Obfuscate Excel Add-in

Add-in Express™ Support Service
That's what is more important than anything else

Obfuscate Excel Add-in
 
Andrew Saunders




Posts: 17
Joined: 2006-03-21
Hello,

I am trying to obfuscate an Excel Add-in and having some difficulty. I am using VS2003 and Aspose.Obfuscator (free download www.aspose.com/Products/Aspose.Obfuscator). My project has the Shim project included and is strongly named, and I am using the setup project generated by Add-in Express. I have not obfuscated projects before so this is all new to me.

1) I am not sure which file to obfuscate in my project. Is it the MyAddin.dll found in the bin folder or is it the MyAddin.dll found in the obj\Release folder?

2) Aspose.Obfuscator generates the obfuscated version of MyAddin.dll together with an XML Map file in a folder called "Output" which is placed in the same directory as the original MyAddin.dll. It also generates an XML config file that is placed in the same directory as the original MyAddin.dll.

How to I get the obfuscated version of MyAddin.dll into my setup project in place of the original MyAddin.dll? It seems that everytime I rebuild the project it generates a new MyAddin.dll that overwrites the MyAddin.dll that exists in both the bin and obj/Release folders, so replacing them with the obfuscated version does not appear to work. Or am I supposed to remove the Primary Output from the project and add the obfuscated version of MyAddin.dll? Or something else?

3) I saw in another post that I should leave the namespaces and names of classes and methods unchanged. It also said that if using a shim to re-sign the assembly using the sn.exe tool. If this is the case then what are the steps involved to re-sign the assembly using this tool?

4) Is obfuscation the only way to provide protection from decompiling or is there something else I could be doing?

Many thanks in advance.


Posted 04 Jul, 2006 02:01:04 Top
Sergey Grischenko


Add-in Express team


Posts: 7233
Joined: 2004-07-05
Hi Andrew.

1. Usually the 'Release' versions of .NET assemblies are obfuscated.
2. We doesn't support Aspose.Obfuscator. Please ask the Aspose support team about it or read the documentation. However I will try to develop an example using the Aspose.Obfuscator and will let you know about results.
3. You can use the following command line:
sn -R myAssembly.dll sgKey.snk
Also please read the 'Delay Signing an Assembly' chapter in the MSDN library to learn more about the sn.exe tool.
4. Obfuscation is the best way to protect your code from being decompiled.
Posted 04 Jul, 2006 09:43:01 Top
Brad Smith




Posts: 49
Joined: 2005-11-22
I'm interested in the whole obfuscation thing, but it'll be a while before I have to worry about actual implementation. If the above exercise results in some sort of technote or sample, I'm sure a lot of us would be appreciative. From what I've been reading, it's not exactly straightforward.

Brad.
Posted 04 Jul, 2006 11:07:01 Top
Sergey Grischenko


Add-in Express team


Posts: 7233
Joined: 2004-07-05
Andrew, I have just tested Aspose.Obfuscator with the MyShimmedAddin example from the ADX installation package and it works fine needlessly to re-sign the add-in assembly.
Posted 04 Jul, 2006 11:23:36 Top
Andrew Saunders




Posts: 17
Joined: 2006-03-21
Thanks Sergey,

so once I obfuscate MyAddin.dll how to I add it to the setup project? Do I copy it into the "Release" folder and overwrite the unobfuscated MyAddin.dll then rebuild the setup project?


Posted 05 Jul, 2006 03:28:01 Top
Sergey Grischenko


Add-in Express team


Posts: 7233
Joined: 2004-07-05
Hi Andrew.

Just open the 'File System' editor of the setup project, right click on the 'Application Folder' and add the obfuscated MyAddin.dll assembly to the setup ('Add -> File' option of the context menu).
Posted 05 Jul, 2006 07:48:44 Top
Andrew Saunders




Posts: 17
Joined: 2006-03-21
Ok, so after I add the obfuscated MYAddin.dll what do I do with the Primary output from MyAddin, as I get the error that "Two or more objects have the same target location"?
Posted 05 Jul, 2006 08:09:38 Top
Sergey Grischenko


Add-in Express team


Posts: 7233
Joined: 2004-07-05
Just delete it.
Posted 05 Jul, 2006 08:19:25 Top
Andrew Saunders




Posts: 17
Joined: 2006-03-21
OK so when I do that it all builds fine, but when I try to install I get the following error messages.

Firstly I get
********************************************
Application Domain: DefaultDomain
Assembly Codebase: file:///C:/Program Files/Default Company Name/MyAddin1Setup/AddinExpress.Install.dll
Assembly Full Name: AddinExpress.Install, Version=2.5.1759.0, Culture=neutral, PublicKeyToken=null
Assembly Version: 2.5.1759.0
Assembly Build Date: 30/05/2006 3:38:26 PM

Exception Source: AddinExpress.Install
Exception Type: System.ApplicationException
Exception Message: An error occurred during the add-in registration process.
Exception Target Site: InstallAddin

---- Stack Trace ----
AddinExpress.Install.ADXProjectInstaller.InstallAddin(addinFullName As String, adxAssemblyName As String, check As String, gac As String, regasm As String)
AddinExpress.Install.dll: N 00245 (0xF5) JIT
************************************************

Then when I press continue I get this error message

*********************************************************
Application Domain: DefaultDomain
Assembly Codebase: file:///C:/Program Files/Default Company Name/MyAddin1Setup/AddinExpress.Install.dll
Assembly Full Name: AddinExpress.Install, Version=2.5.1759.0, Culture=neutral, PublicKeyToken=null
Assembly Version: 2.5.1759.0
Assembly Build Date: 30/05/2006 3:38:26 PM

Exception Source: mscorlib
Exception Type: System.IO.FileLoadException
Exception Message: Strong name validation failed for assembly 'MyAddin1.dll'.
Exception Target Site: nLoad

---- Stack Trace ----
System.Reflection.Assembly.nLoad(fileName As AssemblyName, codeBase As String, isStringized As Boolean, assemblySecurity As Evidence, throwOnFileNotFound As Boolean, locationHint As Assembly, stackMark As StackCrawlMark&)
AddinExpress.Install.dll: N 00000 (0x0) JIT
System.Reflection.Assembly.InternalLoad(assemblyRef As AssemblyName, stringized As Boolean, assemblySecurity As Evidence, stackMark As StackCrawlMark&)
AddinExpress.Install.dll: N 00307 (0x133) JIT
System.Reflection.Assembly.LoadFrom(assemblyFile As String, securityEvidence As Evidence, hashValue As Byte[], hashAlgorithm As AssemblyHashAlgorithm)
AddinExpress.Install.dll: N 00095 (0x5F) JIT
AddinExpress.Install.ADXProjectInstaller.InstallAddin(addinFullName As String, adxAssemblyName As String, check As String, gac As String, regasm As String)
AddinExpress.Install.dll: N 01057 (0x421) JIT
*************************************************

Any ideas on how to fix this?
Apologies for asking so many questions about this.




Posted 05 Jul, 2006 08:42:01 Top
Sergey Grischenko


Add-in Express team


Posts: 7233
Joined: 2004-07-05
Andrew, try to re-sign the assembly after the obfuscation process.
Just run the following command line:
sn.exe -R <the name of the obfuscated assembly>.dll <the name of the file that conains the add-in strong name>.snk
Posted 05 Jul, 2006 09:55:34 Top