Is it possible ( or how) to dump source code/machine code from memory?

Question

I am actually working for the side of software protection. But in order to properly protect my source code ( be it .Net or C++), I would need to understand what is achievable ( and not achievable) from hacker's point of view .

I can protect/obfuscate/encrypt/virtualize my code all the way I want, but when the source code is loaded into the memory, it will have to be unprotected in order to run. So at this point of time, can hacker dump the source code out from the memory, and thus recover my source code in full, unadulterated fashion?

If yes, how this can be done? Using what tools?

Edit: from my finding, it seems that this is doable, and there are protection tools that can prevent this, such as Agile.Net:

Method Level Code Encryption - Encrypts all the MSIL code and keeps it in a secure storage. When the assembly is loaded Agile.NET binds to the .NET runtime engine and manages decrypting the MSIL on a per method basis. Agile.NET creates a runtime environment that executes the original MSIL code by decrypting one method at a time, this important virtue minimizes the exposure of MSIL code in memory thus prevents dumping the code from physical memory.

But I have no idea how, can anyone shed some lights on this?

Answer 1

Just to be clear: You can not reconstruct source code from .net or c++ binaries. You can try to recover it using heuristics, embedded symbols and knowledge about the assembler, but you already lost the necessary information in translation.

You should differentiate between packing and obfuscation.

Packing means you encrypt (and / or compress) parts of your compiled code and have a decryption / unpacking stub at the beginning, fetching the encrypted blocks and unpacking them. This can be often observed in the case of malicious software. In this case, you can dump the memory right after the decryption process and it will be unencrypted.

There are more sophisticated means of packing like VM-packing, which increase the challenge of dumping the data noticeably, but there has been a lot of research in this area. That being said, something like a general unpacker does not exist.

Obfuscation on the other hand alters the code directly in a fashion which makes it still able to be executed. For example, a common technique is obfuscating the control flow though the use of spaghetti code, e.g. inserting unnecessary branches and jumps. These operations can principally not be undone and increase the challenge of reversing significantly.

-> You can not hide the logic you want to execute from the machine you want it to run on. You can only make it harder for humans to figure out what your code does.