我认为这个话题主要有两个方面。

A) .NET只是反向工程而不是原生的吗?

B)我们是什么类型的程序员?

标题: 保护.NET代码不受逆向工程的影响

我的观点:

Least preference to make commercial application in .NET, because it will expose even your comments on the built binary after decompile. (I don't know what is the logic to include the comments also with binary) So any one can just decompile it, rename/modify/change the look and resell the application in 24 hours. In native application rename/modify/change of look is not possible as easy as one could do in .NET Worried part in .NET is that you could get the whole project with solution from a single binary exe/dll.

想象一下现在的安全状况有多糟糕。 因此，即使是外行也可以轻松地对. net应用程序进行逆向工程。

如果它是本地应用程序，如c++ /VB6/Delphi，只有知道ASM的专家破解者才能修补exe，而不是像。net那样100%逆向工程。

但是现在整个世界都在使用。net，因为用它的高级特性和库很容易做项目。

好消息是，微软似乎在2020年支持。net的本地输出，这将使像我这样的程序员考虑将。net c#作为主要语言。

https://www.codeproject.com/Articles/5262251/Generate-Native-Executable-from-NET-Core-3-1-Proje?msg=5755590#xx5755590xx

不幸的是，你逃不掉的。最好的办法是用C语言编写代码，然后P/调用它。

这里有一个小小的catch-22，有人可能只是将您的应用程序反编译到CIL并杀死任何验证/激活代码(例如，对C库的调用)。请记住，用C语言编写的应用程序也会被更顽固的黑客逆向工程(看看现在的游戏被破解的速度就知道了)。没有什么可以保护您的应用程序。

最后，它的工作原理很像你的家，保护得足够好，这样就花费了太多的精力(意大利面条代码在这里会有所帮助)，这样攻击者就会转移到你的隔壁邻居(竞争:))。看看Windows Vista，肯定有10种不同的破解方法。

有包在那里，将加密你的EXE文件，并在用户被允许使用它时解密它，但再一次，这是使用一个通用的解决方案，毫无疑问已被破解。

激活和注册机制针对的是“普通人”:那些没有足够的技术知识来绕过它(或者就此而言，他们知道他们可以绕过它)的人。不要为饼干费心了，他们有太多的时间。

除了购买保护之外，您(或您的开发人员)还可以学习复制保护。

这些想法是:

首先，尝试编写一个将自己写入控制台的程序。这是一个著名的问题。这个任务的主要目的是练习编写自引用代码。

其次，您需要开发一种技术，以某种方式重写一些代码 可依赖于其他方法的CIL。

你可以编写一个虚拟机(但是使用。net)。在这里放一些代码。 最终，虚拟机运行另一个运行代码的虚拟机。 这是针对很少调用的函数的一部分，目的是为了不太降低性能。

将一些逻辑重写为c++ /CLI，并混合托管代码和非托管代码。这将使拆卸变得坚硬。在这种情况下，不要忘记提供x64二进制文件。

您不能完全保护任何应用程序(托管与否)。如果像Playstation和iPad这样的系统都被破解了——厂商甚至控制着硬件——你的应用还有什么希望呢?幸运的是，你并不是真的想这么做。在我看来，你需要确保你的应用程序足够安全，这样别人就不会意外地窃取你的产品。

例如，如果使用每台机器许可证，那么它不应该只在安装到新的第二台机器上时才能工作。你需要一个好的错误消息来防止额外的支持呼叫，但不要花费额外的时间让它难以解决，也不要用它来打击用户。

另一个例子是限时审判。甚至不用担心简单的事情，比如用户是否可以回滚系统时钟。这样做的人知道他们违反了您的许可，只要用户知道他们违反了您的许可，您就做得够多了。

You need to do this much because users don't care about your license. Licenses are made-up things that nobody cares about until they need to. No one reads them, and they really shouldn't have to. Therefore the best way to tell the user where the boundaries are is if the out-of-the-box behavior for your application complies with the license. In this first case that means either failing to install or installing in trial-version mode the second time. For the latter, it might just mean checking a plain-text date in a configuration file. Either way, make sure you handle it in an elegant, helpful, and respectful manner.

So that explains what it means do just that much. But why not go any further? Why not plug every little hole you can find? The answer is in two parts. First, if someone will cross the ethical threshold of consciously breaking your license terms — even in a simple way — they'll also be willing to do something more difficult or dangerous like pull your application from a torrent site — and there is a certain amount of danger involved in running applications downloaded from untrusted sources. Making it any harder is only a minor annoyance for these users and risks causing problems with your paying customers. Keeping it simple may prevent someone from digging into your application and releasing a more comprehensive crack. Second, you have few eyes available to look for flaws; the hackers have many, and they have more practice finding them. You only need to miss one little flaw, and your app will have the same distribution on pirate sites as if you did nothing. You have to be right every time; they only have to be lucky once. So the effort required is very high, and the likelihood of any measure of success is very low.

Ultimately, if someone wants to pirate your application (as opposed to just using it), and that is their main goal, they will. There's nothing you can do to stop them. This is the nature of software; once the files that make up your product are on a user's computer they will be able to do with them as they wish. This is especially relevant in managed environments like Java or .NET, but it definitely applies to native code as well. Time is on their side, and given enough time any digital security can be broken.

Since you can't stop users from pirating your product, your best course of action is to engage this class of user in a way the uses them to your benefit. It is often possible to get them working for you rather than against you. With that in mind, no matter what your application is, it's probably worth it to keep a free version that is almost completely functional and doesn't expire. The difference between even a US$1 price tag and free is huge, if for no other reason than that the customer doesn't have to trust you with their credit card. A free edition of your product will not only effectively kill pirated distribution (why risk a pirated version when you can be legitimate for the same price?), it has the potential to dramatically expand your audience.

