Use Dotfuscator Professional to implement a multi-layered protection strategy for your .NET applications. Each of these layers provides an important piece of an overall protection strategy - if one layer is compromised, the other layers continue to provide effective protection, making it more difficult for attackers to understand, modify, and misuse your code.
Because different applications face different risks, you can choose the protections that best fit your security requirements.
How Dotfuscator Protects Your Application
Dotfuscator protects compiled .NET applications by combining static protection and runtime protection.
Static protection changes the protected assemblies so they are harder to inspect and understand after compilation. Runtime protection adds Checks that can detect suspicious conditions while the protected application runs.
Together, these layers help protect your application against different reverse-engineering and tampering scenarios.
Obfuscation Transforms
Obfuscation transforms operate on compiled code to modify the MSIL (Microsoft Intermediate Language) within your assemblies and make it nearly impossible for humans or automated tools to reconstruct your original logic.
| Protection | What it does | Common use |
| Renaming | Replaces meaningful type, method, field, and property names with less meaningful names. | Make decompiled code harder to understand. |
| Control Flow | Changes the structure of method bodies while preserving application behavior. | Make decompiled logic harder to follow. |
| String Encryption | Encrypts selected strings and decrypts them at runtime. | Make sensitive strings harder to find through static inspection. |
| Resource Encryption | Encrypts resources packaged in an app or library, making it more difficult to copy or alter them. | Protect embedded and satellite resources from unauthorized extraction or modification. |
| Smart Obfuscation | Automatically identifies and applies obfuscation rules for known API usage patterns and application types. | Maintain application functionality by automatically applying necessary renaming and removal exclusions for common technologies. |
These transforms are usually the first protection layers you configure. Dotfuscator enables some protection by default, and you can strengthen the settings after your first successful protected build.
Runtime Protection
Checks help protect an application while it is running. Dotfuscator can inject validation logic into an application to detect conditions that may indicate tampering, debugging, or misuse and respond with configured behavior or custom application logic.
| Check | What it detects | Common use |
| Tamper Check | Changes that may indicate the application has been modified. | Respond when the protected application appears to have been altered. |
| Debugging Check | Debuggers attached to the protected application. | Respond when someone tries to debug the application. |
| Root Check | Rooted Android devices. | Respond when an Android app runs in a rooted environment. |
| Shelf Life Check | Application use after a configured date or time period. | Limit use of time-sensitive builds, demos, or evaluation versions. |
When a Check detects a configured condition, it can trigger a response such as terminating the application, throwing an exception, or invoking custom application logic.
Always test both the normal case and the detected condition before release.
Additional Protections
Dotfuscator also includes features that help reduce application size and support software distribution scenarios.
| Feature | What it does | Use it to |
| Removal | Removes unused code, constant definitions including string literals, and metadata from protected assemblies. | Reduce application size and reduce the attack surface. |
| Watermarking | Embeds a custom marker into an application. | Identify a specific build or protected application. |
Supporting Protected Applications
Dotfuscator also provides features that help you build, deploy, and debug obfuscated assemblies.
| Feature | What it does | Use it to |
| Linking | Combines multiple inputs into a single output. | Simplify deployment in specific scenarios. |
| Incremental Obfuscation | Reuses renaming information between builds. | Keep renamed symbols consistent across releases. |
| Debugging Obfuscated Code | Helps interpret protected application behavior and stack traces. | Diagnose issues in released protected applications. |
Advanced Obfuscation Topics
Some projects require additional configuration because of specific language features, frameworks, target platforms, or runtime behaviors.
Review Advanced Protection Topics when your application uses features such as:
- Reflection
- Serialization
- XAML
- Dependency injection
- Dynamic loading
- Platform-specific application packaging
Choose an Integration Approach
Choose the approach that matches your project and build process.
| Scenario | Recommended Approach |
| You have a standard .NET, .NET Framework, Blazor, Avalonia, MAUI, or Xamarin project | Use Dotfuscator MSBuild targets. |
| You use a custom MSBuild project | Use the Dotfuscate MSBuild task or another alternative workflow. |
| Your build system is not based on MSBuild | Run Dotfuscator from the command line. |
| You need Dotfuscator to run after packaging steps | Run Dotfuscator after the normal build step. |
| You only have compiled .exe or .dll files | Create a config file and run Dotfuscator after compilation. |
| You use Azure Pipelines | Use the Dotfuscator Azure Pipelines extension. |