[SwagotMcFaggot]

pretty useless post tbh. somebody who doesn't understand how .NET binaries are compiled and how their code is interpreted is not going to maically be able to create their own obfuscator, or add anything valuable to ConfuserEX. also, isn't Enigma a native packer? does it even obfuscate the .NET? i assume mega dumper or some other .NET unpacker will be able to dump the actual IL code from memory....

Correct, engima is a native packer, but it does obfuscate the .NET and utilizes virtualization, etc.

[Aristocles]

Maybe, but this is not always possible nor always the best solution.

An active network connection is necessary, which is not only always present, and also slows down your program a lot when lots of traffic is going. But more importantly, some code (such file operations, starting or stopping processes, etc.) simply cannot be put on a remote server.

This is exactly like was discussed a few days ago.

this is the best anti reverse engineering solution, no matter what, since the data cannot be analyzed directly.

find me one case where this solution is possible and also where this solution is not the best ?

for active connection, its 2019 almost everyone got a decent internet access, at least cedent enough to upload the input and download the output of a remote execution code.
slow down your program, well yes and obfuscation too, and for traffic well you compensate the non-existence obfuscation cost with the servers cost.

[ＪＵＳＴＩＮ]

this is the best anti reverse engineering solution, no matter what, since the data cannot be analyzed directly.

find me one case where this solution is possible and also where this solution is not the best ?

for active connection, its 2019 almost everyone got a decent internet access, at least cedent enough to upload the input and download the output of a remote execution code.
slow down your program, well yes and obfuscation too, and for traffic well you compensate the non-existence obfuscation cost with the servers cost.

Huh? Obfuscation does not slow down a program nearly as much as remote code execution... and obfuscation is a very broad topic. Different obfuscation methods will affect the speed of your program differently, but none of these methods will slow down your program as much as using networking to call functions.

Some obfuscators even make optimizations to your code and can result in a positive impact. When methods are executed on a client in C# for the first time, their IL instructions have to be compiled to native machine code before they can even run. The JIT compiler, which preforms this task, can optimize your code in some cases. This means that your .NET code actually becomes a bit faster the second time it is called, and some modifications made to the IL code by an obfuscator will be removed on runtime. Every single time you call a function that is executed remotely, you'll have more latency than executing the same function on a users PC, even with a good connection.

Not that this matters, the difference is typically not significant in real world usage. I just figured I'd point that out. Remote code execution is not applicable in every situation. Washi is 100% correct. Some code simply can't be executed on a server, aka literally anything that interacts with your computer/file system/processes directly. Removing code from your client also doesn't necessarily prevent it from being cracked. As long as your server exists and is running, you should assume it's possible to obtain a crack of your software.

Even without taking that into account, it's simply rarely necessary. Any code that you feel must be completely removed from the program should've never been in the program in the first place. When you're writing code in an application that runs on a clients computer, you should assume that everything you're writing can be read by a reverse engineer. If you feel like it's vital that nobody else ever sees a particular function, you should've been writing it to be executed remotely from the get-go.

In situations where you feel remote code execution is necessary (and there are plenty of these scenarios) you should use it somewhat sparingly. Use it on functions that you have to use it on, don't use it on every function in the program. Most code that can be remotely executed via C# can also be accomplished by other languages that are meant to run on a servers back end.

It definitely has it's place, and I use it frequently, but I think a lot of people on HF simply don't know what to use it with and throw it around as if it's magic. Nowadays I'll try to write these super-secret functions in PHP so I can run the code from a cheap HTTP/web hosting server rather than an RDP or VPS that should have higher specs to try to minimize the latency added by remote code execution. If your client side code isn't secured, people will be able to call your remotely executed functions on their own. They wont know how it works, but they'll be able to access it.

