.NET | Will Mworia's Blog

November 10, 2007 • 4:03 pm 3

Code Security and Learning by Reverse Engineering Code

There are many ways of learning to engineer software. One, of the more classic being reading Code and understanding how it does what it does. It’s structure, it’s content, it’s the next best thing to actually writing code yourself cos you see how someone else approached a problem and how they made their software work.

The only thing is, how do you get good code to read. One interesting way is by dissassembling code… which brings in the aspect of securing your code. I recently got curious about an assembly and ran ILDASM against it. To my surprise the assembly, which was meant to be a private company’s product dissassembled and right infront of me was all the IL! Of course my intention is not to pirate code or anything, I’m just satisfying curiosity and learning.

So, what do you do with raw IL? Well, if you want to step through the code easily you want to see the high level stuff, right? And here’s where a good dissassembler can come in handy. I use Lutz Roeder’s .NET Reflector.

It’s an awesome tool. You can check out an assembly’s source in IL, C#, VB.NET, VC++, Delphi and Chrome! (It so turns out that this assembly I’m looking at is VERY well coded, too bad they didn’t secure the code from being dissassemble).

Reflector gives you a really cool interface with a tree view of your assemblies, a pane showing the dissassembled code which has hyperlinks for the methods and such so you can be browsing a method and find a call to another method and this appears as a link which takes you to that method body and you have nifty back and forward buttons so you can go back to the original method you were looking at.

The cute thing is that by using a drop down menu you can switch languages to get the same source code in either of the languages supported. Now there’s a neat way to learn multiple languages at once!

Reflector supports .NET frameworks 1.x through 3.5 so all your fancy LINQ code will be decompiled without a problem.

Now that we know you can basically take an assembly from some software vendor that’s not properly secured and basically get the source back, what can the software vendor do to preven the wily software head from getting there software sources (right click and EXPORT in Reflector and you have all the source file PLUS the project files so you can fire away into VS and VOILA!). I am a dev so i understand VERY well why you would need to prevent this from happening.