Renaming is Dotfuscator's primary obfuscation feature.
When an application is compiled, the resulting assemblies contain names that can reveal information about the application's design and functionality. Class names, method names, property names, field names, and namespaces can help an attacker understand how the application works.
Renaming replaces these identifiers with new names that are difficult to understand while preserving the application's behavior. This makes reverse engineering more difficult and reduces the amount of information available to an attacker.
Renaming is enabled by default in Dotfuscator and is typically the first protection applied to an application.
How Renaming Works
Dotfuscator analyzes your application's assemblies and replaces eligible identifiers with new names. This renaming feature uses Overload Induction™, Dotfuscator's patented renaming technology, to increase the effectiveness of renaming by assigning the same name to multiple members when the .NET runtime can still distinguish between them based on their signatures. This makes decompiled code more difficult to understand and can reduce assembly size by increasing name reuse.
For example, the following is the original source code before Obfuscation:
private void CalcPayroll(SpecialList employeeGroup) {
while (employeeGroup.HasMore()) {
employee = employeeGroup.GetNext(true);
employee.UpdateSalary();
DistributeCheck(employee);
}
}The following is the reverse-engineered source code after Overload Induction Obfuscation:
private void a(a b) {
while (b.a()) {
a = b.a(true);
a.a();
a(a);
}
}After renaming, the application continues to function normally, but the resulting code is significantly more difficult to understand when viewed in a decompiler.
Enhanced Overload Induction™ extends this capability by allowing a method's return type or a field's type to be used when determining uniqueness. This can provide up to 15% more redundancy in method and field renames, further reducing the number of distinct names that appear in the protected assembly. Because source languages such as C# and Visual Basic do not allow overloading based solely on return type or field type, this technique can make decompiled code even more difficult to interpret.
Enhanced Overload Induction™ is disabled by default.
Benefits of Renaming
Reduce Reverse Engineering
- Makes decompiled code significantly more difficult to understand.
- Multiple methods may appear with the same identifier, making application logic harder to reconstruct.
- Renaming to illegal identifiers is unnecessary because decompilers already compensate for those names. Instead, Overload Induction increases ambiguity by safely reusing identifiers.
Reduce Assembly Size
Renaming can also reduce application size.
- Long identifiers are replaced with shorter names, reducing the size of a 20 characters long name by 90%.
- Reusing identifiers reduces entries in the string heap.
- Overload Induction delays the need for longer generated names by maximizing identifier reuse.
Limitations
Renaming is designed to preserve application behavior while making code more difficult to understand. However, some application technologies depend on identifiers remaining unchanged.
Examples include:
- Reflection
- Configuration files with entry points
- Third-party libraries that reference members by name
- Assemblies containing XAML
When these scenarios are present, you may need to exclude specific code elements from renaming. You must also fully test your application after enabling renaming to ensure all references update correctly.
Note: You must use only Lower Alpha or Upper Alpha renaming schemes for Xamarin.Android builds.
For more information, see Identify Renaming Exclusions.
Enhanced Overload Induction Considerations
Enhanced Overload Induction™ relies on compile-time analysis. Applications that use .NET Remoting cannot safely use this feature because remoting may throw an ambiguous match exception when multiple methods differ only by return type.
When using remoting:
- Disable Enhanced Overload Induction™ while continuing to use standard Overload Induction.
- Exclude remotely called classes from renaming if appropriate.
Because of this limitation, Enhanced Overload Induction™ is disabled by default.
Enhanced Overload Induction™ is also automatically suppressed for types marked as serializable. If this behavior is not appropriate for your application, you can change it by configuring the enhancedOIOnSerializables renaming option in the configuration file or by selecting Include Serializable Types in Enhanced Overload Induction on the Renaming Options tab.
Apply Renaming Protection
To apply renaming protection:
- Open your Dotfuscator configuration.
- Add the inputs you want to protect.
- Enable Renaming protection.
- Build the protected application.
- Test the protected application to verify that it functions as expected.
After the build completes, Dotfuscator generates protected assemblies that contain the renamed identifiers.
For more information, see Protect Your App With the Config Editor, Protect Your App with MSBuild, and Protect Your App Using the Command Line Interface.
Review the Results
After protection is applied, you can inspect the protected assembly using a decompiler to see how identifiers have been renamed.
Dotfuscator also generates a map file that records the relationship between original names and obfuscated names. This file can be used later to decode obfuscated stack traces.
For more information, see Map File Reference and Decoding Obfuscated Stack Traces.