CliSecure - Protection level

[DionysusToast]

Hi

I am developing some code to release and today I tested the CliSecure product. I am not sure if there's a bug or not.

I just did an export of my code with the protection option checked. I then ran it through the 9Rays decompiler, a product that I have never used before and....

I CAN SEE ALL MY CODE !!!!

It took me about 5 minutes to decompile my code, although it would take less time in the future as I now know how to use the decompiler.

What, exactly is the point of this free CliSecure product? I don't see any point at all. It doesn't protect the code in any way at all. If someone with zero experience of decompiling code can do it in 5 minutes, what protection is there?

Is this a bug of some sort?

This is Ninja 7 r4.

Cheers

Pete

[NinjaTrader_Bertrand]

Hi Pete, thanks for the testing and report - we will look into it. Are you using a licenced version of the tool you mentioned or the evaluation one? Are you actually able to see for example your OnBarUpdate() code?

[DionysusToast]

Bertrand

I got a CliSecure for NinjaTrader license from Secure Team.

It's not an eval copy and yes - I can see all my method names and contents.

Cheers

Pete

[NinjaTrader_Bertrand]

Thanks Pete, I was referring to the decompiler tool you use - do you use the evaluation version here or not?

[TAJTrades]

Hi
I just did an export of my code with the protection option checked. I then ran it through the 9Rays decompiler, a product that I have never used before and....

Pete,

I downloaded the Evaluation version of 9Rays but could not decompile. What steps did you use? I could not see the "OnBarUpdate". Was listed as ":void".

But then I have never tried to decompile anything so I may not know what I am doing.

[DionysusToast]

I've done more research.

The version of 9Rays was eval. It shows exactly the same thing for protected and non protected assemblies.

It shows all variables used in the code & it shows all method names in the code. It doesn't show procedural code inside the methods, it shows:

// ------------------------------------------------------------------------------
// This code was generated by
// 9Rays.Net Decompiler.Net services Evaluation
// ver.5.8.1.14
// http://www.9rays.net
// Copyright 2011 9Rays.Net All rights reserved.
// Evaluation version: decompiles about 50% of methods, properties and events.
// ------------------------------------------------------------------------------
protected override void OnMarketData(NinjaTrader.Data.MarketDataEventArgs e)
{
// Evaluation version.
}

So - from this I can't see if it's the eval or CliSecure that's preventing the code within the method from being shown.

Over to .NET Reflector 7.0

Unprotected Assembly:
protected override void OnMarketData(MarketDataEventArgs e)

{
if (!this.decimalsCalcd) { this.decimals = this.PriceDecimals(base.get_TickSize());

Protected Assembly:
[MethodImpl(MethodImplOptions.NoInlining)]
protected override void OnMarketData(MarketDataEventArgs e)
{
}

So - from the perspective of .NET Reflector, it does appear that the lines of procedural code within the methods is hidden. I am trying to get a key for 9Rays to see if that can decode the method lines.

The problem with what we have is that there is still a HUGE amount of information given away. All of the method names & properties, all of the variable names are there.

The manual says the code is protected and anyone reading the CliSecure site will look at their main features and presume that their code is going to be protected by those features when it is clear the main feature (obfuscation) is not included in the Ninja version.

As a programmer of over 25 years, I use meaningful variable and procedure names. As such, giving all that away to anyone that can download a free bit of software is something I can't accept.

This is something you should make clear to people. If the expectation is protection of all of the IP, not some of the IP, then this falls short. For sure, this fell short of my expectations and I'm hardly new to this.

I'll post more when I get 9Rays. As it is, it appears that CliSecure ($795) full version is the only safe option OR another obfuscator. I have no idea how to create my obfuscated assemblies with CliSecure full version, obviously it won't be by via the 'protect compiled assembly' option.

Will the use of the full version of CliSecure be supported in any way? If not, you have a partial solution to code protection.

Cheers

Pete

[zweistein]

Ok, your headline WAS frightening... (it is not any more)

It is almost sure that also the full version of Ray9 decompiler will not reveal the content of the functions like OnBarUpdate() etc.

The Function names and class variables are all visible, it is a side effect of using C# managed code.
Be careful with obfuscation etc as some aspects like reflection and serialization might not work properly (and it will difficult to debug)

regards

Andreas

[NinjaTrader_Bertrand]

Thanks for the testing Pete and feedback guys: this would be the level of protection offered, the so called signatures / properties would be expected to be 'decompilable'.

Please also see this thread describing potential options in CLI's full product that would unfortunately not be available in the 'CLI for NT' version - http://www.ninjatrader.com/support/f...ad.php?t=38640

[bukkan]

CliSecure suddenly is not working at my end. it used to work even sometimes back

in the attached pic the there are 2 msgbox dialogs. the upper one is the error dialog as given via ninja when i try to export any indicator with cli protection, and the below error dialog is thrown by CliSecure (standalone NT version) when I try to put in the login details (which it asks for) which i got from CliSecure when i registered with them. both used to work.

any input will be appreciated.

regards

p.s. - i send them for another license request with the same email id.

[NinjaTrader_Bertrand]

Hi bukkan, first time I see those errors being thrown - could the license file from the free vs full once perhaps conflict? Perhaps a backbone issue reaching the servers for license verification purposes?

[bukkan]

thanks Bertrand for the prompt reply.

Ninja atleast is having no issues while checking the license key.

I have CliSecure for NT only (the free version, CliSecureInstallerNT.exe as provided by CliSecure). the lincese key as provided by CliSecure is not working anymore . In fact that was the case for long, but that didnt cause NT any trouble and the builtin CliSecure function in NT was working fine. Only today the error message was thrown and CliSecure in NT too stopped working.

If i uninstall CliSecure, then the Cli function in NT didnt work at all (the NT help file pops up). It seems the CliSecure program needs to be installed for NT to work.

Perhaps I need a license key from CliSecure, but then that is just my guess. Any pointer would be appreciated.

Thanks again..

[NinjaTrader_Bertrand]

You're welcome bukkan, I would then try with a refreshed license key from CLI - perhaps there was a period where an (for whatever reason) expired key was still allowed to function but that has ended now? Perhaps email the key used to the CLI Team and ask if that would be still valid?

[bukkan]

Thanks Bertrand. I already applied for a new key. I will mail them too. Will let you know whatever the outcome maybe.

regards..

[NinjaTrader_Bertrand]

Thanks Bertrand. I already applied for a new key. I will mail them too. Will let you know whatever the outcome maybe.

regards..

Sounds good bukkan, please do - interested what it can be tracked down to...

Good weekend,

[DionysusToast]

Thanks for the testing Pete and feedback guys: this would be the level of protection offered, the so called signatures / properties would be expected to be 'decompilable'.

Please also see this thread describing potential options in CLI's full product that would unfortunately not be available in the 'CLI for NT' version - http://www.ninjatrader.com/support/f...ad.php?t=38640

This is a real shame because this is a very poor level of protection. As my object structures have been exposed, figuring out how I designed my product will be fairly simple.

Do you actually support Ninja + Full CliSecure with obfuscation? Or will any problems I run into along the way be met with a 'not supported' reply?