Categories
DevSecOps

Defining Data Obfuscation and How It Works Within Your Development

Reading Time: 5 minutes

Nowadays, the stakes of cybersecurity are higher and the methods of data breaches are becoming more sophisticated. Cyberattackers are inventing more lethal data breach strategies such as reverse engineering tools, decompilers, and disassemblers.

In response, developers must take extra steps to ensure the safety and security of their code and their users’ data. The healthcare industry is the most targeted by hackers, followed by the financial services and retail sectors. According to a study cited by the National Library of Medicine, there were 2216 incidences of data breaches reported across 65 countries in 2018 alone. Among these data breach incidences, the healthcare industry faced 536 breaches. 

Software development is one of the most affected industry sectors. In fact, data from the recent IBM report showed that software development was the target of 44% of all ransomware attacks in 2021. Findings from research conducted by Positive Technologies show that mobile banking applications are the most affected by cybercrime. The study also showed that common cyberattacks and cyber vulnerabilities are caused by names of classes and methods explicitly written in the source code, without being masked or encrypted through methods such as code obfuscation.

The need for masking is increasing as stakes in cybercrime rise. Data from CBinsights shows that data masking will grow to be an $800M industry by 2023. As you can see, data obfuscation is important for many reasons. Not only does it protect your intellectual property, but it also helps to keep user data safe and secure.

What Is Data Obfuscation and Why Should I Care?

So, what is data obfuscation? In their guide, Brunton and Nissenbaum define data obfuscation as “the deliberate use of ambiguous, confusing, or misleading information to interfere with surveillance and data collection projects.” In simple terms, it is a method of hiding data by making it difficult to interpret. App hardening is an excellent example of the use of data obfuscation and protection. It’s a technique used to protect information by making it unreadable and unusable to anyone who doesn’t have the proper key to unlock it.

This is accomplished by using some of the best practices of data protection such as encryption, code transformation, and watermarking. In the software development world, data obfuscation is important. It assists software developers to protect intellectual property, ensure the safety of user data, and prevent reverse engineering. For instance, software developers can prevent intellectual property theft through encryption. By encrypting code, it becomes much more difficult for non-authorized people to copy it or reverse engineer it.

The use of data obfuscation is becoming increasingly relevant, especially as businesses and start-ups move to the online space. A survey conducted by 451 Research LLC revealed that data obfuscation techniques are on the rise, partly due to accelerating DevOps and as developers’ access to production data rises. Findings from the survey revealed that 53% of organizations interviewed used data obfuscation methods to protect the organization’s developer infrastructure. However, mobile developers seem to be lagging behind in adopting data obfuscation strategies to prevent data breaches in their development activities. According to research by the Association for Computing Machinery, only 24.92% of the 1.7 million free Android apps from Google Play are obfuscated by the developers.

This is a concern because, as the number of mobile devices and apps increases, so does the risk of data breaches. A recent study by Kaspersky shows that nearly one-in-five (17% of internet users) have had private information leaked to the public without their consent. With the increasing number of data breaches, it is becoming more important than ever for developers to take measures to protect their code and user data. One way to do this is through data obfuscation.

Five Types of Software Vulnerabilities That Affect All Developers

As a developer, it is important to be aware of the different types of software vulnerabilities that can affect your code. By understanding these vulnerabilities, you can take steps to avoid them and keep your code safe. Here are five common software vulnerabilities:

1. SQL Injection

SQL injection is a type of attack that allows attackers to execute malicious SQL code on a database. This can be done by submitting malicious input into an application that then gets executed by the database. SQL injection can be used to access sensitive data, such as user passwords and credit card numbers. SQL injection can be prevented by using data obfuscation techniques, such as string encryption, and parameterized queries.

2. Cross-Site Scripting (XSS)

Cross-site scripting is a type of attack that allows attackers to inject malicious code into a web page. This can be done by submitting malicious input into an application that is then displayed on the web page. XSS can be used to steal sensitive information, such as cookies and session IDs. It can also be used to inject malicious code into the web page, such as JavaScript code that redirects users to a malicious site.

