.NET has seen a surge in its popularity as a development platform since 2018, powered not least by the multiplatform capabilities introduced with .NET Standard. According to the Tiobe Index, C# currently ranks in fifth spot as a choice for developers in .NET, outranked only by Python, C/C++, and Java. Python is particularly in demand for internal projects or automation use cases, as Java is for servers, and .NET for end user devices. For traditional standalone and client applications, it is safe to say that .NET is a sure second choice alongside C/C++. Security matters, and it matters especially when applications are run out in the field, on an end user’s device. This is true for the end users themselves, as they don’t want their machines affected by malware or other harmful code, which is usually avoided by solutions like signed code. But it is also true for software developers who want to protect their work from piracy or IP theft. .NET differs from C/C++ in that the source code does not go through a compiler to run as machine code on a specific platform. Instead, it is turned into intermediate code that can still run on multiple platforms. The downside to this is that the intermediate code remains accessible for snooping and tampering by would-be attackers. License checks can be removed or replaced by forged ones, and business secrets contained in the code may simply be stolen. Our answer: AxProtector .NET from our CodeMeter Protection Suite. AxProtector .NET works perfectly with code signatures, meaning developers do not have to make that decision between security for the end user or protection for their own IP. They can, and should, have both. AxProtector .NET makes clever use of the easy legibility of the intermediate code: it extracts all the classes and methods contained in a .NET assembly and encrypts them piece by piece. The encrypted code is then placed back instead of the original code. During runtime, the methods are decrypted on the fly when they are called for. The actual intermediate code remains in the device’s working memory only for a brief moment to run through the Just In Time Compiler (JIT) and create the machine code, and then it is erased from memory. A native C/C++ component, CPSRT, takes over part of the decrypting and runs cyclical security checks in the background. By comparison to a straight-up .NET solution, adding this native component increases the security of the system again. CPSRT is available for most common platforms and processes, including Windows, macOS, Linux, Intel x86 and x86-64 as well as ARM and AARCH64. It does not normally mean any limitation to the application’s ability to run on multiple platforms.

1. CodeMeter Protection Suite Rüdiger Kügler, VP Professional Services
ruediger.kuegler@wibu.com
Axel Engelmann, Architect Protection Technologies
axel.engelmann@wibu.com
Protection and Licensing
.NET Applications
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 1

2. Where to find the accompanying audio
To access the on-demand replay of this masterclass, please visit
www.wibu.com//wibu-systems-webinars/protecting-and-licensing-net-
applications/access.html
09.03.2023 © WIBU-SYSTEMS AG 2023 - A Bit of License Management Magic 2

3. Disassembling a
.NET Application
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 3

4. Disassembling a .NET Application (Just Decompile)
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 4

5. CodeMeter
Protection Suite
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 5

6. CodeMeter Protection Suite
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 6
AxProtector
Windows
AxProtector
macOS
AxProtector
Linux
AxProtector
.NET
AxProtector
Python
AxProtector
JavaScript
AxProtector
Java
AxProtector
Android
Automatic Protection        
Modular Licensing        
IP Protection        
CodeMoving        
File Encryption planned planned planned    planned planned
Compile Time Obfuscation   

7. Variants of AxProtector .NET
 AxProtector .NET 10.30
 .NET Framework < 4.7.2
 AxProtector .NET (incl. AxProtector GUI)
 .NET Framework 4.7.2 or higher
 AxProtector .NET Standard
 .NET Standard 2.0 or higher
 AxProtector .NET NC (Native Core)
 .NET Framework 4.7.2 or higher, .NET Standard 2.0 or higher, .NET 5 or higher
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 7

8. AxProtector .NET NC – Targets
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 8
Windows
 Windows x86
 Windows x86_64
macOS
 macOS x86_64
 macOS ARM
Linux
 Linux x86_64 glibc
 Linux ARMhf glibc
 Linux AARCH64 glibc
 Linux x86_64 musl
 Linux ARMhf musl
 Linux AARCH64 musl

9. Protecting a
Single Assembly
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 9

10. Compiled Assembly Protected Assembly
Operating Principle of AxProtector .NET
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 10
Header Header
AxProtector .NET
AxEngine
(Security Engine)
2 33 E8 E1 CA
59 16 4B 75 53
E 24 C5 30 D8 85
C7 15 C2
C E6 7E 87 1B A8
9 81 53 62 DE A6 F4 AF
8 D1 D9 6D DD 1B 4 CB 82 63 82
F BD 5D 71
Start(arg) pi = (double) (2*y)
y = x * (2 + x) + 1 y = sin(x)
z = Math.Pow(10, prec) inc(ab)
if (CheckVal(x)) call (fit(y))
i += 10 for(i = 0; i < z; i++)
Picture:BM P0 FF
Icon:01 FF
String:Viewer
Picture:PN G0 FF 00
String:Open File Data:01 FF FF
Code (Methods)
Resources
9 6F F6 48 22 E7 B0 DA D1 4F 3E
2 59 D0 BD A A9 DD F4 67 44 DB
8 35 60 C3 50 C3
A8
6 4A 63 4C FE
5 9C B2 1E FA D3 DD 10 DD E0
3 8F EF C4 4C F0 79
A 5F E9 DC C5 2E C A2 3B 5D 7E
Encrypted Methods
Encrypted Resources
 Firm Code
 Product Code
 …

