Can my C# program be dumped from memory and reversed into source code?

Question

I have a client application that, once the user is authenticated with my server, sends a byte array which is then loaded using Assembly.Load. I am pretty sure once that happens, even if the loaded bytes are dumped from memory, they cannot be used to re-construct source code. I just wanted to confirm this, or get more information in case I am wrong.

Thanks!

Answer 1

It is in fact trivial to dump the byte array or the module directly from dnSpy.

To mimic the described scenario I wrote some trivial example code:

using System.IO;
using System.Reflection;

namespace DumpAssembly
{
    class Program
    {
        static void Main(string[] args)
        {
            var rawAssembly = File.ReadAllBytes("Test.dll");
            var assembly = Assembly.Load(rawAssembly);
            foreach(var type in assembly.ExportedTypes)
            {
                if (type.Name == "Test")
                {
                    var method = type.GetMethod("DoCoolStuff");
                    method.Invoke(null, null);
                    break;
                }
            }
        }
    }
}

Drop the generated assembly in dnSpy, start debugging and step a little through the Main method. Soon you will be able to save the newly-loaded module:

Once the module is saved, opening it in dnSpy will easily give away your intellectual property:

Now a partial solution for this is obfuscating your module with something like ConfuserEx (it's open source, commercial products are available). This might slow down your attackers but it would be naive to assume they cannot decompile and understand your code within a reasonable amount of time.