XSS can be prevented by using data obfuscation techniques, such as input validation and output encoding. Input validation involves checking user input to ensure that it is valid before it is displayed on the web page. PreEmptive’s Dotfuscator uses input validation to verify the application’s integrity during runtime.

3. Cross-Site Request Forgery (CSRF)

Cross-site request forgery is a type of attack that allows attackers to inject malicious code into a web page. This can be done by submitting a malicious link or form to a user. CSRF can be used to trick users into submitting sensitive information, such as their username and password. It can also be used to inject malicious code into the web page, such as JavaScript code that redirects users to a malicious site.

CSRF can be prevented by using data obfuscation techniques such as input validation and output encoding. Input validation involves checking user input to ensure that it is valid before it is processed by the application.

4. Session Hijacking

Session hijacking is a type of attack that allows attackers to take over a user’s session. This can be done by stealing the user’s session ID. Session hijacking can be used to access sensitive data, such as user passwords and credit card numbers. It can also be used to modify data, such as changing a user’s password or adding new users to a database. PreEmptive’s Dotfuscator is the best app shield against session hijacking.

5. Denial of Service (DoS)

Denial of service is a type of attack that prevents users from accessing a website or service. This can be done by overwhelming the website with traffic or by crashing the server. DoS can be used to make a website unavailable, such as by preventing users from being able to access the website or by slowing down the website so that it is unusable. Denial of service can be prevented by using data obfuscation techniques, such as input validation and output encoding.

Data obfuscation is an important tool that any developer should use in developing security application. By using data obfuscation techniques, such as input validation and output encoding, developers can make it much more difficult for attackers to inject malicious code into their web pages. This can help to prevent a wide range of attacks, including SQL injection, cross-site scripting, CSRF, session hijacking, and denial of service.


Don’t Let Your Data Fall Into the Wrong Hands

Data obfuscation is a critical step in software development, yet too often it is neglected. By understanding what data obfuscation is and how to apply it, you can protect your applications from hacking and tampering. PreEmptive’s comprehensive suite of obfuscation tools can help you secure your DevSecOps pipelines and investments. With our help, you can protect your systems and keep your data safe. Contact us today to learn more about our products and services!


Categories
Risk Management

3 Common Security Mistakes Developers Make in Their SDLC

Reading Time: 4 minutes

The systems development lifecycle (SDLC) is a process used by developers to create and deploy software applications. The SDLC provides a framework for security, quality assurance, and project management throughout the software development process. Security is of paramount importance in the SDLC, as developers must ensure that their applications are secure from attacks.

Quality assurance is also critical, as developers must ensure that their applications meet customers’ expectations. Project management is essential to the success of the SDLC, as it helps developers track their progress and ensure that they meet their deadlines. By following the SDLC, developers can create high-quality, secure software applications that meet customers’ expectations.

When it comes to developing software, the security of the final product should be a top priority. Unfortunately, this is not always the case. Security is often an afterthought, which can lead to vulnerabilities and exploits. 

3 Most Common Security Mistakes That Developers Make When It Comes to Cybersecurity

When it comes to developing software, the security of the final product should be a top priority. Security should be integrated into every stage of the SDLC, from initial planning to post-deployment. Here are three common mistakes developers make when it comes to security in their SDLC.

1. Not Using Software Security Tools to Prevent Cyberattacks

The first common mistake many developers make is failing to use the proper software security tools to prevent cyberattacks. They often try to develop their own tools or use free ones that are ineffective. This can lead to vulnerabilities in the code, which hackers can exploit.

Using software security tools can help developers find and fix vulnerabilities in their code, making it more difficult for hackers to capitalize on them. These tools can also help automate the process of checking and fixing vulnerabilities in the code, saving time and resources.

