EnvObfuscator 2.5.0

<div align="center">

EnvObfuscator

Generates Obfuscated Properties from .env File Content

</div>

• public static Memory<char> properties for each .env entry.
• Validate_<PropertyName>(ReadOnlySpan<char>) for constant-time comparison.
• Ability to generate GUID-named chaff classes.

🚀 Getting Started

To avoid embedding "raw data" as an assembly metadata, EnvObfuscator uses preceding block comment as a source.

using EnvObfuscator;

/*
# 👇 Copy & paste .env file content
API_KEY=abc123
SERVICE_URL=https://example.com
SECRET=PA$$WORD
EMPTY=
*/
[Obfuscate(seed: 12345)]  // Omit the argument to use random seed
static partial class EnvSecrets
{
}

// Always returns a freshly decoded clone each time
var apiKey = EnvSecretsLoader.API_KEY;
var cache = apiKey.ToString();

// Consuming decoded data...

// Zeroing out the span — more for peace of mind than actual security
apiKey.Span.Clear();
cache = "";

// Validation (no decoding, full-length compare to avoid timing differences)
if (EnvSecretsLoader.Validate_SECRET("PA$$WORD"))
{
    //...
}

var password = (stackalloc char[] { ... });

if (EnvSecretsLoader.Validate_SECRET(password))
{
    //...
}

password.Clear();  // Fills memory by zero

Some system APIs take a string parameter. Recommend that the decoded data should not be stored in local variable as possible.

var res = await httpClient.GetAsync(EnvSecretsLoader.URL.ToString());

// Not recommended: You can use GC.Collect or MemoryMarshal to
// force zero memory (but it would be predictable code pattern)

Emitting Chaff

Intended to eliminate unnecessary "marker" for obfuscation, generated classes don't have DynamicallyAccessedMembers or UnityEngine.Scripting.Preserve attribute.

If you need to include the generated GUID-named chaff classes in build, use link.xml to prevent trimming on Native AOT or Unity IL2CPP build.

// Declare necessary chaff classes as desired

// Tip: The working dummy should provide the same functionality,
//      but also logs user information for later use in banning.

/* API_KEY=working-dummy-to-detect-reverse-engineering */
[Obfuscate] partial class DbSecrets { }

/* API_KEY=working-dummy-to-detect-reverse-engineering */
[Obfuscate] partial class DatabaseSecrets { }

/* API_KEY=key-for-valid-usage */
[Obfuscate] partial class MySecrets { }

Here shows sample link.xml for Unity. See the following link for more details.

• Unity: https://docs.unity3d.com/Manual/managed-code-stripping-xml-formatting.html
• C# / .NET: https://github.com/dotnet/runtime/blob/main/docs/tools/illink/data-formats.md

<linker>
  
  <assembly fullname="MyAssembly">
    
    <type fullname="MyNamespace.MyClass" preserve="all"/>
    
    <type fullname="MyNamespace.MyOtherClass" preserve="methods"/>
  </assembly>

  
  <assembly fullname="UnityEngine.CoreModule">
    <type fullname="UnityEngine.GameObject" preserve="all"/>
  </assembly>
</linker>

Diagnostics

• Missing multiline comment yields a warning.
• Invalid lines are ignored and reported (first invalid line is shown).
• Invalid keys (non-identifiers, invalid characters, or duplicates) are errors.
• Seed value 0 is allowed but warned (deterministic and predictable).
• Obfuscation keys must be non-zero (error); change the seed to generate different keys.

Known Limitations

🕹️ Technical Specs

• Each non-empty, non-# line is parsed as KEY=VALUE (split on the first =).
  • Keys/values are trimmed; values may contain = after the first.
• Keys must already be valid C# identifiers.
  • Invalid characters or keywords cause an error.
  • Duplicate names cause an error.
• Validate_<PropertyName>(ReadOnlySpan<char>) short-circuits only on length mismatch, then performs a full-length compare to avoid leaking timing information.
• Clear decoded values with Span.Clear() after use to zero sensitive data.
• Obfuscation details:
  • Builds a base character table from all values + a default extra set.
  • Duplicates the table, XOR-encodes with odd/even keys, then shuffles.
  • Random helpers are emitted into random namespaces with random class/field names.
• seed (if provided) controls the output deterministically.
  • The type’s assembly-unique identifier is mixed into the seed so each target differs.