Search code examples
vb.netvisual-studioobfuscationdecompiling

Encrypt Visual Basic Project


Can I encrypt a Visual Basic project so it can't be decompiled by dotPeek or any other software? I have done some research and I can't find anything.


Solution

  • The question you have asked is an excellent example of The XY Problem, where you have problem X, come up with solution Y, and then ask how to perform or implement Y. I shall answer Y first and advise you on X, which is what you really should have asked, e.g. "If I have an API key in my source code, how can I keep it safe?".

    The answer to Y is kind-of yes. You can obfuscate your .NET assemblies in such a way that it becomes moderately difficult to determine exactly what the source code does. However, constant values, such as your API key, will be significantly easier to retrieve since it is a constant string value. The important thing to remember here is that obfuscation is not security, the API key most definitely can still be retrieved.

    The answer to X (the question you should have asked), and the advice that you should follow, is to not store the API key in your application at all. Have an external server that you can send requests to that will in turn use the API key to retrieve relevant data and perform operations. Having your own server as a middle-man means that you can ratelimit requests and authenticate users yourself if you choose to. API keys should never be stored in client-side code (unless you have things like public and private API keys, which I believe Stripe, among others, use).