Different software security tools have varying roles in the SDLC. Some help identify potential security risks, some write secure code, and others test code for vulnerabilities. In-app protection tools assist in securing the app post-development. It is crucial to prioritize security at every stage of the SDLC to ensure that risks are appropriately mitigated and that the final product is secure.

There are many different software security tools available that can help prevent attacks. These tools can help find and fix vulnerabilities in the code. They can also help monitor the system for suspicious activity and block attacks.

PreEmptive offers a variety of  in-app protection tools that can be used throughout the software development lifecycle to secure code, aid in app hardening. and mitigate vulnerabilities. PreEmptive tools are designed to work with a variety of programming languages and platforms, making them versatile for developers. Whether a developer is looking to protect mobile apps, web apps, or desktop apps,  PreEmptive tools can help them secure the code and prevent vulnerabilities from arising.

2. Failing to Use Source-Code Analysis Tools

The second mistake developers often make is failing to use source-code analysis tools. These tools can help identify vulnerabilities in the code and provide recommendations for fixing them. Many developers are not  aware of these tools or do not use them properly. This can lead to serious security issues that could otherwise be avoided.

Source-code analysis tools can be used to find a variety of issues, including buffer overflows, SQL injection, and cross-site scripting. They can also help find vulnerabilities in third-party libraries. By using these tools, developers can find and fix vulnerabilities before hackers exploit them.

Source-code analysis aims to improve the security of an application by identifying potential vulnerabilities during the development process. Security issues can often be found in the code itself, so it makes sense to look for them early on.

Source-code analysis can be used at different stages of the SDLC. For example, it can be used to identify potential security risks during the requirements-gathering phase. During the design phase, it can also be used to ensure that security is built into the system, and it can be used during the testing phase to find any vulnerabilities that may have been introduced during development.

Once the source code is analyzed, the findings can be used to improve the security of the application. For example, if a potential vulnerability is found, the code can be fixed to prevent it from being exploited. Alternatively, if a security issue is found in a third-party library, the application can be redesigned to avoid using that library. The application can then be submitted to the  in-app software protection tools offered by PreEmptive for app hardening.

3. Not Doing Security Testing in All Phases of the SDLC

The third mistake that many developers make is not doing security testing in all phases of the SDLC. Security testing should be done throughout the entire process, from initial planning to post-deployment.  Security testing can help find and fix vulnerabilities in the code. It can also help ensure that the application is configured correctly and meets all security requirements.

Security testing can be done manually or with automated tools. Automated tools can help speed up the process and find more issues than manual testing. Security testing should be done regularly, even after the application has been deployed.

In most cases, security testing is treated as an afterthought, to be done right before the app goes live. Security testing in the earlier stages of development can help find and fix issues before they become a problem. Security testing should be done throughout the entire SDLC to ensure that the application is secure.


Conclusion

Cybersecurity threats are increasing in number and sophistication every day. Developers who want to stay ahead of the curve need to use the latest software security tools to prevent cyberattacks. While developers can make many potential mistakes in their SDLC, we’ve highlighted the three most common ones. Implementing security within the SDLC is critical to protecting applications from cyberattacks and data breaches.

PreEmptive offers high-quality, highly flexible, smart application protection, including app hardening, to a wide variety of industries, protecting and securing applications for a broad range of platforms, including .NET, Java/Android, JavaScript, and iOS.  Take a look at PreEmptive’s solutions today and see how they can help improve the application security posture.


Categories
Risk Management

Common Mistakes Developers Do When Building Apps

Reading Time: 5 minutes

With the rapid rate at which new apps are popping up, it goes without saying that app development is becoming increasingly popular. Over 143 billion apps were downloaded in 2021 alone. However, not all apps garner the success their developers may have initially hoped to achieve. Many end up getting uninstalled after their first use.

The competitive market is partly to blame for this. But mistakes that occur during the application development process are to blame as well. Here, we’ll go over eight of the most common mistakes developers make so that you can avoid them and position your app for success. 