[0xDEAD10CC]

this is the best anti reverse engineering solution, no matter what, since the data cannot be analyzed directly.

find me one case where this solution is possible and also where this solution is not the best ?

for active connection, its 2019 almost everyone got a decent internet access, at least cedent enough to upload the input and download the output of a remote execution code.
slow down your program, well yes and obfuscation too, and for traffic well you compensate the non-existence obfuscation cost with the servers cost.

You are just making the assumption that all software is targeted at home users that have the typical basic internet package. Regardless, there are cases where software might need to scan a network, and analyze data, and maybe create a report or something. How are you going to do that all server-sided exactly? Even if you delegated the non-scanning portion of that software to your SAAS solution, tighter corporate networks may be entirely locked down from having internet access at all, and there are still security critical situations where requirements are in place for everything to be done locally for risk mitigation reasons, even outside of the government world. There are other examples too aside from this where an internet hosted solution wouldn't be ideal.

[Aristocles]

Ok so both of you haven't read me I suppose now ? Because

1) my question is : "find me one case where this solution is possible and also where this solution is not the best ?" none of you answered that and you simply repeated what Washi wrote.

2) optimization on obfuscation-side is nearly insignificant since the compiler already do an amazing job.

3) "Even if you delegated the non-scanning portion of that software to your SAAS solution, tighter corporate networks may be entirely locked down from having internet access at all, and there are still security critical situations where requirements are in place for everything to be done locally for risk mitigation reasons, even outside of the government world." what are you on, keep me some. Since I propose a SaaS solution with remote server execution, that means you can do whatever you want on the server side, analyze data, create report or something, scan a network. You will have to adapt, or send encrypted data from customers computer to remote server to then analyze it.

I am well aware every product cannot be protected by that method. But find me one case where this is a possible solution AND where this is not the best solution ? I'm still waiting

[Washi]

Ok so both of you haven't read me I suppose now ? Because
...
I am well aware every product cannot be protected by that method. But find me one case where this is a possible solution AND where this is not the best solution ? I'm still waiting

Gotta be honest, could say the same about you now as you completely missed the point of my post :/

The point of my post was not to prove that remote execution is bad. In fact, it can be very useful and strong as you explained. The point is that your solution will not work for every use case, which means that it can never always be the best way to protect an application. As I, and both Justin and 0xDEAD10CC have briefly expanded upon, you cannot get past some limitations of either the program itself, the environment where the program is going to reside in, or the interest of the customer.

Reasons may include physical limitations. As mentioned before; no active permanent connection to the internet, doing file operations, or performing network scans etc. make it impossible to deploy a setup like this. Another thing people tend to forget is the introduction of security risks. Methods that are offloaded to a server have to be very securely implemented to prevent side-channel attacks or illegitimate usage and need to operate very carefully (think of input sanitization, or potential data leakage in the output, proper encryption for the traffic between client and server). Most methods are not coded to overcome these hurdles, as they were originally designed to be invoked locally and only serve one purpose.

Even if it were possible to overcome all these potential issues, investing in solutions that will allow for this kind of setup is not always what the programmer and/or customer is willing to do. You might lose potential customers if they hear your program can only operate with an active internet connection. Concrete example: I commute a lot, and work while I do so, which means I don't always have a permanent internet connection. I would absolutely hate to see if my favourite IDE prohibits me from using it because of this limitation. I know a few of my friends use Adobe Photoshop and Premiere on a daily basis for which a similar argument could be made. If we allow ourselves to mobile data usage, then just try to imagine how much data these kinds of programs will require you to transmit and receive. Not great for the customer's wallet.

To touch on the security part: A programmer will have to invest time in adjusting their code to allow for secure remote execution if it wasn't setup this way from the get go. The list of reasons goes on... Which brings us to exactly the point Justin was making. If you wanted to have methods executed remotely, the system should have been setup this way in the first place, not as a final thought.

I know you like promoting your product, even though you might do it without explicitly mentioning the name (e.g. nudging people into using an obfuscator with features that coincidentally match all the features you are providing in your own obfuscator). I don't blame you for that. We're not to downplay your service. But you gotta acknowledge that even though your product might be cool and all, it won't save the world from hunger and poverty. Not everything is an attack on you or your business.

