Protect your .NET code from reverse engineering
A complete IL obfuscation and hardening suite — renaming, control-flow flattening, code virtualization, string encryption, anti-tamper and more. Verified to run identically to your original build.
Free edition — no account needed to download · Explore all features →
// before — trivially readable
public decimal CalculatePrice(int qty) {
return qty * BasePrice * (1 - Discount);
}
// after — flattened, renamed, encrypted
public decimal a(int A_0) {
int b = 1837;
while (true) switch (b) { /* … */ }
}How protection works
Protection happens on your build, not in your source
Nebula transforms your compiled output, so there is nothing Nebula-specific in your projects and no source dependency to manage. Point it at your assemblies — via the desktop app, the CLI, or MSBuild on your build server — and it runs the full pipeline while your developer builds stay untouched.
Capabilities
Layered protection, one tool
Combine transforms to raise the cost of reverse engineering — each one is independently configurable, so you tune protection per assembly and per method.
Identifier renaming
Rename types, methods, fields and parameters to short, meaningless names, so a decompiler shows a.b(c) instead of your design. Reflection, serialization and public-API members are detected and preserved automatically.
Control-flow flattening
Rewrites each method into a dispatcher-driven state machine, so the original if / for / try structure is genuinely destroyed rather than reordered. It works on every method shape and is verified to run identically to your original.
Code virtualization
The strongest protection: your most sensitive methods are compiled to a custom bytecode run by a small embedded VM, so the logic no longer exists as IL. To recover a method an attacker must first reverse-engineer the virtual machine itself.
String encryption
Literal strings — messages, SQL, URLs, keys, the text that gives your logic away — are encrypted with a fresh per-build key and decrypted at runtime through an inlined, unbranded routine. Encrypt every string or just the sensitive ones.
Anti-tamper & anti-debug
A load-time integrity check detects a patched assembly, and a runtime check detects an attached debugger. Both react on your terms — throw, exit, or invoke your own handler — defeating the most common bypass attacks.
Reference-call obfuscation
Calls are routed through injected, unbranded proxy methods, so decompilers and automated call-graph analysis can no longer see which BCL or external method a site actually invokes — stopping tools like de4dot from reconstructing your program.
Resource & metadata hardening
Encrypt embedded resources and strip or obscure the compile-time metadata that leaks intent, removing another layer decompilers rely on and shrinking the attack surface of the shipped binary.
Blazor WebAssembly protection
Blazor WASM ships your real assemblies to the browser — the highest-exposure .NET target. Nebula obfuscates a published app and repairs the blazor.boot.json integrity hashes and pre-compressed copies, so the protected app still loads.
Authenticode & strong-name signing
Because obfuscation rewrites the assembly, signing has to happen after — so Nebula re-applies your strong name and Authenticode-signs the protected output, with timestamping, as the final step of the pipeline.
Defense in depth
Layers that compose around your code
No single transform is a silver bullet — resilience comes from stacking them. Nebula wraps your compiled IL in successive layers, so an attacker has to peel back signing, anti-tamper and anti-debug before they even reach code whose logic has been flattened, virtualized and stripped of every readable name.
- Turn each layer on or off per assembly and per method
- Reserve the heaviest protection for your most sensitive methods
- Defeats automated deobfuscators, not just casual inspection
See it in action
From readable source to hardened output
The same method after Nebula renames every identifier, flattens the control flow into a dispatcher loop, and encrypts the string literals — behaviour identical, intent gone.
public decimal Price(Order o) { if (o.Coupon == "SAVE20") return o.Total * 0.8m; // loyalty discount return o.Total; }
public decimal a(b c) { int s = 0x791; while (true) switch (s) { case 0x791: s = c.d == R(0x3a91) ? 210 : 44; break; case 210: return c.e * V(0x1f); case 44: return c.e; } }
A decompiler now shows c.a(b) and a state-machine loop — never your names, structure, or the string "SAVE20".
Runs everywhere .NET does
One tool, every .NET target
The same protection pipeline covers desktop, web, mobile and libraries — from .NET Framework 4.8 through .NET 10.
Correctness first
Obfuscation that never breaks your app
The strongest protection is worthless if it changes behavior. Nebula's transforms are validated across frameworks so that renaming, control-flow flattening and string encryption produce output that runs identically to your original binary — verified byte-for-byte in our test suite.
How it worksWho it's for
Built for teams that ship real code
If your product runs on a machine you don't control, its logic is exposed. Nebula is for the teams that can't afford to hand that logic away.
Commercial ISVs & SaaS
Keep licensing logic, key math and proprietary features out of a decompiler in every shipped build.
Desktop & line-of-business apps
Software that runs on customer machines — WPF, WinForms and services on .NET Framework 4.8 and modern .NET.
Financial & algorithmic software
Hide proprietary models, pricing engines and calculations that are the whole value of the product.
Browser- & client-shipped code
Blazor WebAssembly and other apps whose real assemblies are downloaded and run on a machine you do not control.
What you get out of it
- Raise the cost and time of reverse-engineering your code
- Keep license checks and proprietary algorithms out of decompilers
- Ship on every current .NET target with no behavior changes
- Still diagnose production crashes with symbol-map de-obfuscation
Editions
Start free, upgrade when you're ready
Free
For evaluation and small projects
- Identifier renaming
- Up to 2 encrypted strings
- Up to 2 control-flow-protected methods
- CLI & GUI
Pro
The full protection suite, no limits
- Everything in Free, with no caps
- Full string encryption & control-flow flattening
- Anti-tamper, anti-debug & resource encryption
- Authenticode signing & MSBuild integration
- Stack-trace de-obfuscation (symbol maps)
- Priority email support
Download Nebula.NET
Windows installer with the CLI and desktop GUI. Start with the Free edition — no account needed.
Looking for a license key? See pricing & buy →