Track Software Distribution with Watermarking

Watermarking (PreMark) embeds identifying information into a protected application without affecting its runtime behavior.

Organizations can use watermarking to:

• Embed copyright information
• Identify software builds
• Track customer-specific distributions
• Investigate unauthorized software sharing

Unlike application metadata, a watermark is embedded directly into the assembly and is designed to survive normal use of the application.

How Watermarking Works

During the protection process, Dotfuscator embeds a watermark string into selected assemblies.

The watermark can contain any information meaningful to your organization, such as:

• Customer identifiers
• License numbers
• Distribution channel information
• Build identifiers
• Copyright information

After the protected assembly has been distributed, the watermark can be extracted to determine where the build originated.

Watermark Encryption

Dotfuscator can optionally encrypt the watermark before embedding it into the protected assembly.

Encryption helps prevent the watermark from being easily identified if an attacker examines the assembly.

When encryption is enabled:

• A passphrase is used to encrypt the watermark.
• The same passphrase is required when extracting the watermark.
• The resulting watermark may require more storage space within the assembly.

Use encryption when the watermark contains sensitive information or customer-specific identifiers.

Character Maps

Before a watermark can be embedded, Dotfuscator converts the watermark string into bytes using a character map.

Character maps help maximize the amount of information that can fit into an assembly.

Smaller character maps allow longer watermark strings but support fewer characters.

Choose the smallest character map that supports the characters required by your watermark.

Watermark Size Considerations

The amount of data that can be embedded depends on several factors:

• The size and complexity of the target assembly
• The selected character map
• Whether encryption is enabled

Larger assemblies can generally accommodate larger watermark strings.

Because Dotfuscator cannot determine the available watermark capacity until processing occurs, it cannot predict the maximum watermark size in advance.

If the watermark exceeds the available space, Dotfuscator can:

• Truncate the watermark and issue a warning
• Stop the build and report an error

Extracting Watermarks

Dotfuscator includes the premark command-line utility for extracting watermarks from protected assemblies.

The utility can:

• Read unencrypted watermarks
• Decrypt encrypted watermarks
• Process one or more assemblies

Use watermark extraction when validating builds or investigating software distribution.

Syntax

premark [options] assembly1[,assembly2,...]

Parameters

Options

Examples

Extract an unencrypted watermark:

premark MyApplication.dll

Extract an encrypted watermark:

premark -p=MyPassphrase MyApplication.dll

Best Practices

• Use meaningful identifiers that help trace a build to its source.
• Enable encryption when storing customer-specific information.
• Choose the smallest character map that supports the required characters.
• Test watermark extraction as part of your release process.
• Store passphrases securely if watermark encryption is enabled.

Related Articles

• The PreMark Editor
• Release Checklist
• Protect Your App with the Config Editor