topic Re: How to protect my ArcMap addin from decompiler? in ArcObjects SDK Questions

How to protect my ArcMap addin from decompiler?

SongWendong — Thu, 15 Aug 2013 01:11:06 GMT

We have to provide an organization a ArcMap addin which is written in C#. It contains some algorithms that we would like to keep it to ourselves.
You know esri addin is actually a zip file you can unzip it and find the dll which means you can extract and decompile it.
It turns out you can not change the stuff in the package and rezip it.It would not be properly installed after. So it means I cannot obfuscate the code and replace the dll in the addin file.
Any ideas?

Re: How to protect my ArcMap addin from decompiler?

LeoDonahue — Thu, 15 Aug 2013 03:06:44 GMT

Good question.

I know in Java, you can obfuscate your class files into a jar using something like ProGuard, and unzip the Java add-in, change jars, re-zip etc. I assume you can obfuscate your code before you package the add-in.

Does your client have access to the internet? What about moving your algorithms to a web service and have your add-in call the web service? Anyone who decompiles your add-in will only see how to make the call to your web service, and they can probably abuse it, but they won't know the implementation of the algorithm.

You could also give your client a username/password that authenticates to your web service via your add-in, then you can control who can make requests to your web service.

I guess it depends on what your add-in is doing with respect to whether or not you can pass ArcObjects references around via web services. If you look at ArcGIS Online, all geoprocessing is now based on web services.

These are just ideas.

Re: How to protect my ArcMap addin from decompiler?

GaryPoole — Thu, 15 Aug 2013 21:51:41 GMT

We do the obfuscating in the pre-build event of the project which has the Config.esriaddinx file. The only other thing in that project is a dockable window and a couple of buttons.

Re: How to protect my ArcMap addin from decompiler?

LeoDonahue — Thu, 15 Aug 2013 21:56:01 GMT

The obfuscated code just makes it harder to understand what it's doing to slow you down from re-writing it yourself.

Obfuscated code still runs, so what do we accomplish?

How will you know when someone tries to decompile your add-in? If you want to protect your ideas, patent them.

Re: How to protect my ArcMap addin from decompiler?

SongWendong — Fri, 16 Aug 2013 07:13:02 GMT

We do the obfuscating in the pre-build event of the project which has the Config.esriaddinx file. The only other thing in that project is a dockable window and a couple of buttons.

What tool are you using for obfuscating in the pre-build event?

Re: How to protect my ArcMap addin from decompiler?

GaryPoole — Fri, 16 Aug 2013 15:04:36 GMT

What tool are you using for obfuscating in the pre-build event?

We are using Intellilock for obfuscation and licensing. It is inexpensive, works well, and is updated on a regular basis but don't expect any customer support.

Re: How to protect my ArcMap addin from decompiler?

YukunXing — Thu, 20 Feb 2014 16:42:58 GMT

We are using Intellilock for obfuscation and licensing. It is inexpensive, works well, and is updated on a regular basis but don't expect any customer support.

Hi Gary, I'm trying to figure out how to license an ArcGIS Add-in and bumped into your post here. How do I use intellilock on an existing add-in project? Any help is appreciated!