This article describes the Dotfuscator command-line executable, supported command-line options, and how command-line options interact with configuration files.
For an introduction to protecting applications from the command line, see Protect Your App from the Command Line.
Install Location
The location of the Dotfuscator command line depends on how Dotfuscator was installed.
| Installation Package | Directory |
|---|---|
| Windows Installer | %DOTFUSCATOR_HOME%\dotfuscator.exe |
| NuGet Package | {install dir}/tools/programdir/dotfuscator.dll |
where
| Variable | Description |
|---|---|
| %DOTFUSCATOR_HOME% | Environment variable that points to the Dotfuscator installation directory. |
| {install dir} | Directory where the Dotfuscator NuGet package was installed. |
Running CLI
Windows Installer
The Windows Installer version is a .NET Framework 4.7.2 application. Run it like any WIndows console tool:
%DOTFUSCATOR_HOME%\dotfuscator.exe%DOTFUSCATOR_HOME% to your system PATH, allowing you to run dotfuscator from any command prompt.NuGet Package
The NuGet version is a framework-dependent .NET 6 application. You must have the .NET 6 runtime or higher installed before running the CLI:
dotnet {install dir}/tools/programdir/netcore/dotfuscator.dllor
{install dir}/tools/programdir/netcore/dotfuscatorCommand Syntax
Command line options may begin with the '/' or the '-' characters.
Command Line Options:
Usage: dotfuscator [options] [config_file]Standard Options
The following is a summary of the standard command line options.
| Standard Options | Description |
|---|---|
-i |
Performs an investigation-only build. Dotfuscator simulates the build but does not generate protected assemblies |
-p=<property list> |
Sets user-defined properties in the configuration file. |
-q |
Suppresses verbose output. |
-v |
Displays additional build information. |
-nologo |
Suppresses the copyright and license banner. |
-? |
Displays command-line help. |
-?? |
Displays extended command-line help. |
[config_file] |
Specifies the Dotfuscator configuration file to use. |
Property List
The -p option accepts a comma-separated list of property assignments.
Example:
-p=outdir=c:/temp,name=MyAppValues containing spaces must be enclosed in quotation marks.
-p=MyProperty="value has spaces"Extended Options
Extended options allow for basic obfuscation from the command line, without requiring you to first create a config file. If you use a config file with an extended command line option, the command line option supplements or overrides the commands in the config file.
| Extended Options | Description |
|---|---|
-in [+|-]<file>[,[+|-]<file>] |
Specify inputs. Any combination of assemblies, package files or directory file masks can be specified. Use a prefix to obfuscate input as library mode (+) or private (-) assembly. The default is governed by assembly file extension (EXEs are private; .DLLs are run in library mode). |
-out:<directory> |
Specify output directory. Default is ./Dotfuscated. |
-honor:[on|off*] |
Toggle honoring obfuscation attribute directives found in all input assemblies. |
-strip:[on|off*] |
Toggle stripping obfuscation attributes from all input assemblies. |
-makeconfig:<file> |
Deprecated, use genconfig. Saves most runtime options (from command line and config file if present) to <file>. Allows build to proceed. |
-genconfig:<file> |
Save all runtime options (from command line and config file if present) to <file>. Does not run a build. |
-debug:[on|off*|auto]
|
Emit debugging symbols with output assemblies. Using this option with the on setting is deprecated; please use the auto setting instead. |
-license:<license-string>
|
Specifies a Dotfuscator license string to activate and use for this run of Dotfuscator. Typically this option should be used for a Floating License. The value of this option is used even if another license is specified by an environment variable or in the license file. |
-suppress:[on|off*] |
Add the SuppressIldasmAttribute to supported output assemblies. |
-disable |
Disable all transforms regardless of other options |
-mono-compatible:[on|off*] |
Use only Mono-compatible transforms. |
-rename:[on|off*] |
Enable/disable renaming. |
-mapout:<file> |
Specify output mapping file. Default is ./Dotfuscated/map.xml. |
-mapin:<file> |
Specify input mapping file. |
-clobbermap:[on|off*] |
Specify map file overwrite mode. |
-keep:[namespace|hierarchy|none*] |
Specify type renaming scheme. |
-prefix:[on:off*] |
Append a prefix to all renamed types. |
-enhancedOI:[on|off*] |
Use Enhanced Overload Induction. |
-refsrename:[on*|off] |
Rename referenced metadata defined only in input map file. |
-naming:<naming option> |
Specify identifier renaming scheme, where <naming option> is one of: loweralpha, upperalpha, numeric, or unprintable. |
-controlflow:[high*|medium|low|off] |
Set control flow obfuscation level. |
-encrypt:[on*|off] |
Enable/disable string encryption. |
-prune:[on*|off|const] |
Enable/disable removal, or enable constant-only removal. |
