Obfuscation tool with click-once support - security

I have found a lot of obfuscation tools with no clickonce support.
Could you provide vendors with click once support?
I would like to deploy obfuscated software at once without adding ANY extra line of code (pre-buid, post build etc)
p.s. I believe that is software related

I can't speak for other obfuscation products, but this has been a request of customers of Dotfuscator.
An integrated method for obfuscating ClickOnce applications is not currently available but will be coming in the next major release of Dotfuscator. I know this, because the task is currently assigned to me :) .
If there is anything in particular that you would like to see please feel free to let me know and I'll make sure to keep it in mind as I work on it.

You can create the manifests outside of Visual Studio using mageui (run mageui from the visual studio command prompt). It requires a little more work, but you can create the manifests with the dll's post-compile. If you want to make it easier after the initial setup, you can create a nant build file to do all the steps for you using mage (command line equivalent to mageui).

I produce a piece of software called ClickOnceMore which can be used to create ClickOnce manifests from obfuscated assemblies. Its more user friendly than Mage and MageUI and has a command line version that can be included as part of a build process. I have several customers who use it in conjunction with obfuscators, particularly Dotfuscator.
You can find the software here: http://www.clickoncemore.net

The Dotfuscator software included in Visual Studio 2010 will obfuscate your code and re-sign the manifests for you. Prior versions would obfuscate, but then you had to re-sign the manifests yourself.

Related

one installer for 3 programs

I would like to run one installer for three programs, i.e. Folder is created under the name KAM Package, and there are three separate folders with three separate programs and their files. They must also be separately in the start menu.
Welcome to Stackoverflow: Please try to elaborate your questions and make them as specific as possible so we don't end up writing stuff that doesn't help or answer anything of what you really intended to ask about (happens more often than we'd like).
Deployment Tools: As others have said, please choose a deployment tool first. I'll just link to a previous answer to see if it helps you: How to create windows installer (links to Windows Installer tools and legacy setup tools - please do have a look).
Free MSI Tools: And there are free tools you can use to inspect compiled MSI files: Orca, InstEd or SuperOrca (towards bottom). These are not full-fledged tools to create MSI files, but they work great as viewers and for small hotfixes and changes, etc...
Some Links:
Wrap C# application in .msi installer
Windows service NOT shown in add remove programs under control panel
What installation product to use? InstallShield, WiX, Wise, Advanced Installer, etc

How to embed Visual C++ runtime required from third party dlls

I have a software that is coded in C#. It depends on two(!) third party dll which require Visual C++ 2008 and Visual C++ 2005 redistribute. Originally the installer was built in InnoSetup with all "vs200x_sp1_vcredist_x??.exe" embedded and run on install time. However since it lacks of some advanced features we decided to migrate to Wix Toolset.
The problem is, MSI was running in a more restricted environment, so I didn't figure out what is the best way to require those redistributable file being executed properly. I was tried to use merge modules instead but it didn't work - I can see that the files were installed but dependency walker shows that dll is still not link to the right version.
I think that WinSxS makes things worse at least in this case, since the software keep failing with some error message regarding "Windows Side by Side configiration (14001)" when I use the merge module approach.
So the question is:
Are there any way to build a MSI that runs a exe that install some prerequisites? I wouldn't mind those prerequisites being downloaded or just embedded.
I know that WinSxS information is stored in the manifest of the dll. So if I was permitted to remove the manifest information by the third party company, and use dynamic dll loading instead the problem could be resolved. However is this legitimate? Since I will then need to embedded the Microsoft dlls directally in the msi.
I have noticed one of the dll's manifest says its required version is "9.0.21022.8" but the one in my MSM file is "9.0.30729.6161". Is this the issue? If so can I resolve the issue by I modifying the manifest to allow the right version? I don't think this will cause the dll not working, anyway.
The msi file should install only your software. If you need to install pre-requisites, you should use a bootstrapper for it. Bootstrapper's responsibility is to install pre-requisites and it's not a task of your msi.
If you see that wix bootstrapper is complex you can try on a simple bootstrapper like the dotnet installer bootstraper. you can download it from
http://dblock.github.io/dotnetinstaller/

