Xamarin Application code obfuscation

[giuseppenovielli]

Hi, thanks for maintenance ConfuserEx.

I want to known, there are some users that tried it into Xamarin Application, for Visual Studio For Mac 2019? There is some complete documentation?

Thanks!

[digocesar]

There are other issue to this question: https://github.com/mkaring/ConfuserEx/issues/24

[LaraSQP]

Obfuscate before packing

[giuseppenovielli]

@LaraSQP yes, but how? Where is steps to follow?

[LaraSQP]

I did for a project years back and is now on a HD somewhere.

Give me a few days.

[giuseppenovielli]

@LaraSQP Thanks very much! Share a simply project on github, and please check if now work yet.

[KvanTTT]

@LaraSQP you mean obfuscation on the source code level?

[LaraSQP]

Sorry, the project is gone.

But I found a lone copy of a csproj file with the following lines in it:

  <Target Name="Obfuscate" AfterTargets="_CopyIntermediateAssemblies" Condition="'$(Configuration)' == 'Obfuscated'">
    <Exec Command="ConfuserEx.bat" WorkingDirectory="..\ConfuserEx\" />
  </Target>

My guess is that ConfuserEx was called on the compiled assemblies in the obj folder before they are copied to the bin folder and, thus, were already obfuscated by the time the packing was done.

The key part then would be CopyIntermediateAssemblies

Hope it helps.

[giuseppenovielli]

@LaraSQP you have tried to obfuscate Android project with your method (add into .csproj code)?

I found this link https://forums.xamarin.com/discussion/comment/403804#Comment_403804 that means this approach not working.

[digocesar]

Yesterday we were able to set up our project to obfuscate the .net standard libraries and the common library between Android and iOS projects. We put an event in posbuild to run the obfuscation only in release and we had to change a setting in The android and iOS common project. Monday I'll give you better informativo.

[giuseppenovielli]

@digocesar Thanks very much!!

[LaraSQP]

@LaraSQP you have tried to obfuscate Android project with your method (add into .csproj code)?

I found this link https://forums.xamarin.com/discussion/comment/403804#Comment_403804 that means this approach not working.

I am not surprised it's obsolete. Xamarin forced me to change the approach several times back then.

Read the entire thread you linked to, btw, that guy has posted a solution down at the bottom that seem ok by this February. The concept seems to remain the same but the code has changed.

[digocesar]

We were able to obfuscate only the project libraries. The Android and iOS projects (which appear in the solution with a smartphone icon) were unable to obfuscate. And we are using the release 1.4.1!

Code of pos-build command in the projects:

cd "$(SolutionDir)"
if $(ConfigurationName) == Release (
  call "$(SolutionDir)..\libs\ConfuserEx\Confuser.CLI.exe" -n "$(ProjectDir)Confuser.crproj" 
)

*We versioned the ConfuserEx executable in 'libs' folder.

And here is our Confuser.crproj configuration:

<project outputDir=".\" baseDir="bin\Release\netstandard2.0" xmlns="http://confuser.codeplex.com">
  <rule pattern="true" inherit="false">
    <protection id="constants" />
    <protection id="ctrl flow" />
    <protection id="anti ildasm" />
    <protection id="rename" action="remove" />
    <protection id="resources" action="remove" />
  </rule>
  <module path="TCPConfig.dll" snKey="..\..\..\StrongName.snk" />
</project>

In .net framework we could use 'rename' and 'resources' protection. But in the common library that is .Net Standard 2.0 it wasn't possible. You need to test in your project what set of configuration should work.

And we needed to add this configuration to .csproj file of .Net Standard library so that referenced libraries are present on output folder. If it is not configured ConfuserEx will say that can not find some Xamarin libraries like Xamain.Forms.dll.

<PropertyGroup>
  <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
</PropertyGroup>

[mkaring]

Did you try to use the MSBuild package for obfuscating instead of the post build command? The main advantage of using it, is that it creates a project file containing explicit references to all files that are dependencies of the project.

[digocesar]

Hello @mkaring. I was using the "old" ConfuserEx in other projects and when I tested the Xamarin with ConfuserEx 2 I didn't see that there was this option with MSBuild and NuGet. A little while ago that I was seeing better the description of the project, I went to find this out. And I saw the configuration options to obfuscate the Android project. So I will end up testing this option as well. Best regards.

