Resource Encryption helps protect resources packaged in an application or library by encrypting them during the build process.
Resources often contain information that developers do not want to expose, such as:
- Images
- Configuration data
- Localization resources
- Embedded files
- Application assets
Without protection, these resources can often be extracted, copied, modified, or reused.
When Resource Encryption is enabled, Dotfuscator encrypts selected resources and injects the code required to decrypt them at runtime. The application continues to access the resources normally, while the stored resources are no longer directly accessible.
Resource Encryption supports both embedded resources and satellite resources.
Why Protect Resources?
Attackers frequently inspect assemblies to locate resources that may contain valuable information or application assets.
Common goals include:
| Resource Type | Potential Risk |
| Images and media | Copying or unauthorized reuse |
| Configuration files | Discovery of application behavior or settings |
| Localization resources | Extraction and modification of application content |
| Embedded files | Redistribution or tampering |
Resource Encryption helps reduce these risks by protecting resources from direct inspection.
Limitations
Resource Encryption does not currently support Mac Catalyst ARM64 assemblies.
Encrypting Resources
Resource Encryption protects resources embedded in .NET 5+ assemblies. When you encrypt resources in an assembly that uses satellite assemblies, Dotfuscator also encrypts the corresponding resources in the satellite assemblies while preserving their resource names.
- Build the application in Release mode.
- Open your Dotfuscator configuration in the Config Editor.
- Navigate to Settings.
- Set Disable Resource Encryption to No.
- Add the assembly that contains the resources you want to protect.
- Open the Resource Encryption tab.
- Select the resources you want to encrypt.
- Click Build to protect the application.
Dotfuscator encrypts the selected resources and injects the runtime decryption logic required to access them at runtime.
Verify the Results
After the build completes:
- Open the protected assembly in the Dotfuscated output directory.
- Open the assembly in a decompiler, such as ILSpy.
- Verify that the selected resources have been encrypted
If your application uses satellite assemblies:
- Open each culture-specific subdirectory in the output directory.
- Verify that the corresponding satellite assemblies were also protected.
- Confirm that the encrypted satellite resources retain the same resource names as the resources in the main assembly.