WiseOwl.Demeanor 6.0.21

Demeanor for .NET

The original .NET obfuscator. Shipping continuously since 1999. Built by the same author through every release.

Demeanor protects your intellectual property without breaking your app. It reads the compiled assembly first, recognizes framework patterns (ASP.NET Core, EF Core, Blazor, WPF, WinForms, MAUI, System.Text.Json, COM), and tells you in plain English what obfuscates cleanly, what breaks, and what code changes would fix it. Then it obfuscates: renames identifiers, encrypts strings, constants, and resources, obfuscates control flow, and injects anti-tamper and anti-debug protections.

Optional Large Language Model (LLM) integration via a built-in MCP (Model Context Protocol) server lets you drive the audit as a conversation through any MCP-capable AI assistant (Claude Code, Claude Desktop, Cursor, Windsurf, Continue.dev). Runs locally over stdio; nothing leaves your machine.

Learn more at www.wiseowlsoftware.com

Install

dotnet tool install -g WiseOwl.Demeanor

That's the entire user-visible install. Self-contained binary — no .NET runtime required on the build machine. On first run, demeanor auto-installs the companion WiseOwl.Inspector global tool (inspector on your PATH), bootstraps the /obfuscate Claude Code skill into ~/.claude/skills/obfuscate/, and registers itself as an MCP server in ~/.claude.json.

For build-time obfuscation as part of dotnet build, see the companion WiseOwl.Demeanor.MSBuild PackageReference. One command, no csproj edits:

dotnet add package WiseOwl.Demeanor.MSBuild
dotnet build -c Release

Release builds auto-obfuscate; Debug builds and test projects are auto-skipped.

What it looks like

// Your code
public class PriceCalculator
{
    private readonly decimal _discount = 0.10m;

    public decimal Apply(decimal price)
    {
        Console.WriteLine($"Discount: {_discount:P}");
        return price - (price * _discount);
    }
}

After Enterprise obfuscation, decompiled with ILSpy:

public class a
{
    private decimal m_a;

    public decimal  (decimal a)
    {
        b.c(b.a("\u0003\rÍÆ0\u001C"), this.m_a);
        return a - (a * this.m_a);
    }
}

Method name is literal whitespace — invalid C# at the parser. Strings encrypted into a decryptor call. Try to recompile:

$ dotnet build
CS1001: Identifier expected
Build FAILED.

Plus integer constants encrypted, control flow obfuscated, anti-tamper and anti-debug injected. The decompiler shows you something — but it's unreadable, won't compile, and the literal "Discount: {_discount:P}" is gone. (Real ILSpy output.)

Why Demeanor

• Original author since 1999. Demeanor first beta shipped in June 2000 alongside .NET Beta 1 (then sold as "Demeanor for .NET, Enterprise Edition"). Brent Rector wrote that release and every release since. Other major .NET obfuscators have changed corporate hands multiple times across that span; Demeanor's author has not.
• Per-company Enterprise licensing. One annual key, unlimited developers, unlimited build agents. No seat counting. No machine locking. No activation server. No phone-home. RSA-signed keys validated entirely offline.
• First-class LLM integration. First .NET obfuscator with built-in MCP support. Drive audit, obfuscation, report queries, and stack-trace deobfuscation through your existing AI assistant — no separate UI to learn.
• Framework-aware by default. Recognizes idioms from ASP.NET Core, EF Core, Blazor, WPF, WinForms, MAUI, System.Text.Json, and COM interop — protects what's safe to rename, flags what isn't, and generates an exclusion plan you can review before any bytes change.

Quick start

demeanor MyApp.dll                            # obfuscate one assembly (default action)
demeanor audit MyApp.dll                      # pre-obfuscation risk analysis
demeanor report Demeanor/MyApp-report.json    # human-readable report viewer
demeanor deobfuscate stack.txt --report ...   # map a stack trace back
demeanor check MyApp.dll                      # is this assembly obfuscated?
demeanor validate-exclusions MyApp.dll --xr "Foo.*"
demeanor init                                 # wire MSBuild into nearest .csproj
demeanor license <KEY>                        # decode + display a license key
demeanor --mcp                                # start the MCP server (stdio)

License key via DEMEANOR_LICENSE environment variable or --license flag. Without an Enterprise key, Demeanor degrades to Community-tier basic renaming.

