如何保护我的 .net 应用程序免受反编译器的攻击？

Question

Okay so i have this C# application that connects to a database has the login and all that stuff but what if some guy just downloaded a decompiler saw my code got the connection string from my DB and did whatever he felt like? How can i protect myself from that? And even if i could protect my connection string how could i protect my acctual code?

Answer 1

You should never store critical information in your assemblies, exactly for this reason. There are numerous ways to obfuscate the information but they only delay the inevitable.

Remember: Security by obscurity is not safe

• Access the data on a server-side application and pass it to an authenticated client instead.
• Restrict the Database User Account to the minimal required rights (if you only need to read information - make sure it doesn't have write access, etc.)

Answer 2

but what if some guy just downloaded a decompiler saw my code got the connection string from my DB and did whatever he felt like? How can i protect myself from that?

That's a shame, isn't it ? There are only a few things you can do for that :

• Use a VPS ($$) and store the login part of your code online. You can, for that secificly, use LiteCode , and here is a tutorial : https://github.com/debug-hf/LiteCode-Example/
• Use an obfuscator to avoid decompilers and hackers to look at your code. The best so far is http://netguard.io . It includes free plans and all the premium plans are fully secured. All your strings are scrambled, melted, stored secretly in the file. Famous deobfuscator, such a De4Dot cannot handle it even if it handles more or less every obfuscators on the market !

Hope it helps :) Cheers

Answer 3

Connection strings can be encrypted in the config file

Connection Strings and Configuration Files

However, you cannot truly protect your code from people wishing to view what it does, you can only make it harder by obfuscation.

I would add that a proper security model could restrict access to both the physical files, and the database 'data', but that does depend on your deployment model.

Answer 4

您应该将连接字符串存储在 app.config 或 web.config 文件中。