[Aristocles]

Who is talking about my product ? Because I'm not, i'm explicitely telling OP not to use an obfuscator.
Nowadays people sell product that need internet no matter what you say. If you want to stick to 1999 go for it, the world is moving.


Again, find me one case where remote execution is a possible solution AND where this is not the best solution.

[Washi]

Who is talking about my product ? Because I'm not, i'm explicitely telling OP not to use an obfuscator.
Nowadays people sell product that need internet no matter what you say. If you want to stick to 1999 go for it, the world is moving.


Again, find me one case where remote execution is a possible solution AND where this is not the best solution.

I did ?

Even if it were possible to overcome all these potential issues, investing in solutions that will allow for this kind of setup is not always what the programmer and/or customer is willing to do. You might lose potential customers if they hear your program can only operate with an active internet connection. Concrete example: I commute a lot, and work while I do so, which means I don't always have a permanent internet connection. I would absolutely hate to see if my favourite IDE prohibits me from using it because of this limitation. I know a few of my friends use Adobe Photoshop and Premiere on a daily basis for which a similar argument could be made. If we allow ourselves to mobile data usage, then just try to imagine how much data these kinds of programs will require you to transmit and receive. Not great for the customer's wallet.

Nice of you for ignoring literally everything I said, and giving me that generous bytes donation.

[0xDEAD10CC]

"Even if you delegated the non-scanning portion of that software to your SAAS solution, tighter corporate networks may be entirely locked down from having internet access at all, and there are still security critical situations where requirements are in place for everything to be done locally for risk mitigation reasons, even outside of the government world." what are you on, keep me some. Since I propose a SaaS solution with remote server execution, that means you can do whatever you want on the server side, analyze data, create report or something, scan a network. You will have to adapt, or send encrypted data from customers computer to remote server to then analyze it.

You think a server is going to be able to scan an isolated network that it isn't even connected to? Have you even thought about the stupidity in what you believe to be true here? ❓ Any workaround for allowing this would be exposing a network to the public too, and I did mention "isolated network" so the context of what you're saying isn't really even on point with what I'm talking about here.

I know you can do all that on the server side, but it would require you to send the data to the server first if you're creating reports from data. With that said, now please re-read what I said becuase you obviously missed this part: "and there are still security critical situations where requirements are in place for everything to be done locally for risk mitigation reasons"

... In other words, for security reasons, sometimes the cloud is not a solution when dealing with sensitive information. Clearly you don't work in a corporate environment or you would be able to reason with these statistics instead of saying that it is the only way to go. It is not about not having the capabilities to get internet access, it is about whether it is feasible to do so, and sometimes it is not. Why do you think networks are separated into VLAN's and locked down with firewall rules? (Hint: There are other reasons, but a big one is security.) Not every part of the network needs internet access either, and allowing it so just so someone can use some features provided by an internet service is not how most corporations do things. Also, if you're hosting the service internally, then there's almost no need to worry about SAAS for a source code protection measure (although that wasn't the scenario I was describing).

Your solution may always be the best solution for HF kids, but in the real world it doesn't work the way you think it does.

[ＪＵＳＴＩＮ]

2) optimization on obfuscation-side is nearly insignificant since the compiler already do an amazing job.

i just explained to you that the code is optimized again before being used in memory... whether or not the obfuscator itself does a good job is irrelevant, i'm just letting you know that obfuscation typically wont result in a program running slower.
however, remote code execution WILL result in a program running slower 100% of the time.

Again, find me one case where remote execution is a possible solution AND where this is not the best solution.

you're supposed to read a post before responding to it. now a total of 3 people have explained this to you.
i'm not going to bother repeating what I've said, or what Washi said, or what 0xDEAD10cc has said.

[Aristocles]

Welp again none of you answered my question so you are just showing off really. The thing is, when the remote execution solution is possible, it's alway the best.