1. Skipping Over Research

After coming up with or hearing an idea for an app, many developers want to dive right into bringing the vision to life. However, rushing in without research can lead to numerous issues and wasted money. 

Successfully developing and marketing an app relies on user research. Is there a need for the app? If so, who is the target audience — what are their demographics? And what are their typical behaviors and motivations?

Competitor research is also critical. If they’re also developing an app — or if they already have one — then keeping tabs on what they’re up to will help you create something unique and appealing. 

2. Striving to Create a “Perfect” App

There’s nothing wrong with wanting to create a great app that users will love. In fact, that’s usually the point. There’s no such thing as a “perfect” app, though. Trying to create something that’s free of all flaws could lead to a never-ending development cycle. Ultimately, you may never launch it. 

That doesn’t mean you can’t strive to develop an app that continues to improve over time. One way to do this is by creating a minimum viable product or MVP. An MVP is a version of an app that only includes the essential features it needs to work. You can then release it to early adopters who can assess its functionality and performance. Their feedback allows you to create a better final product, avoid time and budget waste, and may even speed up the time to launch. 

3. Failure to Test Properly

Testing is a critical component of the software development lifecycle (SDLC). It ensures a smooth, pleasant user experience and helps developers squash “bugs” before launch. The problem is that several challenges still exist

There are several strategies for dealing with common testing challenges. Here are a few that may help:

  • Develop a solid testing process that includes how often you’ll test an app and who will do it. 
  • Consider using in-house and outsourced testing experts. 
  • Make sure you have all of the proper tools to run tests.
  • Make sure there’s ample time to devote to testing (schedule it if you have to). 

4. Creating a Poor User Experience

It’s not uncommon for developers to get so entrenched in the development process that they forget about how users will interact with an app. Unfortunately, that mistake can be costly. A poor user experience is one of the top reasons people uninstall apps. 

Several issues can impact an app’s user experience, including:

  • Slow loading speeds
  • Difficult to navigate (it takes too many clicks for users to find what they need)
  • Unnecessary log-in pages
  • Intrusive ads
  • Low-quality content
  • Boring design

An essential consideration for a good user experience? The user! Put yourself in their shoes when assessing the overall experience. The feedback you get from your MVP version can come in handy, too.  

5. Trying to Squeeze Too Many Features and Functions Into the App

Unique features and functions that serve a purpose for app users are great. Trying to squeeze in too many, however, can be detrimental. 

For one thing, the more features you add, the more expensive the project becomes. Excessive features can bog the app down, hindering its performance and ruining the user experience. The app can also become too large and require too much space on users’ phones.

When determining what features to add to an app, consider if they’re necessary first. Leave out the ones that don’t offer any value. If you start hearing a call for specific features from users, you can add and optimize them later. 

6. Building for Every Possible Platform

You might feel tempted to develop your app for every possible platform right out of the gate. After all, it’s a surefire way to attract more users.

But trying to tackle multiple platforms from the start could quickly destroy your budget. It can also be incredibly time-consuming. Instead, consider starting with one platform — basing your decision on market research — and expanding to others after your initial launch. 

That doesn’t mean you can’t develop an app for more than one platform to start. Make sure that you have a cross-platform strategy, though. For instance, you could use a single source code on a cross-platform app development tool to deploy on Android and iOS devices. 

7. Ignoring Feedback 

Feedback has come up a couple of times already. Listening to what your app users have to say is critical for building an app that they want to use. It’s about more than just listening, though. It’s also about using that feedback to improve your app with each update. Along with eliminating pain points for your users, using customer input lets them know you care. That’s one of the best ways to earn their loyalty. 

What happens if you don’t listen? User satisfaction decreases, and people start uninstalling your app in favor of something else.

8. Neglecting the Importance of Security

A recent survey found that 86% of developers don’t view security as a top priority when writing code. Half of the respondents also said they wouldn’t be able to guarantee their code to be safe from common vulnerabilities. 

