Skip to content

Reference

Release notes

What changed in each Nebula.NET release.

The latest Windows build is always on the download page. Verify the SHA-256 shown there against your download.

Each entry is the latest build from its release window; smaller point releases shipped within the same window are rolled up into it, so version numbers may skip.

Edition names. The paid edition is Pro; Enterprise is the top tier.

1.1.5

Released 2026-10-06.

Built-in tamper telemetry — “report-home” (tamperReportUrl, Pro) — set a URL and every guard that fires (anti-tamper, anti-debug, environment/patcher checks, expiry) also POSTs a minimal {"event":"…"} to your own endpoint before its reaction, so you learn when a protected copy is attacked in the field — no callback to write. The send is bounded and self-swallowing (never blocks or crashes the app); only the event name leaves, to your URL, never to Delta1 Labs. Works on .NET and .NET Framework targets; adds outbound traffic (not for air-gapped). See configuration.

Continuous runtime checks (environmentChecksContinuous, Pro) — environment/tampering-tool detection no longer runs only at startup. It subscribes to AppDomain.AssemblyLoad so a profiler or patcher attaching after launch is caught the moment it loads, re-checks at the entry of the methods that call your licensing SDK (the same ones autoProtectLicensing finds), and — with environmentChecksIntervalSeconds — can re-check on a jittered background timer. Opt-in; reuses the same reaction. See configuration.

MonoMod detection — environment checks now also detect MonoMod.RuntimeDetour (Detour / Hook / NativeDetour) alongside Harmony. (Detection is by loaded managed type; a purely native inline hook or raw DLL injection remains out of scope.)

Cross-platform CLI (Linux, macOS & CI) — the protector now ships as a dotnet tool, Delta1Labs.Nebula.Tool, so it runs anywhere .NET 8+ runs. Install with dotnet tool install --global Delta1Labs.Nebula.Tool (the command stays nebula). All IL transforms and strong-name signing work on Linux and macOS; only Authenticode signing remains Windows-only. New guide: Linux, macOS & CI, with container images and GitHub Actions / GitLab CI / Azure Pipelines examples.

Configurable expiry (time-bomb) guard (expiryUtc, paid-gated) — build a demo or evaluation that stops running after a date you set, with a configurable reaction (exit, throw, or a callback into your code).

Environment & tampering-tool detection (paid-gated) — detect a CLR profiler (CORECLR_ENABLE_PROFILING / COR_ENABLE_PROFILING) and the Harmony runtime patcher at startup, and react on your terms. See detecting runtime patching.

Method-encryption anti-dump — encrypted methods now keep their IL encrypted at rest and decrypt per-invoke into a buffer that is scrubbed immediately after, so a memory dump during execution no longer yields the method body.

Auto-protect your licensing code (autoProtectLicensing) — Nebula detects methods that call your licensing SDK (for example Keyright) and automatically applies the strongest protection your edition allows to them, so license checks get hardened without you listing each method.

Unity & [Obfuscation] awareness — automatic preservation for Unity-serialized types and [SerializeField] fields, and the assembly-level [Obfuscation] / ObfuscateAssemblyAttribute is now honoured for public-API preservation.

Metadata hardening — the #Strings heap is rebuilt on write, so identifiers renamed away no longer linger as orphan strings a reader could recover from the raw metadata.

1.1.2

Released 2026-09-23.

Trial-lease enforcement — online trial activations now enforce the evaluation rules through the lease, so a trial-protected build can’t be run as a production license.

MSBuild packaging — ships Nebula.Blazor.targets and a self-contained build task so Blazor WebAssembly protection runs cleanly from MSBuild / CI.

Online activation via Keyright — online license activation now uses the Keyright licensing service by default.

Anonymous usage analytics (Free edition) — the Free edition reports anonymous, non-identifying usage counts to help prioritize the roadmap. No source code, assembly contents or personal data is ever collected. Paid editions don’t send it, and you can turn it off entirely with NEBULA_NO_TELEMETRY=1 (recommended for air-gapped / regulated environments). See the Privacy Policy.

Also in this period — the anti-reverse-engineering work:

Code virtualization (Enterprise) — compile your most sensitive methods to a custom bytecode run by an embedded VM, so their logic no longer exists as IL. See Code virtualization.

Blazor WebAssembly protection — the new nebula blazor command obfuscates a published Blazor WASM app and repairs the blazor.boot.json integrity hashes and pre-compressed copies, so the protected app still loads. See Protecting Blazor WebAssembly.

Built to defeat de4dot — non-foldable control-flow dispatch, per-call-site string encryption, and reference (proxy-call) obfuscation stop automated deobfuscators from stripping protection. See Resisting automated deobfuscation.

Reference (proxy-call) obfuscation (proxyReferences, Pro+) — hides the call graph behind unbranded proxy methods.