-rmout:<file> |
Specify removal report file. By default no report is written. |
-rmclobber:[on|off*] |
Enable/disable overwriting the removal report without backing up an existing copy. |
-link:[[+][,[+]],]out= |
Specify assemblies to link into named output assembly. A '+' prefix indicates a primeassembly. Omit the list to link all inputs, using first input as the prime assembly. You can specify multiple link options on the command line. |
-link:off |
Disables linking. Linking is off by default unless you pass a config file with linking options. This option is useful for that scenario. |
-premark:[on|off*|only] |
Enable/disable watermarking. "Only" option disables all other transforms. |
-watermark: |
Specify the watermark string. Quotes are optional. By default, all input assemblies are watermarked with this string. |
-passphrase: |
Optionally specify a passphrase to use for encrypting thewatermark string. |
-charmap: |
Specify a character map to use to encode the watermark string. The name must be one of the supported character maps. See Character Maps. |
-smart:[on|off] |
Enables/disables Smart Obfuscation. See SmartObfuscation. |
-soreport:[all|warn|none] |
Sets the verbosity level of the reporting output of the Smart Obfuscation functionality. See SmartObfuscation. |
-soout:<file> |
Specify smart obfuscation report file. By default no report is written. |
-soclobber:[on|off*] |
Enable/disable overwriting the smart obfuscation report without backing up an existing copy. |
Supplementing or Overriding a Config File from the Command Line
Dotfuscator has the unique ability to accept a complete or partial config file, yet allow you to supplement or override its options from the command line. This allows you to quickly adjust and tweak settings using a standard config file as a template.
| Command Line Option | Config File Option | Notes |
|---|---|---|
-in [+|-][,[+|-]] |
input section | adds |
-out: <directory> |
output section | overrides |
-honor:[on|off* ] |
inputassembly section | overrides |
-strip:[on|off*] |
inputassembly | overrides |
-debug:[on|off*|auto] |
debugauto, debug, debugimpl, debugopt, and pdb options |
overrides |
-suppress:[on|off*] |
Sets (or unsets) the suppressildasm global option |
overrides |
-disable |
Sets "disable" option in renaming, controlflow, stringencrypt, and removal sections | overrides |
-rename:[on:off] |
Sets (or unsets) "disable" option in "renaming" section. | overrides |
-mapout:<file> |
"mapoutput" section | overrides |
-mapin:<file> |
"mapinput" section | overrides |
-clobbermap:[on|off] |
"overwrite" attribute in "mapoutput" section | overrides |
-keep:[namespace|hierarchy|none] |
Sets (or unsets) renaming options: "keepnamespace","keephierarchy" | overrides |
-enhancedOI:[on|off] |
Sets (or unsets) "enhancedOI" renaming option | overrides |
-refsrename:[on|off] |
"obfuscatereferences" attribute in "mapinput" element. | overrides |
-naming:<naming option> |
Sets the "scheme" attribute in the renaming section, where <naming option> is one of: loweralpha, upperalpha, numeric, or unprintable. |
overrides |
-controlflow:[high|medium|low|off] |
Sets the "level" attribute in the controlflow" section. The off flag sets the "disable" option. | overrides |
-encrypt:[on|off] |
Sets (or unsets) the "disable" option in the stringencrypt* section. | overrides |
-prune:[on|off] |
Sets (or unsets) the "disable" option in the removal section. | overrides |
-rmout:<file> |
Sets the "removalreport" option in the removal section | overrides |
-soout:<file> |
Sets the "file" attribute on the "smartobfuscationreport" option in the smartobfuscation section | overrides |
-link:[[+]<name>[,[+]<name>],]out=<name> |
Sets sub-elements of the element | overrides |
-link:off |
Sets the "disable" option in the linking section. | overrides |
-premark: [on|off*|only] |
Sets (or unsets) the "disable" option in the premark section. The "only" setting is not saved to the config file. | overrides |
-watermark |
Sets the element. | overrides |
-passphrase |
Sets the element and sets the usepassphrase option. | overrides |
-charmap |
Sets the "encoding" attribute in the premark section. | overrides |
For more information on renaming schemes and their limitations, see Config File Reference.
Examples
Obfuscate a Library
dotfuscator -in:my.dllObfuscates my.dll as a library (visible symbols preserved and unpruned) with renaming, control flow, removal, and string encryption turned on. The output assembly is written to a directory called ./Dotfuscated, and the map file is written to ./Dotfuscated/map.xml since no output directories were specified.
Obfuscate an Application
dotfuscator -in:-myapp.exe,-private.dllObfuscates myapp.exe and private.dll together as a standalone application. Even visible symbols inside the DLL are obfuscated. Removal is enabled based on the entry point method contained in myapp.exe.
dotfuscator -in:myapp.exe -mapo:MyName.xmlObfuscates myapp.exe as a standalone application and writes the renaming map to MyName.xml .