Hackers don’t only attack websites. Some can reverse engineer mobile apps to inspect them while they work or capture communications between an app and server. They can also use code-based attacks to steal data, get around security checks, or compromise your app’s integrity. 

Prioritizing security is a must. One way to do this is with comprehensive mobile app protection with PreEmptive. Applying a layered approach, PreEmptive Protection uses obfuscation, encryption, tamper-proofing, and more to make your apps more difficult for potential hackers to exploit. It integrates seamlessly into your build process and requires no code changes. Best of all, it goes wherever your apps go. 


Avoid Common Mistakes for Better Apps People Love to Use

App development can be a time-intensive and sometimes frustrating process. Even the best developers make mistakes from time to time. Understanding the most common ones can help you avoid them or manage them more effectively if they do happen. 

If you’re looking for ways to make your apps more secure, PreEmptive is here to help. Visit our products page for more information about our app protection, or check out our resources to see what else we can do for you!


Categories
Support Corner

Understanding Cross-Assembly obfuscation

Reading Time: 2 minutes

Enterprise application development involves several moving parts.  There may be different teams working on different components: server-side, client-side, GUI, API, database, etc.  Each component may have a completely different release cycle, and each team may be working completely independent of one another.  But however the work is divided, all these components must come together to work properly at runtime. Any professional application protection tool should have the ability to handle these complex scenarios without disrupting the development process.  

Dotfuscator’s Runtime

Dotfuscator is designed with that at the center. The tool allows users to get up and running quickly, while providing full control to adjust for specific project requirements.  Cross-Assembly Obfuscation is just one example of the many ways it provides us this flexibility. 

Dotfuscator treats its inputs as a set of related assemblies.  It examines all internal and external references, traverses the full inheritance hierarchy.  It then performs “Cross-Assembly Obfuscation” meaning classes, methods, properties and their references are renamed uniformly across all input assemblies.

Dotfuscator Flexibility

If it’s not feasible to obfuscate and deploy our entire application at the same time, this is not a problem for Dotfuscator.  It can be approached a few different ways, but the easiest to maintain is to build with Library Mode enabled for each project.  In Library Mode, Dotfuscator preserves public and protected types and member names and signatures.  Only private and internal types and members will be renamed.  Obfuscation transforms like Control Flow, String Encryption, and Tamper detection will be performed regardless of access modifier.  This ensures that calls to the obfuscated assemblies work properly whether the calling assembly has been obfuscated in the same project or not.  

Cross Assembly Obfuscation Example

A simple example can be downloaded here.  This shows the same set of assemblies (two dll’s referenced by one main exe) obfuscated two different ways.  In the first scenario, all assembly files are included in one Dotfuscator project.  In the second scenario, each assembly is obfuscated separately, with Library Mode enabled to preserve references between them.  In both scenarios, the obfuscated binaries come together to work properly at runtime. 


Stay tuned for our continuation article, we will examine other strategies for approaching obfuscation spanning different teams.  If you have feedback on this topic or other topics you would like us to discuss in the Support Corner, please feel free to contact our Support Department.


Categories
Risk Management

The Risks Of Not Using In-App Protection

Reading Time: 4 minutes

Businesses of all types rely on applications, in fact they have become the central way the majority of us live our lives. From online banking, to filing your taxes on your phone or attending a virtual doctor’s appointment. Every element of our lives is navigated by a mobile or desktop application

It’s not just users, companies are also reliant on applications. Using them to manage central operations, production, fulfillment and marketing. Organizations use applications in a myriad of fashions, by the same token every application adds further risk. 

Businesses are shifting online to meet emerging needs but are also being faced by an emerging risk landscape with expanding risk across the Internet of Things. Application protection as such is an essential component to protect every element of your organization. IP Theft, application attacks or data leakage can all have material impacts on the organization, reputation and adherence to regulations. The impact of failures in this regard can be expensive. In 2018 it was estimated that IP targeted cyber crime accounted for $50 to $60 Billion of global losses. The payment industry has established fines of up to $500K per incident for security breaches according to UCSC failure to comply for companies is clearly expensive. 

