So, Is It Worth The Upgrade?

The best parts of Dotfuscator Professional 2.0 are its excellent integration with VS.NET, overloaded induction, string encryption, the break ILDASM feature, flow logic obfuscation, support for incremental obfuscation and debugging, and support for the Compact .NET Framework. In addition, Preemptive includes excellent samples, help documentation, and a year of support and upgrades.

But it's not perfect. Dotfuscator Professional does not include maximal obfuscation out of the box; it should. You have to read the help files to turn on some of the features, such as string encryption, breaking ILDASM, and overloaded induction. The company acknowledged that this might need to be changed; a spokesman said, “Break ILDASM is off by default, but it could probably be on as a default setting.” For maximal obfuscation in your apps, see “Step 4 - Configuring the Project” in the Standalone GUI Quick Start help documentation.

Another modest setback is that Dotfuscator Professional is its cost. At $1,495, the price might be a bit steep for small development shops and independent contractors, but a Standard Edition is available for smaller budgeted development shops. The flip side is that you need Dotfuscator only on a build machine, so those without larger corporate budgets will only need one or two copies, putting it within the more modest budgetary constraints of even one-man shops.

The Standard edition is available for $395, but for that price you will have to give up compacting and pruning, support for the Compact .NET Framework, control-flow obfuscation, induction, incremental obfuscation, string encryption, and the ILDASM break feature. If you really want to prevent tools like Reflector from decompiling your code, you need the professional version's features.

Intermediate language, Just-In-Time compilation to support security checks as well as multi-language support, and a single linker are here to stay, because security is the biggest software risk we have. Unfortunately this means that decompilers and disassemblers are here to stay too, putting your intellectual property at risk.

A prudent rule of thumb is to make obfuscation as identifiable a part of your software development process as is analysis, design, coding, and testing. If you can't afford to throw away your company's competitive, intellectual property then you will want to obfuscate your assemblies before shipping them. Dotfuscator Professional is a slick proposition.