通过

How to prevent ILDASM from disassembling my .NET code

  • 项目

Long story short – you can use SuppressIldasmAttribute attribute. However, please note that it won’t prevent decompilers (such as .NET Reflector, ILSpy or JustDecompile) from reverse engineering your code.

Here are the details:

What is IL?

Intermediate Language (IL) is CPU-independent instructions and any managed (.NET) code is compiled into IL during compile time. This IL code then compiles into CPU-specific code during runtime, mostly by Just InTime (JIT) compiler.

What is ILDASM?

ILDASM is a tool installed by Visual Studio or .NET SDK and it takes a managed DLL or EXE and produces the IL code which is human readeble clear text.

How to get IL code from an assembly

For example, consider the following code:

using System;

using System.Text;

 

namespace HelloWorld

{

    class Program

    {

        static void Main(string[] args)

        {

            Console.WriteLine("Hello world...");

        }

    }

}

Put this code in a console project and build it, you will have an EXE file.

Then open a Visual Studio Command Prompt and type ILDASM and press enter. ILDASM should be opened. Open the EXE file you build from the code above in the ILDASM. You should see something like below:

 

If you double click on Main : void(string[]) then you can get the IL code of the Main method:

 

So, how can I prevent ILDASM from disassembling an assembly?

.NET has an attribute called SuppressIldasmAttribute which prevents disassembling the code. For example, consider the following code:

 using System;

 using System.Text;

 using System.Runtime.CompilerServices;

  

 [assembly: SuppressIldasmAttribute()]

 namespace HelloWorld

 {

     class Program

     {

         static void Main(string[] args)

         {

             Console.WriteLine("Hello world...");

         }

     }

 }

As you can see, there are just two differences:

1) We have added System.Runtime.CompilerServices namespace decleration.

2) We have added [assembly: SuppressIldasmAttribute()] attribute.

After building the application in Visual Studio, when we try to open the resulting EXE file in ILDASM, now we get the following message:

 

Does SuppressIldasmAttribute prevents my code to be decompiled using decompilers?

No. Decompilers are using System.Reflection namespaces and classes to decompile the code and It is not possible to secure your code using that attribute. Your only option is to use obfuscators to scramble your code although scrambling will only produce code which is more difficult to read and understand.

References

MSIL Disassembler (Ildasm.exe)
https://msdn.microsoft.com/en-us/library/f7dy01k1(v=VS.100).aspx

SuppressIldasmAttribute Class
https://msdn.microsoft.com/en-us/library/system.runtime.compilerservices.suppressildasmattribute(v=VS.100).aspx

--
AMB

Comments

  • Anonymous
    May 28, 2011
    so what?! reflector, ida-pro and lots of others don't care about it!don't waste your time.
  • Anonymous
    March 28, 2012
    The comment has been removed
  • Anonymous
    October 11, 2015
    The comment has been removed