"Your solution may always be the best solution for HF kids, but in the real world it doesn't work the way you think it does." good, the guy asking for help nickname is Qiwi and he run https://leetsms.pw/ do you think i'm talking to someone ELSE than HF kids ? Nop. So your show off is irrelevent, and my solution is very accurate : remote execution, or get your thing cracked.

"i'm just letting you know that obfuscation typically wont result in a program running slower."

In general, obfuscation by renaming variables, methods, and classnames to more meaningless names does not impact performance (note that it CAN). Some vendors of obfuscation software even claim that aside from obfuscation, there is also a performance gain as much as 30%. Although I have never tested these claims, have never seen them proven, and therefore find them hard to believe.

However, do keep in mind that some software also enables flow obfuscation: adding meaningless control loops to statements so the code is harder to follow. That does have a negative effect on performance, albeit small.

[th3s3cr3t0n3]

Not sure if anyone has dropped this yet: https://github.com/yck1509/ConfuserEx

ConfuserEx is a pretty good tool, I've used it and automated the obfuscation by writing a batch file that runs on a build action.

It works really well and breaks any deobfuscation tool that tries to read it when you use the correct configurations. I've never asked anyone to try and reverse engineer the resultant DLLs though.

[Washi]

Welp again none of you answered my question so you are just showing off really. The thing is, when the remote execution solution is possible, it's alway the best.

Are you doing this on purpose? Maybe the colours of your screen are broken because I even highlighted the relevant part in my post. Let me try again:

Even if it were possible to overcome all these potential issues, investing in solutions that will allow for this kind of setup is not always what the programmer and/or customer is willing to do. You might lose potential customers if they hear your program can only operate with an active internet connection. Concrete example: I commute a lot, and work while I do so, which means I don't always have a permanent internet connection. I would absolutely hate to see if my favourite IDE prohibits me from using it because of this limitation. I know a few of my friends use Adobe Photoshop and Premiere on a daily basis for which a similar argument could be made. If we allow ourselves to mobile data usage, then just try to imagine how much data these kinds of programs will require you to transmit and receive. Not great for the customer's wallet.

Even though it is possible for your app to have a permanent connection (in the example, the developer using the IDE on a desktop), that does not mean it will in every environment (e.g. the developer using the IDE on a laptop). I also like how you keep ignoring any of the security risks we mention. Again, not saying remote execution is bad. It is just not always the best solution.

Instead of just saying "no I am right", actually provide a counter-argument. Now you're just making a fool out of yourself.

[tweety]

Welp again none of you answered my question so you are just showing off really. The thing is, when the remote execution solution is possible, it's alway the best.

"Your solution may always be the best solution for HF kids, but in the real world it doesn't work the way you think it does." good, the guy asking for help nickname is Qiwi  and he run https://leetsms.pw/ do you think i'm talking to someone ELSE than HF kids ? Nop. So your show off is irrelevent, and my solution is very accurate : remote execution, or get your thing cracked.

"i'm just letting you know that obfuscation typically wont result in a program running slower."

In general, obfuscation by renaming variables, methods, and classnames to more meaningless names does not impact performance (note that it CAN). Some vendors of obfuscation software even claim that aside from obfuscation, there is also a performance gain as much as 30%. Although I have never tested these claims, have never seen them proven, and therefore find them hard to believe.

However, do keep in mind that some software also enables flow obfuscation: adding meaningless control loops to statements so the code is harder to follow. That does have a negative effect on performance, albeit small.

calm down buddy, i think the two you're arguing with know how obfuscation works better than you, and you still didn't address/understand/acknowledge what @washi has said.

not sure why you fail to understand that remote execution isnt always the solution, even though saas is is a good way to keep your codebase safe depending on the nature of the software.

[GhostCode]

Not to mention there are systems that are - on purpose - isolated and not permanently connected to the internet.
Yes, there are many cases where remote code execution is a good choice, but its not always the case.