With that noted, it is important to examine the tacit consequences and long term impacts of not using in app protection:

Risk of Unauthorized Access

Unauthorized Access is a critical risk for the majority of industries that handle private information, specifically personally identifiable information. If a person who is not allowed to make use of your application starts making use of it then there are more chances that the individual will commit fraud. It is hard to predict the behavior or intentions of anyone but it is essential to take every proactive step to avoid unauthorized access. 

Vulnerabilities like Broken Authentication expose your applications to hackers gaining access and then committing fraud. Session management or credential management issues can easily enable hackers to gain access and commit fraud against your application. The worst part… these attacks often go unnoticed without in app protection or runtime checks. As we know the cost of breaches only goes up over time: A breach identified in 100 days costs approximately $5.99 Million, while a breach that takes longer can cost upwards of $8.7 Million. 

Hackers can also use access to your application to expose sensitive datam putting end users at risk of losing their personal data or facing the downstream risks of identity theft, data leaking and doxing. All of which present a tangible threat and will likely result in financial obligations for the organization, due to negligence and failure to protect their customers. It can also be as simple as privilege escalation, a user enabling additional privileges allowing them to control aspects of the application that should not be externally leveraged. A recent example is the 2017 Accenture attack.

Risk Of Fines & Financial loss

There is a reason that the top software companies like 1Password, Google & Adobe pay over $100,000 for researchers that identify vulnerabilities within their toolsets. The bug bounty is in fact a rapidly growing industry and entire organizations exist around identifying these vulnerabilities. A recent research report from IBM identified that finance security professionals detect just 56% of incoming attacks, managing 53% of these attacks and only preventing 31% of attacks completely. Organizations don’t have a comprehensive ability to mitigate risk, even if you are using SAST / DAST / IAST and penetration testing risks can still slip through the gaps. 

The average cost of vulnerabilities for all industries is approximately $13 Million. This combines the cost of paying for fines corresponding to regulation violations, the cost of remediating the risky vulnerabilities, the expense to prevent data from being leaked and the potential cost of IP being leaked. Then let’s lay on the cost of reputation damage, Security Magazine reports that 80% of customers will not continue to leverage a bank’s services if their information is compromised… this is probably justified. Organizations are equally skeptical of services following attacks and they will follow the example of customers.  But, reputation isn’t singular, organizations can also face the impact of loss of goodwill. It will impact your brand image and can prevent customers from even acknowledging the validity of your organization.

Risk of IP Loss

Intellectual property loss is likely the most pernicious risk of not using In App protection. It is often the case that applications include some form of intellectual property which could encourage competitors to copy, steal or leverage in their own applications. 

Reverse engineering is a significant issue for organizations, by enabling capabilities on the client side, users and hackers can gain access to and expose more functionality through the server siege of the application. Not obfuscating code enables these users to easily interpret the intended functionality of the application and identify how to replicate this operability. One recent example is American Superconductor, a U.S based provider of clean energy solutions. In 2011 their largest customer Sinovel ignored their contract and refused to pay millions of dollars owed. The company then obtained the source code for all of the electronic components and were able to install a pirated version into their wind turbines. The violation of the IP rights and loss of revenue can incur as much as $200 Million a year in losses. Without possibility for legal resources or ability to prevent continued leverage. 

IP trade theft costs organizations as much as 3% of Annual U.S. GDP.

But, what can be done to prevent these risks? 

Obfuscation, PreEmptive provides a layered approach that clings to the deployed application and helps to ensure any unidentified vulnerabilities that are hidden. Reducing the likelihood of hackers identifying and leveraging them. Obfuscation also protects your IP concealing the framework and structure of your application from corporate spying and ensuring your competitors can’t repurpose your sweat equity.

For more information about in-app security, visit our products page and start protecting your apps today!


