Another Visio programming problem

[Roger Billsdon]

Hi
I've hit another problem, this time it's with sinking custom events raised by Visio. The event sink in my program doesn't catch events raised by Visio if the SmartAssembly pruning option is selected. I was hoping to use pruning to help increase security and reduce program size. As before I tried adding Microsoft.Office.Interop.Visio to the exclusion list for this option, but in this case it made no difference.

Two questions:
1. How secure are programs that are obfuscated without the pruning option?
2. Do you have a whitepaper or any other documentation that describes the various options, the implications of using them or not, and any common problems when using SmartAssembly. At present I'm having to randomly try various options which is a little time consuming and tedious.

Many thanks
Roger

[nick.maidment]

Hi Roger,

1. I'm not entirely sure how best to measure that, as it depends on what level of obfuscation you apply. I think the best thing I can do is give you an idea of what code should look like before and after obfuscation. it's detailed here: http://www.red-gate.com/supportcenter/Content.aspx?p=SmartAssembly&c=SmartAssembly/help/5.0/SA_ObfuscatingCode.htm&toc=SmartAssembly/help/5.0/toc1032210.htm

2. There is a fair amount of information here: http://www.red-gate.com/supportcenter/Product.aspx?p=SmartAssembly in the "learning SmartAssembly -> using SmartAssembly section near the bottom of the page

[Roger Billsdon]

Hi Nick

Many thanks, but I'd already read through those.

Because all the SmartAssembly help topics are all marked "Help content is still under construction" I thought maybe you might have some additional content (even if it's only in draft form) that was a little more specific to the pruning or interop problems I'm hitting?

Best regards
Roger

[Paul.Martin]

With regard to 1) - depending on your coding style pruning is mostly a code optimization process rather than a security process.
The main times it will increase security is when you have code with testing hooks, future/obsolete functionality. However it will always improve security of metadata only elements like properties and events (which only exist as metadata and are only there as pointers to the underlying get/set/add/remove methods).

Have you excluded the event sink itself from pruning?