Setting up a 1-step build for a Visual C++ Application

Any suggestions? Code and artwork/assets are all in SVN, and we don't want to port it to GCC or another compiler before anyone suggests it!
Simplicity and minimising 3rd-party tools is preferred, since we don't have a build-server it'll probably still be run on a developer's PC but we don't want them just doing a build manually and packaging it up.
It's basically just a C++ solution with several projects, plus we have an Inno Setup installer to build.
Right now it's a 3-step process (or 4 if you include uploading the release to FTP):
Get from SVN
Build solution from VC++
Run Inno to create the packaged
installer
You can use MSVC pre, post & custom build steps to do this, they run programs through the windows command line. also see this: http://blogs.msdn.com/b/visualstudio/archive/2010/04/26/custom-build-steps-tools-and-events.aspx
If you can't do it with the VS build steps (see Necrolis' answer), then in the past I've used makefiles run with nmake, which is included with VS (you need to start a command prompt with the right environment settings for VS - there's a shortcut on the start menu.)
Nowadays I use FinalBuilder ( http://www.finalbuilder.com/home.aspx ) for all this sort of stuff, which is expensive and doesn't meet your 'not 3rd party' desire, but is an excellent tool. Once you get into it, you'll realise that there are probably far more steps you'd like to do than merely compiling/packaging - you probably want to be incrementing version numbers, moving files around, creating directories, etc. FB is good at that sort of stuff.
I am adding up to date answer for other users:
Currently there is 3rd party extension available which integrates Inno Setup into Visual Studio and allows you to build installers directly from IDE (or from command line using MSBuild).
It is possible to use pre, post & custom build steps, batch files, code signing, running programs through the windows command line etc.
Check Visual Studio Marketplace for more info about Visual & Installer: https://marketplace.visualstudio.com/items?itemName=unSignedsro.VisualInstaller

How to properly install MS VC++ 9 runtime?

I have an application that uses the ms vc++ runtime. How should I install it on the end-user's system if it is not present? I was thinking of bundling it with the installer... but how would I do that as far as what to include? Is there some silent installer? If so, where can it be found? I can't seem to find it in the Windows SDK.
There is an interesting post about deploying the runtime libraries on the Visual C++ blog. The post is about VC8 so I'm not sure all the recommendations apply to VC9.
Here are your options according to Microsoft:
Use an .msi installer including the .MSM files for the VC
libraries you're using. These MSM
files install the libraries globally.
They also keep a reference count so
that the libraries are removed when
the last application using them gets
uninstalled.
Use "app-local"
deployment i.e. copy the
libraries and manifest files in your
application directory. This is a simpler
solution if you don't use an .msi
installer. Your app should still use the
system version of the libraries if they are more
up-to-date than your own.
Link everything statically (and avoid crt usage across dll boundaries)
Another option Microsoft discourage you from using is running the Visual C++ redist installer from your own installer.
I'm not sure what their reasons are. It will take a few extra megabytes and will not be reference counted but it still works very well AFAICT. You can pass the /q option to vc_redist_x86.exe to perform an unattended install (no user interaction).
It has it's own installation program. I've seen it usually run as a prereq step of a larger installer.
One way or the other, you need to list it in your manifest. So you might just as well deliver it as via SxS in your application rather than try to deliver a global copy to the target machine. SxS is a big hard subject, sadly. Hopefully someone will supply an answer with more details and I'll delete this one.

Running Resharper code analysis outside of Visual Studio

Resharper includes various analysis rules which can be run on your solution from inside Visual Studio but is it possible to run these from say the commandline or as part of your autobuild? Resharper seems to be focused on running in Visual Studio but can it be invoked on solution or project files from outside the IDE?
UPDATE: Seems like TeamCity 7.0 EAP includes a way to execute the code-analysis while building
(blog post) so at least it can somehow be invoked and utilized as part of a CI process.
No, this feature is not currently offered by ReSharper. There is a thread on the JetBrains website related to this question and it can be found here.
Here's a quote:
Currently ReSharper has no interface
from running in a standalone batch
application. However, it is possible
to write such an application that
provides the functionality you're
looking for using ReSharper OpenAPI.
So apparently you could use the ReSharper OpenAPI to create the functionality you want; unfortunately, I haven't had any experience in using it so I'm not much help there.
Some links of interest...
ReSharper OpenAPI Developer Community
ReSharper public API and sample source code (aka. ReSharper PowerToys)
I think you want the functionality provided by fxCop. I am not aware of Resharper functioning outside of Visual Studio.
Looks like they're listening! First version available as a 30-day demo now: http://blogs.jetbrains.com/dotnet/2013/03/resharper-code-analysis-goes-beyond-visual-studio/
If you're looking for compliance of code to standards, take a look at StyleCop. You can tie it into msbuild and run the rules outside of the IDE.
No, it can not be run from commandline. I still hope that they add this feature since I requested it last october :)

Resources