Agile.NET Protection for Custom Indicator

[trubolotta]

I'm using NT8 to develop a custom indicator. The indicator compiles without error using the NinjaScript editor or Visual Studio It loads without problem in the charts I have tested thus far. I have also exported the indicator and imported the indicator without any problem. I then added a the free trial version of Agile.NET for obfuscation. I ran it once though no license was required for the free trial version. I'm able to import the obfuscated DLL without any problem and it works.

I then examined the "obfuscated" DLL using JetBrains dotPeek. Every name of every variable, type and method was exposed. The export utility of NT8 simply requires a checkbox be checked to protect the DLL using Agle.NET, I don't see any requirement for configuration or any other setting that might affect the use of Agile.NET. I don't see any information in the help system that requires anything more than the checkbox be checked. What I see in dotPeek is an unprotected DLL. I have assumed, perhaps incorrectly, that the free trial version will perform as the full paid version. After all, it is a "free trial" before purchase that should show me what I am buying. If that is true, then the problem would appear to be in the NT8 implementation through the export utility.

Any help or information to get DLL obfuscation using Agile.NET working properly would be appreciated. What it does now is unacceptable yet it has been recommended by the SecureTeam.

[NinjaTrader_ChelseaB]

Hello trubolotta,

Welcome to the NinjaTrader forums!

I'll have to look into this and I will let you know what I find.

I appreciate your patience.

[NinjaTrader_ChelseaB]

Hello trubolotta,

I gave this a test and it looks like the variable names and method names can be seen with the Agile.NET obfuscation, but the logic cannot be seen and the script code cannot be opened.
https://drive.google.com/file/d/1TLD...w?usp=drivesdk

Knowing the names of variables and methods doesn't really do much in way of being able to recreate a script without the logic inside.

I'm not sure that it would be possible to hide the class, variable, and method names as the application running the script still has to know what those are. I would recommend contacting the SecureTeam directly to see if this is possible with their application.

[trubolotta]

Unfortunately, the names of the indicator I have written are very descriptive of what the indicator does. It reveals the underlying principle of the indicator and once that is known, the logic isn't that difficult to write. Dotfuscator re-writes all of the names but is more difficult to use than a single checkbox. The renamed reference names are there for the script to run but reveal nothing about the underlying principles, which is what I want. But I'm having a problem with Dotfuscator as well since NT provides no information as to what references are needed and their paths, or any of the setup parameters required to use an obfuscator directly on the compiled DLL.

I will contact the Secure Team as you recommend but I think people should know that Agile.NET has a big hole in it as far as security is concerned. Would you have a link to contact the Secure Team? Thank you (and I appreciate how promptly you replied).

[NinjaTrader_ChelseaB]

Hello trubolotta,

I would suggest using a different name for the class, method, or variable.

You are requesting that in our help guide we mention that Agile.NET does not hide the class, method, and variable names?

https://ninjatrader.com/support/helpGuides/nt8/protection_dll_security.htm

[trubolotta]

Using different names is not practical. There are multiple classes, over a hundred variables, multiple type definitions and numerous methods. All of the names were selected to make the code understandable and all of which are exposed. Renaming would make the code very difficult to maintain and difficult to follow, even with full access to the script. In addition, there is a separate administrator and subscriber version. It could be done given enough time but it shouldn't be necessary.

The help guide, which I consulted first before posting here, says nothing about this limitation of Agile.NET.

I have left a support request to Secure Team. I'll see what comes back and post a reply here if it is helpful. Other developers may find it useful.

[NinjaTrader_ChelseaB]

Hello trubolotta,

We appreciate anything you can report back.

[trubolotta]

I have not heard from Secure Team yet but it is early. I did get Dotfuscator Community Edition to work on the two indicator DLLs I need protected. I installed them in NT 8 and they work perfectly, so far. The key was setting the proper configuration and selecting the right objects to exclude from renaming.. Everything I wanted renamed, including types, variables, dependency classes and methods were all renamed. Depending on what I hear from Secure Team, I'll then decide whether to go with Agile.NET or Dotfuscator Professional.

[trubolotta]

I have not heard anything from Secure Team, not even an acknowledgement that I asked a question. Consequently, I have decided the best security would be to place the critical algorithms in a C++ dll. Unfortunately, I have not been able to get even the simplest dll to work with NT8. I actually have made a related post to that effect here:

https://ninjatrader.com/support/forum/forum/ninjatrader-8/platform-technical-support-aa/1111966-c-dll-not-found-in-c-indicator

[frankduc]

trubolotta,

In post 8 you said

I installed them in NT 8 and they work perfectly, so far. The key was setting the proper configuration and selecting the right objects to exclude from renaming..

Than in post 9 :

I have not been able to get even the simplest dll to work with NT8.

Did it work with the Dotfuscator Community Edition, i am looking for an alternative to secure team.

From the reading i done on the web it seems pretty much any code can be decompile, there is no real ultimate protection.

Do you have a link for Dotfuscator Community Edition ? Have you think about Eazfuscator or ConfuserX?

Ty

[islandvicats]

I have not been impressed at all with Secure Team. We have been using them for a couple years, and it is not a pleasant process. They auto renewed our license but the service has been interrupted. It was auto renewed yesterday and expires today (apparently it expired yesterday because today I cannot use it today). The "delivery" of the renewed license will be "no later than" the 16th of Oct. Our years of experience with Secure Team is that they have zero sense of urgency and are unresponsive for the most part. I just filled out their contact form on their website and the email was sent to me from me. I have no idea if they will even get my email. It would be great if NinjaTrader had an alternative to Agile.NET.

I too am anxious to hear about Dotfuscator Community Edition

[b16_aln]

I would interested in hearing about any obfuscation that works with nt8 which isn't agile.net.

Dotfusator looks interesting, is anyone can post their experience or settings that work with NT8 that woud be very helpful.

Thanks

[trubolotta]

To bring everyone up to date following this topic, I have not heard a word from Secure Team concerning my questions about AGILE.NET. This is totally unsatisfactory and a weak spot in the level of service provided by NT. I still prefer AGILE.NET because it is simple to use. The indicators I have developed are for my son to use on the source code I wrote. Since he has other developers working on less critical indicators, he prefers obfuscating the source code himself to minimize the number of licenses that would be required. I gave up on Dotfuscator because of the ambiguous settings and lack of instructions.

What I did to make AGILE.NET acceptable was to rename every variable, type and method to conceal their purpose and the general structure of the indicator. I left the original names intact but commented out so I could maintain the code. I had to do that twice for the "admin" and "subscriber" versions of the indicator. It was time consuming and tedious work.

On a separate issue concerning the DLL, I have not found anyway for a native DLL to work with NT8. I've used native DLLs with c# before but the NT8 implementation simply doesn't work.

[NinjaTrader_ChelseaB]

Hello trubolotta,

Below is a link to referencing 3rd party assemblies.

https://ninjatrader.com/support/helpGuides/nt8/using_3rd_party_indicators.htm

Are you finding when following these steps the classes in the assembly cannot be referenced?

[trubolotta]

Are you finding when following these steps the classes in the assembly cannot be referenced?

I've tried this before and keep getting the same error: incorrect format. The DLL I wrote was done with C++ and compile into native code. I have tested that DLL in vanilla c# and it works. No such luck with NT8.