11. AxProtector .NET – ISV’s Side
 Encryption at vendor’s side
 Extracting the classes, the methods, and the executable code
 Producing the new assembly (same name)
 The new assembly looks the same, methods are encrypted individually and include
some additional information
 Resources are encrypted
 Inserting automatic security checks
 Reflection, remoting, etc. are still possible
 Name obfuscation as additional option available
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 11

12. AxProtector .NET – User’s Side
 Decryption during runtime
 When calling the method, its code will be automatically decrypted
 Only if the suitable license is available
 On-Demand Decryption of the executable code
 Decrypted IL code is removed automatically from memory after JIT compilation
 CpsEvents adopts flexible error handling
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 12

13. Just Decompile with a Protected .NET Assembly
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 13

14. Modular Protection of a
Single Assembly
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 14

15. Compiled Assembly Protected Assembly
Concept of AxProtector .NET (Modular Protection)
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 15
Header Header
AxProtector .NET
AxEngine
(Security Engine)
2 33 E8 E1 CA
59 16 4B 75 53
E 24 C5 30 D8 85
C7 15 C2
C E6 7E 87 1B A8
9 81 53 62 DE A6 F4 AF
8 D1 D9 6D DD 1B 4 CB 82 63 82
F BD 5D 71
Start(arg) pi = (double) (2*y)
y = x * (2 + x) + 1 y = sin(x)
z = Math.Pow(10, prec) inc(ab)
if (CheckVal(x)) call (fit(y))
i += 10 for(i = 0; i < z; i++)
Picture:BM P0 FF
Icon:01 FF
String:Viewer
Picture:PN G0 FF 00
String:Open File Data:01 FF FF
Code (Methods)
Resources
9 6F F6 48 22 E7 B0 DA D1 4F 3E
inc(ab) A A9 DD F4 67 44 DB
35 60 C3 50 C3 i += 10
1E FA D3 DD 10 DD E0
3 8F EF C4 4C F0 79
A 5F E9 DC C5 2E C A2 3B 5D 7E
8
5 9C B2
00 00 00 00
 …
 License Lists
assigned to different
methods

16. Modular Protection of a Single Assembly 1
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 16

17. Modular Protection of a Single Assembly 2
 Encryption with different license list for highest security
 Different effective key for code encryption
 Markup with an attribute
 Configuration in YAML-file
 Application behavior by WUPI calls
 Wibu Universal Protection Interface
 High-level API for easy integration
 No AxEngine/CpsEvents messages are shown
 You need both – encryption and API calls
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 17

18. Modular Protection of a Single Assembly 3
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 18

19. Modular Protection of a Single Assembly 4
 Alternative approach for error handling (no license found)
 Exception handling
 Global handler around assembly entry points to catch global licensing exceptions
 AxEngine/CpsEvents message is shown
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 19

20. Fine Tuning the
Performance
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 20

21. 0 s
10 s
20 s
30 s
40 s
Unprotected AxProtector .NET AxProtector .NET NC
Time Taken
Comparing a Method Executed 1,000,000,000 Times
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 21

22. 35 s
36 s
37 s
38 s
Unprotected AxProtector .NET AxProtector .NET NC
Time Taken
Comparing a Method Executed 1,000,000,000 Times
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 22
1,9 % performance loss < 0,2 % performance loss

23. Modular Protection of
Multiple Assemblies
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 23

24. Application by one ISV with different modules
 Best practice approach:
 One assembly – one license – one Product Code – encryption as single assembly
 Mixing protected and unprotected assemblies is possible
 Error handling in calling executable or in called library
 Each entry point is unencrypted and checks its own license first
 Library raises exception and executable catches exception
 Executable knows and checks license before loading library
 Same technical solution as single assembly
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 24

25. Application by different ISVs (Plugins)
 Encrypting plugins with individual Firm Code / Product Code
 Mixing different Firm Codes is possible
 Mixing with other licensing vendors is possible
 Error handing in library (plugin)
 Error handling at entry points
 Unencrypted entry methods
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 25

26. Multiplatform Protection
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 26

27. Multiplatform Protection
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 27

28. https://www.wibu.com
info@wibu.com
Europe: +49-721-931720
USA: +1-425-7756900
China: +86-21-55661790
Japan: +81-45-5659710
Thank you very much for your attention
2023-03-08 © WIBU-SYSTEMS AG 2023 - Protecting and Licensing .NET Application 28