Nebula.NET 1.1: code virtualization, Blazor WASM protection, and beating de4dot

Nebula.NET 1.1 is our anti-reverse-engineering release. It adds the strongest protection we ship — code virtualization — a dedicated way to protect Blazor WebAssembly apps, and a set of hardening changes aimed squarely at the automated deobfuscators attackers reach for first.

Code virtualization (Enterprise)

Renaming and control-flow flattening make code hard to read. Virtualization makes it not there. Nebula compiles your most sensitive methods to a custom bytecode executed by a small embedded VM, and replaces the method body with a stub that runs it. A decompiler no longer shows your logic — only a call into the VM:

public static int Validate(string key)
{
    return VirtualMachine.Run(typeof(LicenseCheck).TypeHandle, 100663302, /* … */);
}

To recover the method, an attacker first has to reverse-engineer the VM itself — a completely different order of effort than reading flattened IL. It’s ideal for licence checks, key derivation and proprietary algorithms, and because the runtime targets .NET Standard 2.0 it works on every .NET target, including .NET Framework. See the virtualization guide.

Blazor WebAssembly protection

Blazor WASM downloads your real assemblies to the browser, which makes it the most exposed .NET target — and one most obfuscators ignore, because you can’t simply obfuscate the DLLs: Blazor checks each one against a SHA-256 integrity manifest and refuses to load a mismatch.

The new nebula blazor command handles it end to end — obfuscate a published app and repair blazor.boot.json plus the pre-compressed .br/.gz copies, so the protected app still loads:

dotnet publish -c Release -o publish
nebula blazor --framework publish/wwwroot/_framework --config nebula.config.json

Details in Protecting Blazor WebAssembly.

Built to beat de4dot

A knowledgeable attacker’s first move is to run an automated deobfuscator like de4dot to strip protection in one click. Nebula 1.1 targets the specific techniques those tools use:

• Control-flow that can’t be constant-folded — the dispatch state is masked with a runtime-computed key, so there’s nothing to statically fold and rebuild.
• String encryption that can’t be auto-stripped — a per-call-site key means the decryptor isn’t the signature de4dot auto-detects, and no single call reproduces a string.
• A hidden call graph — reference (proxy-call) obfuscation routes calls through unbranded proxies so tools can’t see what you’re calling.
• No IL at all — virtualized methods have nothing for a deobfuscator to clean up.

Don’t take our word for it: obfuscate a build, run it through de4dot, and open the result in our free Glass.NET decompiler. The control flow is still flattened, the strings still encrypted, the virtualized methods still just a VM call. More in Resisting automated deobfuscation.

Also in 1.1

• requireLicensedEdition fails the build instead of silently downgrading if the licence can’t apply the requested protection — and the build path re-verifies its online lease so a revoked licence is caught.
• Nebula.Runtime now targets .NET Standard 2.0, so virtualization runs everywhere.

Nebula.NET 1.1 is a free-to-try upgrade for existing users. Download it, or see the full feature list and editions.