Audit before you obfuscate

demeanor audit MyApp.dll

Surfaces 20+ risk patterns (auto-detected, needs-exclusion, advisory) BEFORE modifying anything. Same detection logic the obfuscator uses, presented as findings with risk + recommendation per pattern. Use --json for tooling integration.

What's included

Obfuscation passes (Enterprise tier, on by default; CLI flags shown for the --no-* opt-out):

• Symbol renaming — types, methods, fields, properties, events, parameters, generic params; alpha or Unicode naming; virtual override renaming across assembly boundaries (--no-virtual-rename).
• String encryption (--no-strings).
• Constants encryption (--no-constants).
• Resource encryption (--no-resources).
• Call hiding — direct call sites become opaque (--no-call-hiding, --proxy-threshold N).
• Control-flow obfuscation — three intensity levels (--cfg <Reorder|Predicates|Flatten>, --no-cfg).
• Anti-tamper — runtime integrity verification (--no-anti-tamper).
• Anti-debug — runtime debugger detection (--no-anti-debug).
• Aggressive renaming — pushes identifier transforms past what a C# parser will accept, with companion metadata stripping (--no-aggressive, --no-enum-deletion).
• Reflection hindrance (--no-hinder-reflection).
• Incremental obfuscation — preserves stable mappings across builds (--prior-report).
• Strong-name resigning — --keyfile / --keycontainer.

Framework auto-detection (always on, no opt-in needed) — Demeanor recognizes idioms from each framework and pre-populates a safe exclusion plan you can review before any bytes change:

• ASP.NET Core (MVC, Minimal API, SignalR)
• EF Core
• Blazor
• WPF (data binding)
• WinForms (data binding, generated resource and settings classes, designer surfaces)
• MAUI XAML
• MEF
• Configuration binding
• Serialization — binary, XML, System.Text.Json (including source-generated serialization contexts), and Newtonsoft.Json
• COM interop

The audit command surfaces 20+ risk patterns before any modification — see demeanor audit MyApp.dll.

AI-assisted workflow (LLM integration)

If you have Claude Code, Claude Desktop, Cursor, Windsurf, or Continue.dev installed, Demeanor's bootstrap registers its MCP server with 20 tools spanning assembly inspection, obfuscation orchestration, report analysis, stack-trace deobfuscation, exclusion validation, and pattern reporting. Invoke /obfuscate in Claude Code to walk through obfuscating any .NET app interactively.

MCP (Model Context Protocol) is the open protocol Anthropic published for AI assistants to call external tools. Demeanor's MCP server runs locally over stdio — no inbound network connection, no telemetry, no Demeanor data ever leaves your machine. The same binary that runs as the CLI runs as the MCP server (demeanor --mcp).

Licensing

Per-company licensing — no seat counting, no machine locking. RSA-signed keys validated entirely offline.

Pricing and purchase: www.wiseowlsoftware.com/pricing.

Documentation

Full documentation including CLI reference, MSBuild properties, exclusion patterns, CI/CD integration, framework-by-framework guidance, and troubleshooting:

www.wiseowlsoftware.com/docs

About Wise Owl Software

Demeanor is published by Wise Owl Software, founded by Brent Rector in 1990. Brent has been writing software for over five decades and spent two decades at Microsoft as a Principal Software Architect — a decade directly on the Windows operating system itself, plus years on Visual Studio, the Windows SDK, and .NET. Demeanor's first beta shipped in June 2000 alongside .NET Beta 1, and the same author has continuously developed and maintained it across every release since.

www.wiseowlsoftware.com

Copyright (c) Wise Owl Software. 1999-2026. All Rights Reserved. Commercial product; see LICENSE for the EULA. Source-license inquiries: www.wiseowlsoftware.com.