结果是，你可能需要提高付费版的价格，这样最终你就有10万免费用户，而不是2000个用户，每人20美元，其中500人愿意为“专业版”支付99美元。这比你花大量时间锁定你的产品赚得更多。不仅如此，你还可以通过多种重要方式吸引这些免费用户并利用这种关系。

一是支持。悲观主义者会借此机会抱怨支持10万免费用户的成本增加，但令人惊讶的事情却发生了:你的产品基本上可以自给自足。在没有资金支持成本的大型开源项目中，您经常会看到这种情况。用户会挺身而出，让它成为现实。

Free users generally have reduced support expectations to begin with, and for good reason. All you need to do is mark the free edition as only qualifying for community support and put up a user-moderated online forum for that purpose. Your support knowledge base is self-generating, and advanced users will shepherd those who need extra hand-holding on your behalf. Even more importantly, this will allow you to identify and correct bugs faster, ultimately improving the quality of your product and lowering total support costs. This wasn't possible before because your user base wasn't large enough, but when you treat the free users as customers it can work very well.

另一个是反馈。通过观察你的论坛，你可以学到重要的改进想法，否则你可能从来没有考虑过。这可以让你最终将更多免费用户转变为付费用户，并创造出更有吸引力的产品，从而吸引更多用户。

最后，你需要考虑市场营销。所有这些免费用户现在都是粉丝，而不是对手，他们会采取相应的行动。不仅如此，当你发布下一个版本时，这些用户都将通过你批准的分发渠道，而不是其他未知的机制。这意味着在你的下一个版本中，你开始与更大的、高度感兴趣和支持你的观众建立联系。

The best features to reserve for the professional edition are tools aimed at making it easy to do corporate deployment and management. A cracker won't see these as a compelling enough reason to hack it for his own use, but for a business looking to buy 300 licenses and push it out company-wide this is a must-have. Of course, the professional edition will be pirated anyway, but again: don't sweat it because you probably wouldn't be able to sell the product to those pirates no matter what you did, so it's not costing you any revenue.

While psychologically it can be hard to give away your product this much, hopefully you can understand how it really is the best way to go. Not only that, it's the only way to go in the long term. I know someone is out there thinking that they don't want to do it this way. After all, they've got by just fine selling their locked-down $20 product for years. But that's just too bad, because if you don't do it this way, eventually someone else will. And their product will be just as good as yours, or close enough they can get away with claiming that. Then all of a sudden your pricing looks outrageous, sales drop dramatically, and there's nothing else you can do. You can opt for an additional middle tier if you must, but it's unlikely to help you.

混淆代码!在混淆c#代码中有一个例子。

你不能。

您可以采取一些步骤来增加一些难度，但最终本地机器上的任何可执行文件都是可以被破解的。最终，这些代码必须转换为本机机器码，每个可运行的应用程序都很容易受到攻击。

你要做的就是让它变得足够难破解，让它不值得人们去麻烦。

我有一些建议可以帮助你保护你的应用程序:

Obfuscate your code. Dotfuscator has a free edition and comes with Visual Studio. Use public/private key or asymmetric encryption to generate your product licenses. This ensures that only you can generate your license codes. Even if your application is cracked, you can be sure that they won't be releasing a key generator for your application, because it is impossible to reverse the key generating algorithm. Use a third-party packer to pack your .NET executable into an encrypted Win32 wrapper application. Themida is one of the better ones. This stops people from reflecting your application in .NET Reflector and makes it a pain to unpack for reversing. Write your own custom packer. If the third-party packers are too expensive, consider writing your own. Sometimes custom packers can be very effective, because there aren't well published methods on how to unpack them. The tutorial How to write your own packer gives a ton of good information on writing your own Win32 packer.

最终，如果人们想要破解你的应用，他们会的。看看所有的商业软件，它们有大量的资源来保护它们的应用程序，但它们在应用程序发布给公众之前就被破解了。

一个熟练的逆向工程师可以启动IDA-Pro，并像切黄油一样切开您的应用程序，无论您做什么。一个打包的应用程序可以被解包，而混淆只会阻止它变得像在公园里散步一样简单。您使用复杂许可代码所做的所有艰苦工作都可以通过一个单字节补丁来完成。

你只需要接受这样一个事实:人们很有可能会盗版你的软件。有些人无论如何都不会为你的应用程序付费，这些人是你不需要担心的。

然而，有许多企业永远不会冒着诉讼的风险，他们很乐意购买软件许可证，而许多计算机用户要么不想冒险，要么发现它是错误的，要么没有足够的技术知识来盗版。这些是你真正的客户，你应该把精力集中在为他们提供良好的用户体验上，而忽略那些破解你软件的人。

我的应用程序以前被盗版过，我认为这是对我个人的侮辱。我是一个小开发者，全身心地投入到一个应用中，而这些人却有胆量剽窃我的作品?!他们直接从我口袋里拿钱!

我立即添加了一堆严格的DRM代码，并试图破坏任何使用非法或破解副本的人。当然，我应该努力让我的应用程序变得更好，而不是试图阻止不可避免的事情。不仅如此，我还伤害了我真正的客户，因为我设置了这些额外的保护措施。

经过长时间的战斗，我意识到我是在与潮流作斗争，所有这些浪费的时间都是徒劳的。除了最基本的许可函数之外，我取出了所有的phone-home代码，并且再也没有回头。