Categories
Support Corner

Protecting a ClickOnce Deployed Application

Reading Time: 2 minutes

ClickOnce is a popular way to deploy and keep applications up to date without a lot of hassle.  These applications are downloaded to the end user’s machine after being published to the server, which means they can easily be decompiled and reverse engineered like other .NET applications. 

Protecting an application that is deployed via ClickOnce is usually very complicated.  After protection, the application and deployment manifests must be manually updated using the Mage tool.  Signing of manifests and assembly files must be done manually, as well. 

With Dotfuscator, we’ve worked to make this process much simpler.

Consider this Example

In 4x versions, Dotfuscator accepted the ClickOnce .application as direct input.  It would re-generate the obfuscated assemblies along with the updated .application package.  The updated deployment manifest and protected binaries would then be copied to the ClickOnce deployment server to be downloaded by the end-user.

Starting with version 6, we’ve made this process even easier.  We just have to integrate Dotfuscator into our application’s project file (.csproj, .vbproj).    

Doing so triggers Dotfuscator to run before packaging steps of our Release build.  Protected binaries are then automatically packaged for deployment.  No additional steps required.

We’ve worked with customers that deploy through ClickOnce, and also create an installer for offline installs.  This process allows us to do both without any additional steps.

A simple ClickOnce project with Dotfuscator integration can be downloaded here.  A release publish of this project generates obfuscated binaries.  Double-clicking the .application manifest simulates a download and install of the ClickOnce application on the client’s machine.

If you have feedback on this topic or other topics you would like us to discuss in the Support Corner, please feel free to contact our Support Department.


Categories
Dotfuscator Support Corner

Protecting Windows Forms Applications with Data Bound GUI Controls

Reading Time: 3 minutes

Today we will focus on data binding, but first let’s define this. Data binding allows Windows Forms applications to display and update UI controls from a data source, without having to modify source code for the control itself. 

When protecting Windows Forms applications, it is important to note how the data bound controls are constructed to determine if they will be impacted by code obfuscation.  If the controls bind to a collection of objects, original property names of that object must be preserved to correctly populate “DisplayMember” and “ValueMember” properties of the control.  When binding controls to an Enum, the original names of its members must be preserved, or the GUI control might show obfuscated names.  On the other hand, if we’re binding directly to a database table (and the table does not map to an object in source code), we don’t need any custom configurations because Dotfuscator does not mangle table and column names.

Consider the Following Example:

This simple Windows Forms application has three UI controls with different data binding techniques: a DataGridView binds to a Customer table in a database, a ListBox binds to a collection of Employee objects, and ComboBox binds to an Enum called DaysOfWeek:  

If I obfuscate with project defaults, I experience a runtime error at app startup:

This occurs because original property names of the Employee object are used in “DisplayMember” and “ValueMember” ListBox properties:

            listBox1.DataSource = employeeList;

            listBox1.DisplayMember = “Name”;

            listBox1.ValueMember = “Department”;

To Avoid the Runtime Error:

First, I’ll open my project configuration file (DotfuscatorConfig.xml) in the Dotfuscator Config Editor, and set a Rename exclusion for the properties in the Employee object:

After configuring this Rename exclusions, the application starts without the runtime exception, but the “DaysOfWeek” ComboBox appears with obfuscated names:

In order to fix this, I will configure a Rename exclusion for the members of DaysOfWeek.

After providing this Rename exclusion, the app starts without any issues or erroneous behavior.  Please also note the DataGridView, which binds to the Customer table in our database, did not require any Rename configuration to start and display correctly.

Conclusion

There are several different ways to use data binding in Windows Forms applications.  We’ve seen a few ways that data bound controls can be impacted by obfuscation.  If you experienced a runtime crash or erroneous UI behavior after applying obfuscation, please use the above steps to resolve the issue. 

The full example can be downloaded here.

If you have any feedback on this topic or other topics you would like us to discuss in the Support Corner, please feel free to contact our Support Department.