Home - Forums-.NET - Spices.Net - obfuscation and Binary Deserailization

Spices.Net

NET code security, tools to protect, obfuscate, tamper defense, code and data safety, recover, convert, optimize, explore, browse and analyze .Net software.

This forum related to following products: Spices.Net Suite, Spices.Net Obfuscator, Spices.Net Decompiler

obfuscation and Binary Deserailization
Link Posted: 03-Sep-2007 02:48
Hi All,

We were facing a strange binary deserialization problem after the obfuscation. If any one can hint me what is wrong in this, thanks in advance.....


namespace SerializationTesting
{
    public class Helper
    {

        public static byte[] SerializeObjectByteArray(object SerializableObject)
        {

            BinaryFormatter objBinaryFormatter = new BinaryFormatter();
            MemoryStream objMemoryStream = new MemoryStream();
            objBinaryFormatter.Serialize(objMemoryStream, SerializableObject);
            byte[] Result =  objMemoryStream.GetBuffer();
            objMemoryStream.Close();
            return Result;
        }

        public static object DeSerializeObjectByteArray(byte[] ObjectGraph)
        {

            BinaryFormatter objBinaryFormatter = new BinaryFormatter();
            MemoryStream objMemoryStream = new MemoryStream(ObjectGraph);
            Object DataObject = objBinaryFormatter.Deserialize(objMemoryStream);
            objMemoryStream.Close();
            return DataObject;
        }

    }
}


namespace SerializationTesting
{
    [Serializable() ]
    public class Tester
    {
        public Tester()
        {
            
        }

        public Tester (string String1 , int Interger1 , DateTime Dt)
        {
            this.m_int1 = Interger1;
            this.m_str1 = String1;
            this.DateTime1 = Dt;
        }
        private string m_str1;
        public string Str1
        {
            get
            {
                return m_str1;
            }
            set
            {
                m_str1 = value;
            }
        }

        private int m_int1;
        public int Int1
        {
            get
            {
                return m_int1;
            }
            set
            {
                m_int1 = value;
            }
        }

        private DateTime m_dateTime1;

        public DateTime DateTime1
        {
            get
            {
                return m_dateTime1;
            }
            set
            {
                m_dateTime1 = value;
            }
        }

        public override string ToString()
        {
            return this.m_str1 + \" : \" + this.m_int1.ToString() + \" : \" +
                   this.m_dateTime1.ToString();
        }
    }
}

namespace SerializationTesting
{
    class Program
    {
        static void Main(string[] args)
        {
           try
           {
               Tester objTester = new Tester(\"TestString\", 10, DateTime.UtcNow);
               System.Console.WriteLine(\"Object Created..\");
               System.Console.WriteLine(objTester.ToString());
               byte[] data = Helper.SerializeObjectByteArray(objTester);
               System.Console.WriteLine(\"Object Serialized..\");
               Tester newTester = (Tester)Helper.DeSerializeObjectByteArray(data);
               System.Console.WriteLine(\"Object DeSerialized..\");
               System.Console.WriteLine(newTester.ToString());
               System.Console.Read();

           }
            catch (Exception e)
            {
                System.Console.WriteLine(e.Message);
                System.Console.WriteLine(e.InnerException.Message  );
                System.Console.WriteLine(e.StackTrace );
            }
        }
    }
}

Link Posted: 03-Sep-2007 18:50
To succesfully serialize/deserialize assembly members you should exclude classes used in serialization from obfuscation.
You can do it by following ways:
[list]
  • By using NineRays.Obfuscator.NotObfuscateAttribute that you can find in the \\SDK\\Obfuscation Attributes\\NineRays.ObfuscationAttributes.dll assembly. Just add a reference to this assembly to the references of your project to use control obfuscation attributes and mark class and its members used in serialization by
  • [NotObfuscate] attribute. It is not necessary to distribute the NineRays.ObfuscationAttributes.dll assembly with your application, this is a utlity assembly used only for marking assembly members that doesn't afftect code behavoir of your application.[/*:m]
  • By using ExclusionPatterns collection to exclude members from obfuscation. For example, addition of SerializationTesting.Tester* string will help you to exclude serializable class from obfuscation.
  • [/*:m][/list:u]