[giuseppenovielli]

Thank @digocesar i will try to obfuscate my open-source repository https://github.com/giuseppenovielli/XF-Prism-Full-Navigation-Example which contains a lot of files and library.

But i will try on mac os!

[redradist]

@mkaring @digocesar I think this link could be useful for obfuscating Xamarin.Android

https://www.codeproject.com/Tips/5164276/Using-ConfuserEx-to-Protect-Your-xamarin-forms-App

Is it possible to include this solution in ConfuserEx 2 ?

[redradist]

Yesterday we were able to set up our project to obfuscate the .net standard libraries and the common library between Android and iOS projects. We put an event in posbuild to run the obfuscation only in release and we had to change a setting in The android and iOS common project. Monday I'll give you better informativo.

@digocesar Can you share your solution, how you integrated ConfuserEx 2 with build of Xamarin.Android and Xamarin.iOS ?

Is it also working with Xamarin.Forms ?

[gsgou]

@giuseppenovielli could you share on this thread as well an info if you had success making it work with VS for Mac?

[giuseppenovielli]

@gsgou Sure! ;)

[gsgou]

@gsgou Sure! ;)

Thanks a lot for your effort and sharing. Its quite exciting addition as preemptive does not have any timeline to support VS for Mac in its community edition.

[redradist]

@giuseppenovielli Do you have some test project for this for sharing how you did this ?

[giuseppenovielli]

@redradist Not at the moment.

[giuseppenovielli]

@mkaring @gsgou @redradist @KvanTTT @LaraSQP

https://github.com/giuseppenovielli/XF-Prism-Full-Navigation-Example/wiki/Xamarin.Android-Obfuscation-with-mkaring-ConfuserEx

I have tried to obfuscate my open source Xamarin.Android project on Mac Os, with Visual Studio for Mac 2019 Community. Please see my wiki.

Please see, mostly my Feature and Note's Section.

@mkaring The main step is add target into PrismFullNavigation/PrismFullNavigation.Android/PrismFullNavigation.Android.csproj:

<Target Name="Obfuscate" AfterTargets="AfterBuild" Condition="'$(Configuration)' == 'Release'">
    <Exec Command="$bash /Users/hrcoffee2/XF-Prism-Full-Navigation-Example-master/PrismFullNavigation/obfuscator_2.sh" WorkingDirectory="$(SolutionDir)" />
  </Target>

1)But AfterTargets="AfterBuild" is corretly?? I don't known! So it means that Obfuscate Process will be start after 'AfterBuild' action when compile your project.

2)Why not embedded .dll obfuscated into .apk? I open .apk into assemblie folder and there is .dll not obfuscated!

3)Only .Net Standard can obfuscate. Why not Xamarin.Android .dll? It said that Xamarin.Forms.Xaml not find.

4. @mkaring i Install Confuser.MSBuild.Tasks but how used it?

[giuseppenovielli]

@digocesar Can you give more detail?

• When launch ConfuserEx process?
• When you release .apk .dll obfuscated is embedded in?

We were able to obfuscate only the project libraries. The Android and iOS projects (which appear in the solution with a smartphone icon) were unable to obfuscate. And we are using the release 1.4.1!

Code of pos-build command in the projects:

cd "$(SolutionDir)"
if $(ConfigurationName) == Release (
  call "$(SolutionDir)..\libs\ConfuserEx\Confuser.CLI.exe" -n "$(ProjectDir)Confuser.crproj" 
)

*We versioned the ConfuserEx executable in 'libs' folder.

And here is our Confuser.crproj configuration:

<project outputDir=".\" baseDir="bin\Release\netstandard2.0" xmlns="http://confuser.codeplex.com">
  <rule pattern="true" inherit="false">
    <protection id="constants" />
    <protection id="ctrl flow" />
    <protection id="anti ildasm" />
    <protection id="rename" action="remove" />
    <protection id="resources" action="remove" />
  </rule>
  <module path="TCPConfig.dll" snKey="..\..\..\StrongName.snk" />
</project>

In .net framework we could use 'rename' and 'resources' protection. But in the common library that is .Net Standard 2.0 it wasn't possible. You need to test in your project what set of configuration should work.

And we needed to add this configuration to .csproj file of .Net Standard library so that referenced libraries are present on output folder. If it is not configured ConfuserEx will say that can not find some Xamarin libraries like Xamain.Forms.dll.

<PropertyGroup>
  <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
</PropertyGroup>