Sentinel Hl Basic protect vendor code

Question

I use bellow code to protect a piece of .net program. We chose to use api instead of classic Envelope method as we want custom behavior not just the normal window "Key not found"

My question is how i can protect the vendor code as it can be seen as plain text in decompiler ?

Thanks in advance.

    HaspFeature feature = HaspFeature.Default;

// Key bellow is random generated.....
    string vendorCode = 
    "AzIceaqfA1hX5wS+M8cGnYh5ceevUnOZIzJBbXFD6dgf3tBkb9cvUF/Tkd/iKu2fsg9wAysYKw7RMAsV" + 
    "vIp4KcXle/v1RaXrLVnNBJ2H2DmrbUMOZbQUFXe698qmJsqNpLXRA367xpZ54i8kC5DTXwDhfxWTOZrB" + 
    "rh5sRKHcoVLumztIQjgWh37AzmSd1bLOfUGI0xjAL9zJWO3fRaeB0NS2KlmoKaVT5Y04zZEc06waU2r6" + 
    "AU2Dc4uipJqJmObqKM+tfNKAS0rZr5IudRiC7pUwnmtaHRe5fgSI8M7yvypvm+13Wm4Gwd4VnYiZvSxf" + 
    "8ImN3ZOG9wEzfyMIlH2+rKPUVHI+igsqla0Wd9m7ZUR9vFotj1uYV0OzG7hX0+huN2E/IdgLDjbiapj1" + 
    "e2fKHrMmGFaIvI6xzzJIQJF9GiRZ7+0jNFLKSyzX/K3JAyFrIPObfwM+y+zAgE1sWcZ1YnuBhICyRHBh" + 
    "aJDKIZL8MywrEfB2yF+R3k9wFG1oN48gSLyfrfEKuB/qgNp+BeTruWUk0AwRE9XVMUuRbjpxa4YA67SK" + 
    "unFEgFGgUfHBeHJTivvUl0u4Dki1UKAT973P+nXy2O0u239If/kRpNUVhMg8kpk7s8i6Arp7l/705/bL" + 
    "Cx4kN5hHHSXIqkiG9tHdeNV8VYo5+72hgaCx3/uVoVLmtvxbOIvo120uTJbuLVTvT8KtsOlb3DxwUrwL" + 
    "zaEMoAQAFk6Q9bNipHxfkRQER4kR7IYTMzSoW5mxh3H9O8Ge5BqVeYMEW36q9wnOYfxOLNw6yQMf8f9s" + 
    "JN4KhZty02xm707S7VEfJJ1KNq7b5pP/3RjE0IKtB2gE6vAPRvRLzEohu0m7q1aUp8wAvSiqjZy7FLaT" + 
    "tLEApXYvLvz6PEJdj4TegCZugj7c8bIOEqLXmloZ6EgVnjQ7/ttys7VFITB3mazzFiyQuKf4J6+b/a/Y";

    Hasp hasp = new Hasp(feature);
    HaspStatus status = hasp.Login(vendorCode);

    if (HaspStatus.StatusOk != status)
    {
        //handle error
        Application.Exit();
    }

You still need to obfuscate your DLL with Sentinel's app. Just don't protect the particular method. — kagelos, May 24 '16 at 12:55
The ideea was : if license not found work in demo mode . If i need to obfuscate dll means that even for demo il need key — adi sba, May 24 '16 at 13:06
I don't have it anymore (thankfully) but I remember you were able to choose the particular classes and methods that would be automatically protected. You can perhaps omit the ones you want to work also in demo mode unprotected. Still it will obfuscate the whole thing. It will just not add the injected code that checks for a license in the excluded methods. — kagelos, May 24 '16 at 14:01
Possible duplicate of [Should HASP Vendor Code be encrypted/obfuscated?](http://stackoverflow.com/questions/20053539/should-hasp-vendor-code-be-encrypted-obfuscated) — Lilshieste, Aug 18 '16 at 18:58

score 0 · Answer 1 · answered Aug 01 '19 at 13:40

A working example using ConfuserEx to obfuscate the assembly.

// sentinel demo key...      
private static string CodeDemo_Internal()
    {
        return "AzIceaqfA1hX5wS+M8cGnYh5ceevUnOZIzJBbXFD6dgf3tBkb9cvUF/Tkd/iKu2fsg9wAysYKw7RMAsV" +
            "vIp4KcXle/v1RaXrLVnNBJ2H2DmrbUMOZbQUFXe698qmJsqNpLXRA367xpZ54i8kC5DTXwDhfxWTOZrB" +
            "rh5sRKHcoVLumztIQjgWh37AzmSd1bLOfUGI0xjAL9zJWO3fRaeB0NS2KlmoKaVT5Y04zZEc06waU2r6" +
            "AU2Dc4uipJqJmObqKM+tfNKAS0rZr5IudRiC7pUwnmtaHRe5fgSI8M7yvypvm+13Wm4Gwd4VnYiZvSxf" +
            "8ImN3ZOG9wEzfyMIlH2+rKPUVHI+igsqla0Wd9m7ZUR9vFotj1uYV0OzG7hX0+huN2E/IdgLDjbiapj1" +
            "e2fKHrMmGFaIvI6xzzJIQJF9GiRZ7+0jNFLKSyzX/K3JAyFrIPObfwM+y+zAgE1sWcZ1YnuBhICyRHBh" +
            "aJDKIZL8MywrEfB2yF+R3k9wFG1oN48gSLyfrfEKuB/qgNp+BeTruWUk0AwRE9XVMUuRbjpxa4YA67SK" +
            "unFEgFGgUfHBeHJTivvUl0u4Dki1UKAT973P+nXy2O0u239If/kRpNUVhMg8kpk7s8i6Arp7l/705/bL" +
            "Cx4kN5hHHSXIqkiG9tHdeNV8VYo5+72hgaCx3/uVoVLmtvxbOIvo120uTJbuLVTvT8KtsOlb3DxwUrwL" +
            "zaEMoAQAFk6Q9bNipHxfkRQER4kR7IYTMzSoW5mxh3H9O8Ge5BqVeYMEW36q9wnOYfxOLNw6yQMf8f9s" +
            "JN4KhZty02xm707S7VEfJJ1KNq7b5pP/3RjE0IKtB2gE6vAPRvRLzEohu0m7q1aUp8wAvSiqjZy7FLaT" +
            "tLEApXYvLvz6PEJdj4TegCZugj7c8bIOEqLXmloZ6EgVnjQ7/ttys7VFITB3mazzFiyQuKf4J6+b/a/Y";
    }