Stronger aggressive control-flow (Enterprise) — key-masked dispatch plus non-prunable decoy states.

Universal runtime — Nebula.Runtime now targets .NET Standard 2.0, so virtualization runs on every .NET target including .NET Framework.

Build safety — requireLicensedEdition fails the build (rather than silently downgrading) if the license can’t apply the requested protection, and the build path re-verifies its online lease near expiry so a revoked licence is caught.

1.0.15

Released 14 September 2026.

Build integration — multi-targeting and Visual Studio

  • The MSBuild integration now obfuscates every target framework of a multi-targeted project automatically — it runs once per framework and writes each to its own per-TFM output folder, with the aggregate outer build skipped (no more empty-TargetPath runs).
  • Works under Visual Studio / msbuild.exe as well as dotnet build: under Framework MSBuild the target shells out to the nebula CLI (set NebulaToolPath if it isn’t on PATH).
  • New CLI --input / -i (repeatable) overrides the config’s inputs, so a shared settings-only config (transforms but no inputs) can protect many projects and frameworks while the build supplies each assembly.

Licensing & build safety

  • New config requireLicensedEdition — fail the build if the license can’t apply the requested protection (missing / revoked / lapsed / Free, or an Enterprise-only feature downgraded on a Pro license) instead of silently shipping weakly-obfuscated output. Recommended for build servers and CI.
  • The build now re-verifies the activation lease online as it nears expiry, so a revoked or lapsed license is caught at the next build (previously a cached lease was trusted until it fully expired). See licensing.

Output & hardening

  • Obfuscated assemblies no longer disclose the obfuscator — injected helper types use neutral, non-branded names, so a decompile of your protected code doesn’t point back to the tool that produced it.
  • Stronger control-flow and numeric-constant hardening.

Control-flow

  • Aggressive intensity now also protects branch-free (straight-line) methods, splitting them at safe points into a dispatcher — so even simple linear methods no longer stay readable when you ask for maximum protection.

Desktop GUI

  • Faster on large projects: the assembly tree now virtualizes at every level, so expanding a big type or namespace only renders what’s on screen.
  • Single, predictable selection: clicking, expanding or collapsing any node — at any depth — selects exactly that node (and only that node) and keeps it in view.
  • Loading a project shows a busy indicator instead of appearing to hang.
  • Clearer, restyled tabs and a tidier project toolbar.
  • Very large, string-heavy inputs stay responsive: the tree caps how many individual string entries it lists (type/method selection is never capped; config-level string encryption still covers everything).

Stronger control-flow on real-world methods

  • Fixed a stack-analysis limitation where large methods dominated by a try/catch — especially ones that return from inside the try (a common shape for license checks and validation code) — fell back to a weaker “opaque-predicate only” transform instead of full flattening. These methods are now fully flattened into dispatcher state machines, including nested try bodies. This corrects the modelling of the leave instruction (which empties the evaluation stack per ECMA-335).
  • Added NEBULA_CF_DEBUG=1 to report, per method, why any body couldn’t be flattened.

Trial licensing

  • Fully-functional, time-limited evaluation licenses: everything unlocked until the trial date. The app shows a distinct TRIAL badge and the number of days remaining.
  • Assemblies protected under a trial license carry a startup notice that they were built with an evaluation license and are not licensed for production, and they stop running once the trial date passes. Assemblies protected with a paid license are unaffected and keep running indefinitely — a lapsed paid license only stops you protecting new builds, never the ones you already shipped.
  • Request a trial right from the pricing page.

Editions

  • The desktop app and CLI now clearly show the active edition — Free, Pro, or Enterprise (and Enterprise Trial) — in the title bar, the About box, and nebula license.

Renaming is now optional

  • You can turn identifier renaming off — for example to protect only control flow while keeping names for your own debugging. In the desktop app, selecting nothing to rename now means nothing is renamed.

Reliability

  • Correct handling of value-type signatures when injecting protection into .NET Framework targets.
  • Internal hardening of Nebula’s own licensing code in the shipped build.

1.0.11 and earlier

The initial public releases established the full protection suite:

  • Identifier renaming with public-API preservation and reflection/serialization auto-detection.
  • String encryption, resource encryption, and whole-method encryption.
  • Control-flow obfuscation across all method shapes, including exception-handling bodies.
  • Anti-tamper and anti-debug, metadata hardening, and Authenticode / strong-name signing.
  • Stack-trace de-obfuscation for licensed builds.
  • Per-customer watermarking (Enterprise) for leak tracing.
  • Cross-assembly renaming for multi-assembly products.
  • A command-line tool, a desktop GUI, and MSBuild / CI integration.
  • Licensing: online activation with seats, plus offline signed licenses for air-gapped use.

Questions about a specific change? Contact us.