Obfy 1.0.6

Obfy

Professional .NET obfuscation tool for protecting C# assemblies and source code.

Obfy helps protect your .NET applications from reverse engineering by applying multiple obfuscation techniques including string encryption, control flow obfuscation, symbol renaming, anti-debugging, and metadata removal.

Why Obfy?

• Easy to Use - Single command to obfuscate your assemblies
• Configurable - From minimal to aggressive protection levels
• Modern - Built for .NET 8+ with cross-platform support
• Extensible - JSON configuration for fine-grained control
• Fast - Efficient obfuscation with minimal overhead

Installation

dotnet tool install --global Obfy

Quick Start

# Basic obfuscation with standard protection
obfy MyApp.dll -o output/

# Aggressive protection for maximum security
obfy MyApp.dll -l aggressive -o output/

# Using a configuration file
obfy MyApp.dll -c obfy.json -o output/

# Generate a configuration file
obfy config generate -o obfy.json

Before & After

Original code:

public class UserService
{
    private const string ApiKey = "sk-1234567890";

    public User GetUser(int userId)
    {
        var connection = "Server=db.example.com";
        return Database.Query(connection, userId);
    }
}

After obfuscation:

public class _‌‍‏‎
{
    private const string _‌‍‏ = /* encrypted */;

    public _‌‍‎ _‌‍‏‪(int _‌‍‏‫)
    {
        var _‌‍‏‬ = _StringDecryptor.Decrypt(0);
        return _‌‍‎‏._‌‍‏‭(_‌‍‏‬, _‌‍‏‫);
    }
}

Protection Levels

Features

String Encryption

Encrypts string literals with AES-256 or XOR, making sensitive data like API keys and connection strings unreadable in the binary.

Control Flow Obfuscation

Transforms code structure using switch dispatchers and opaque predicates, making the logic harder to follow.

Symbol Renaming

Renames types, methods, fields, properties, and parameters to meaningless identifiers while preserving functionality.

Anti-Debug Protection

Injects debugger detection that responds to debugging attempts, deterring runtime analysis.

Metadata Removal

Strips debug information, custom attributes, and documentation, reducing attack surface and file size.

Configuration

Create an obfy.json configuration file:

{
  "level": "standard",
  "stringEncryption": {
    "enabled": true,
    "algorithm": "Aes256"
  },
  "symbolRenaming": {
    "enabled": true,
    "preservePublicApi": true
  },
  "controlFlow": {
    "enabled": true,
    "intensity": 50
  },
  "metadata": {
    "removeDebugInfo": true
  }
}

Examples

Check out the examples folder:

Documentation

Build Integration

MSBuild

<Target Name="Obfuscate" AfterTargets="Build" Condition="'$(Configuration)' == 'Release'">
  <Exec Command="obfy $(TargetPath) -c obfy.json -o $(TargetDir)" />
</Target>

GitHub Actions

- name: Obfuscate
  run: |
    dotnet tool install --global Obfy
    obfy bin/Release/net8.0/MyApp.dll -l aggressive -o dist/

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

Security

For security issues, please see SECURITY.md.

License

MIT License - see LICENSE for details.

Made with ❤️ for the .NET community