obfuscated output...

private static string CodeDemo_Internal()
    {
      string str = \u003CModule\u003E.\u206F⁪‏⁭‎⁯⁭⁮‬‌⁭⁪‮⁫‫⁯⁭⁭⁯‭‎⁮⁫‎⁯‫‭‮‮⁭‏⁯⁮‫‪‏⁯⁮‫‮<string>(2388152962U);
label_1:
      int num1 = 2017564117;
      while (true)
      {
        uint num2;
        switch ((num2 = (uint) (num1 ^ 1541322575)) % 3U)
        {
          case 1:
            num1 = (int) num2 * 795888831 ^ 1645877581;
            continue;
          case 2:
            goto label_1;
          default:
            goto label_4;
        }
      }
label_4:
      return str;
    }

this is with the following settings on...

anti debug, anti ildasm, constants, ctrl flow, and resources

adi sba · Accepted Answer · 2016-07-03T17:42:42.833

As a workaround i made a separated dll with a private const string which contained the vendor api . I obfuscated the dll, so vendor key cannot be read .

Sample class dll obfuscated with Eazfuscator which is free at some version

public class VendorKey
{
    private const string salted = "AzIceaqfA1hX5wS+M8cGnYh5ceevUnOZIzJBbXFD6dgf3tBkb9cvUF/Tkd/iKu2fsg9wAysYKw7RMAsV" + 
"vIp4KcXle/v1RaXrLVnNBJ2H2DmrbUMOZbQUFXe698qmJsqNpLXRA367xpZ54i8kC5DTXwDhfxWTOZrB" + 
"rh5sRKHcoVLumztIQjgWh37AzmSd1bLOfUGI0xjAL9zJWO3fRaeB0NS2KlmoKaVT5Y04zZEc06waU2r6" + 
"AU2Dc4uipJqJmObqKM+tfNKAS0rZr5IudRiC7pUwnmtaHRe5fgSI8M7yvypvm+13Wm4Gwd4VnYiZvSxf" + 
"8ImN3ZOG9wEzfyMIlH2+rKPUVHI+igsqla0Wd9m7ZUR9vFotj1uYV0OzG7hX0+huN2E/IdgLDjbiapj1" + 
"e2fKHrMmGFaIvI6xzzJIQJF9GiRZ7+0jNFLKSyzX/K3JAyFrIPObfwM+y+zAgE1sWcZ1YnuBhICyRHBh" + 
"aJDKIZL8MywrEfB2yF+R3k9wFG1oN48gSLyfrfEKuB/qgNp+BeTruWUk0AwRE9XVMUuRbjpxa4YA67SK" + 
"unFEgFGgUfHBeHJTivvUl0u4Dki1UKAT973P+nXy2O0u239If/kRpNUVhMg8kpk7s8i6Arp7l/705/bL" + 
"Cx4kN5hHHSXIqkiG9tHdeNV8VYo5+72hgaCx3/uVoVLmtvxbOIvo120uTJbuLVTvT8KtsOlb3DxwUrwL" + 
"zaEMoAQAFk6Q9bNipHxfkRQER4kR7IYTMzSoW5mxh3H9O8Ge5BqVeYMEW36q9wnOYfxOLNw6yQMf8f9s" + 
"JN4KhZty02xm707S7VEfJJ1KNq7b5pP/3RjE0IKtB2gE6vAPRvRLzEohu0m7q1aUp8wAvSiqjZy7FLaT" + 
"tLEApXYvLvz6PEJdj4TegCZugj7c8bIOEqLXmloZ6EgVnjQ7/ttys7VFITB3mazzFiyQuKf4J6+b/a/Y";
    public static string Key
    {
        get
        {
            return salted
        }
    }
}

Obfuscation isn't enough by itself to hide the vendor key, because the text will still be readily visible in decompiled code. In order to properly hide the key, the string value needs to be defined somewhere that will actually get obfuscated: for example, in a constructor, or in a local variable right before using it. See here for more details: http://stackoverflow.com/questions/20053539/should-hasp-vendor-code-be-encrypted-obfuscated — Lilshieste, Aug 18 '16 at 18:56
Actually you are wrong please test it as i already done it and works — adi sba, Aug 30 '16 at 10:53
This may depend on the obfuscation tool you are using. In my testing with ConfuserEx to obfuscate and decompiling with dotPeek, using a `private const string` was not enough to have the code obfuscated. — Ryan_S, Aug 01 '19 at 13:42

Sentinel Hl Basic protect vendor code

2 Answers2