Visual Studio Tools for Office (VSTO) has enabled .NET developers to extend the functionality of Office applications like Word, Outlook, and Excel since 2003. VSTO Add-Ins are deployed directly to the end user’s machine and triggered when the Office application starts. Because of this, VSTO Add-Ins can be easily decompiled and reverse-engineered like other .NET applications. As many developers can attest, this is an easy access point for hackers to gain control of your applications.
Most application hardening techniques are quite cumbersome for VSTO Add-Ins. After application hardening, the Mage tool must manually create or update the VSTO application manifest (.manifest) and deployment manifest (.vsto). The assembly and manifest files must also be signed separately.
Fortunately, protecting VSTO Add-Ins is made simple with PreEmptive’s Dotfuscator. We have to edit the project file (.csproj, .vbproj) to add tags that call Dotfuscator.
This will trigger Dotfuscator to run before our build’s packaging steps, so protected binaries are automatically packaged for deployment. This works whether we’ve created an installer or are using ClickOnce. No additional steps are required, and developers can implement it relatively easily.
A simple VSTO Add-In with Dotfuscator integration can be downloaded here. A release build automatically generates obfuscated binaries, and double-clicking the .vsto manifest installs the Word Add-In.
Although VSTO Add-Ins are being phased out in favor of the new Office Add-in, several VSTO applications are still in production and could benefit from Dotfuscator’s simple integration. If you have questions on this or other topics you would like us to discuss in the Support Corner, please contact our Support Department.
