I have an ASP.NET Core 8 MVC project structured in three layers: Business, WebAPI, and Model. I want to convert it into a desktop application, so I used Electron.NET. However, I faced serious security concerns regarding my DLL files, as they can be easily decompiled.
I have tried obfuscation, but it is not strong enough for my needs. Ideally, I need to compile my code into a lower-level language like C++ or any other method that would make reverse engineering much harder.
Key Points:
- My project contains Views (Razor Pages/Views), so Minimal API is not a suitable alternative.
- I need a way to hide or encrypt my DLL files or convert them into a more secure format.
- I am open to alternative solutions, such as using another technology to compile or protect my code. What are the best practices to secure my Electron.NET application’s backend code? Would AOT compilation or using a different language help? Any guidance would be greatly appreciated
Obfuscation (e.g., Dotfuscator, ConfuserEx, Babel Obfuscator) → However, it’s still possible to decompile and understand the logic. Embedding DLLs into the EXE (e.g., Costura.Fody, ILMerge) → This only prevents casual access but does not protect against advanced reverse engineering. Packing with tools like Themida, Enigma Protector → Helped a bit, but can still be unpacked by experienced users. Running WebAPI separately and connecting via HTTP requests → This avoids exposing logic in the frontend but introduces network-related security concerns. What I Expected: I was hoping to find a robust way to prevent decompilation and reverse engineering. Ideally, I want a solution that:
Hides or encrypts my DLL files effectively. Compiles to a lower-level language (e.g., C++) to make decompilation significantly harder. Provides strong security without compromising performance. Would switching to Native AOT (Ahead-of-Time Compilation) help? Or is there a better way to achieve this?