code. As I said above, verify everything you need to at the server level and you shouldn't have any problems.

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |