3 ms·

Tell HN: My new product, Dotpack, a .NET binary packer

40 points by daeken 17y ago

huhtenberg 17y ago
How is it better than UPX?
- daeken 17y ago
  UPX and other binary packers out there don't support .NET binaries in any way. There's only one other .NET packer that I'm aware of, and it seems to be dead (the only traces of it are on shady shareware sites) and quite old.
johns 17y ago
Is the long-term goal going after SmartAssembly's market?
- daeken 17y ago
  Redgate (owner of SmartAssembly) and Remotesoft in general. Yes. Their tools don't work worth a damn and they sell way, way too many licenses. I'd love to take a large chunk out of their market.
  - johns 17y ago
    In fairness to Redgate, their tools have always worked for me. SmartAssembly worked pretty well when I used it too. They're just ridiculously expensive. So I would love to see some good competition for them.
    - daeken 17y ago
      They 'work', but they don't protect your code in any way. Beyond removing names from your code, they really don't do anything useful. It really seems to me like the people working on these obfuscators have never looked at unmanaged code obfuscators used in the wild -- with the amount of data available with .NET assemblies, you can do a whole, whole lot.
    - ComputerGuru 17y ago
      He's going to be charging 500USD per user per year. {sa} charges 500USD per user.
      - daeken 17y ago
        My price is certainly high, but if there's one thing I've learned in business it's that it's much easier to lower your price than to raise it.
        nkohari 17y ago
        That's true, but at a $500 price point, you're also reducing your market substantially due to price elasticity. Be sure to lower the price quickly if you feel like you're not getting traction.
        maxklein 17y ago
        If there is one thing I've learned is that people hate subscriptions.
  - ComputerGuru 17y ago
    Sorry, but bashing your competition doesn't make you look "cool." I reviewed {smartassembly} back in 2007 (http://neosmart.net/blog/2007/smartassembly/ http://neosmart.net/blog/2007/smartassembly/) and till now it remains hands-down the best obfuscation and post-release-processing tool for .NET applications. For larger projects the obfuscation can break the product. It's tedious work, but you can manually exclude functions from the obfuscation procedure until you can find out where things went wrong.
    - daeken 17y ago
      I'm not terribly concerned about looking "cool", I'm simply stating what everyone who's reverse-engineered such obfuscated assemblies knows. These tools simply don't protect your code at all. I think it's a travesty that these tools sell as well as they do while doing nothing to hinder reverse-engineering. Edit: For the record, I performed quite a bit of reverse-engineering on Magic: The Gathering Online, which uses SmartAssembly for obfuscation. Despite it being heavily obfuscated, an hour with Mono.Cecil got me a clean binary with placeholder names. That is simply unacceptable.
      - viggity 17y ago
        I understand spending time on deobsfucation. But what about assembly encryption ala http://www.eziriz.com/intellilock.htm http://www.eziriz.com/intellilock.htm
modeless 17y ago
In addition to merging user assemblies, can you include system assemblies and even the runtime itself? I've always wanted to distribute C# apps as a single executable file that didn't depend on any runtime at all. I think there are some products out there that can do this, but last I checked none of them seemed very good.
- daeken 17y ago
  It's certainly possible, although I'm not certain of the legalities there. I'll look into it once I get merging of assemblies working. Combined with the dead code analysis I'm working on, it may end up working out pretty well. Thanks for the suggestion.
- thebigshane 17y ago
  Xenocode Postbuild works great but costs 1500USD Update: Looks like they consolidated all of their products (including "Postbuild for .NET") into their Application Studio. [http://www.xenocode.com/ http://www.xenocode.com/]
Mrzljak 17y ago
This "Product" is taken from open source project http://exepack.codeplex.com/ http://exepack.codeplex.com/ .. ExePack == DotPack same functionalities .. but one is "Product" and other is opensource project ..
- DarkShikari 17y ago
  Because if they do similar things, they must use the same code? Better tell Microsoft that Apple's ripping them off. I mean, they're both x86-based graphical operating systems, right? Don't accuse people without evidence, especially long-standing members of the community like Daeken, of stealing. The fact that you spammed Daeken's blog with comments promoting exepack (forcing him to disable comments) doesn't help either. Then again, some of your comments were pure gold. For example: "Your product" name is DotPack and open source ExePack ; Pack part of the name the same . coincidence ? To much coincidence in this case . (FYI, I've worked on a portion of DotPack's code, specifically optimizing the LZMA unpacker module, and while that portion was not original code, the original source was a public domain LZMA unpacker. We ended up rewriting practically the whole thing anyways because of how badly it was written. The end result was something like half the size of the original.)
- daeken 17y ago
  The extent of this accusation stems from the fact that both names contain 'Pack', much like every other packer on the planet. One of his many trollish comments on my blog was this: "Your product" name is DotPack and open source ExePack ; Pack part of the name the same . coincidence ? To much coincidence in this case . NM Moscow, Russia At least a dozen HN readers can attest to the fact that I've been working heavily on this, and two have seen the source first-hand and can confirm that it's original. It's offensive to say the least to have such an accusation come up on your own blog, but eh, such is the internet.
  - Mrzljak 17y ago
    Ok. question . Why will someone BUY "Your Product" for 250 - 500 USD (!?) if there is FREE openSource project with very much the same functionality, and from whom you take much of idea and implementation ?? ExePack http://exepack.codeplex.com/ http://exepack.codeplex.com/
DanBlake 17y ago
Could you post a protected .exe URL to this thread to play with? Just a simple crackme would work.
- daeken 17y ago
  If you'd like to take a look at a packed binary, Dotpack itself is packed. Feel free to peek around at it. For what it's worth, there's little to no protection as it stands; the unpacker stubs are obfuscated for space reasons, but the actual assembly is unchanged at this time. Obfuscation will be coming soon, although I'm unsure of how far I'm going to take it for the release version.
paraschopra 17y ago
Sorry, but I am curious what the product does. Can someone explain in lay terms what an exe packer is and why this product is special? Thanks.
- daeken 17y ago
  A binary packer such as Dotpack, UPX, or PEtite compresses an executable and adds an unpacker to the beginning of it. In this way, you have a self-standing application that is a fraction of its original size. What sets Dotpack apart from the popular packing tools is that it works on .NET binaries rather than general Windows/Linux/Mac binaries.
  - Mrzljak 17y ago
    Same thing but FREE and OPENSOURCE ExePack .. http://exepack.codeplex.com/ http://exepack.codeplex.com/ this "product DotPack" is very much the same as ExePack . very possible that ExePack source code is little modified and turned to be "product" .. Read Copiright notes on CodePlex ..
MichaelGG 17y ago
Won't this break XML serialzation? At least, several years ago, XML serialization used to go compile code (call csc on files) at runtime or something crazy like that. We were never able to make our dynamically loaded assemblies work well with XML serialization. I tried a commercial product a while later and it too had that issue. Kudos on LMZA - I wish Silverlight would have used that instead of just zip. It'd make a pretty big impact on size.
- daeken 17y ago
  Nope, this works fine with reflection generally. That sort of introspection, however, will be incompatible with the obfuscation done in the future. I aim to detect where it happens, and at least say "hey, this flag is being ignored since it's going to break things". As for LZMA, it has a huge impact for sure, but until assembly merging and dead code analysis are in place, the impact on Silverlight assemblies is going to be pretty slim. Dotpack does wonders on standalone binaries as it stands (compresses NVidia FX Composer to just over 20% of its original size, for instance), but most Silverlight assemblies only get a 10-20% decrease right now. I'm looking forward to getting the Silverlight side stable and as high quality as the standalone side.

40 points by daeken 17y ago

huhtenberg 17y ago

How is it better than UPX?

daeken 17y ago
UPX and other binary packers out there don't support .NET binaries in any way. There's only one other .NET packer that I'm aware of, and it seems to be dead (the only traces of it are on shady shareware sites) and quite old.

johns 17y ago

Is the long-term goal going after SmartAssembly's market?

daeken 17y ago
Redgate (owner of SmartAssembly) and Remotesoft in general. Yes. Their tools don't work worth a damn and they sell way, way too many licenses. I'd love to take a large chunk out of their market.
- johns 17y ago
  In fairness to Redgate, their tools have always worked for me. SmartAssembly worked pretty well when I used it too. They're just ridiculously expensive. So I would love to see some good competition for them.
  - daeken 17y ago
    They 'work', but they don't protect your code in any way. Beyond removing names from your code, they really don't do anything useful. It really seems to me like the people working on these obfuscators have never looked at unmanaged code obfuscators used in the wild -- with the amount of data available with .NET assemblies, you can do a whole, whole lot.
  - ComputerGuru 17y ago
    He's going to be charging 500USD per user per year. {sa} charges 500USD per user.
    - daeken 17y ago
      My price is certainly high, but if there's one thing I've learned in business it's that it's much easier to lower your price than to raise it.
      - nkohari 17y ago
        That's true, but at a $500 price point, you're also reducing your market substantially due to price elasticity. Be sure to lower the price quickly if you feel like you're not getting traction.
      - maxklein 17y ago
        If there is one thing I've learned is that people hate subscriptions.
- ComputerGuru 17y ago
  Sorry, but bashing your competition doesn't make you look "cool." I reviewed {smartassembly} back in 2007 (http://neosmart.net/blog/2007/smartassembly/ http://neosmart.net/blog/2007/smartassembly/) and till now it remains hands-down the best obfuscation and post-release-processing tool for .NET applications. For larger projects the obfuscation can break the product. It's tedious work, but you can manually exclude functions from the obfuscation procedure until you can find out where things went wrong.
  - daeken 17y ago
    I'm not terribly concerned about looking "cool", I'm simply stating what everyone who's reverse-engineered such obfuscated assemblies knows. These tools simply don't protect your code at all. I think it's a travesty that these tools sell as well as they do while doing nothing to hinder reverse-engineering. Edit: For the record, I performed quite a bit of reverse-engineering on Magic: The Gathering Online, which uses SmartAssembly for obfuscation. Despite it being heavily obfuscated, an hour with Mono.Cecil got me a clean binary with placeholder names. That is simply unacceptable.
    - viggity 17y ago
      I understand spending time on deobsfucation. But what about assembly encryption ala http://www.eziriz.com/intellilock.htm http://www.eziriz.com/intellilock.htm

modeless 17y ago

In addition to merging user assemblies, can you include system assemblies and even the runtime itself? I've always wanted to distribute C# apps as a single executable file that didn't depend on any runtime at all. I think there are some products out there that can do this, but last I checked none of them seemed very good.

daeken 17y ago
It's certainly possible, although I'm not certain of the legalities there. I'll look into it once I get merging of assemblies working. Combined with the dead code analysis I'm working on, it may end up working out pretty well. Thanks for the suggestion.
thebigshane 17y ago
Xenocode Postbuild works great but costs 1500USD Update: Looks like they consolidated all of their products (including "Postbuild for .NET") into their Application Studio. [http://www.xenocode.com/ http://www.xenocode.com/]

Mrzljak 17y ago

This "Product" is taken from open source project http://exepack.codeplex.com/ http://exepack.codeplex.com/ .. ExePack == DotPack same functionalities .. but one is "Product" and other is opensource project ..

DarkShikari 17y ago
Because if they do similar things, they must use the same code? Better tell Microsoft that Apple's ripping them off. I mean, they're both x86-based graphical operating systems, right? Don't accuse people without evidence, especially long-standing members of the community like Daeken, of stealing. The fact that you spammed Daeken's blog with comments promoting exepack (forcing him to disable comments) doesn't help either. Then again, some of your comments were pure gold. For example: "Your product" name is DotPack and open source ExePack ; Pack part of the name the same . coincidence ? To much coincidence in this case . (FYI, I've worked on a portion of DotPack's code, specifically optimizing the LZMA unpacker module, and while that portion was not original code, the original source was a public domain LZMA unpacker. We ended up rewriting practically the whole thing anyways because of how badly it was written. The end result was something like half the size of the original.)
daeken 17y ago
The extent of this accusation stems from the fact that both names contain 'Pack', much like every other packer on the planet. One of his many trollish comments on my blog was this: "Your product" name is DotPack and open source ExePack ; Pack part of the name the same . coincidence ? To much coincidence in this case . NM Moscow, Russia At least a dozen HN readers can attest to the fact that I've been working heavily on this, and two have seen the source first-hand and can confirm that it's original. It's offensive to say the least to have such an accusation come up on your own blog, but eh, such is the internet.
- Mrzljak 17y ago
  Ok. question . Why will someone BUY "Your Product" for 250 - 500 USD (!?) if there is FREE openSource project with very much the same functionality, and from whom you take much of idea and implementation ?? ExePack http://exepack.codeplex.com/ http://exepack.codeplex.com/

DanBlake 17y ago

Could you post a protected .exe URL to this thread to play with? Just a simple crackme would work.

daeken 17y ago
If you'd like to take a look at a packed binary, Dotpack itself is packed. Feel free to peek around at it. For what it's worth, there's little to no protection as it stands; the unpacker stubs are obfuscated for space reasons, but the actual assembly is unchanged at this time. Obfuscation will be coming soon, although I'm unsure of how far I'm going to take it for the release version.

paraschopra 17y ago

Sorry, but I am curious what the product does. Can someone explain in lay terms what an exe packer is and why this product is special? Thanks.

daeken 17y ago
A binary packer such as Dotpack, UPX, or PEtite compresses an executable and adds an unpacker to the beginning of it. In this way, you have a self-standing application that is a fraction of its original size. What sets Dotpack apart from the popular packing tools is that it works on .NET binaries rather than general Windows/Linux/Mac binaries.
- Mrzljak 17y ago
  Same thing but FREE and OPENSOURCE ExePack .. http://exepack.codeplex.com/ http://exepack.codeplex.com/ this "product DotPack" is very much the same as ExePack . very possible that ExePack source code is little modified and turned to be "product" .. Read Copiright notes on CodePlex ..

MichaelGG 17y ago

Won't this break XML serialzation? At least, several years ago, XML serialization used to go compile code (call csc on files) at runtime or something crazy like that. We were never able to make our dynamically loaded assemblies work well with XML serialization. I tried a commercial product a while later and it too had that issue. Kudos on LMZA - I wish Silverlight would have used that instead of just zip. It'd make a pretty big impact on size.

daeken 17y ago
Nope, this works fine with reflection generally. That sort of introspection, however, will be incompatible with the obfuscation done in the future. I aim to detect where it happens, and at least say "hey, this flag is being ignored since it's going to break things". As for LZMA, it has a huge impact for sure, but until assembly merging and dead code analysis are in place, the impact on Silverlight assemblies is going to be pretty slim. Dotpack does wonders on standalone binaries as it stands (compresses NVidia FX Composer to just over 20% of its original size, for instance), but most Silverlight assemblies only get a 10-20% decrease right now. I'm looking forward to getting the Silverlight side stable and as high quality as the standalone side.