Geek Answers Handbook

Is there a way to encrypt a Windows Forms application configuration file?

Is there a way to encrypt a Windows forms application configuration file?

All I can find on google is material dependent on "aspnet_regiis.exe", but I want to do this for a desktop application?

eg. http://msdn.microsoft.com/en-us/library/ms998283.aspx

+4
source share
4 answers

What are you trying to accomplish?

Remember that the program itself needs to decrypt the file, and in your case the EXE file will be located on the computers of end users.
Therefore, anyone who has access to the configuration file will almost certainly have an EXE, and there is no way to prevent them from being read.

If you keep the end user's password and you want to let other people do not read it, you can call File.Encrypt in the file path. Note that this will not work in XP Home.

You can also use the ProtectedData class in System.Security.dll to encrypt an array of bytes, so that only a registered user can decrypt it, and then save this byte array in a configuration file. (This will work in XP home, AFAIK)

+4
source

In response to your comment:

Unable to stop a specific user. If the user tries hard enough, you can’t do anything to prevent him from doing what the application can do on his machine. You can do this extremely difficult, but not impossible.

What are you afraid of what the user will do?

If you want it to be able to see some data, you can use database permissions or stored procedures, or replace the database with a web service.
If you do not want it to be able to copy data, there is no 100% solution.

You can photograph the assembly, but no obfuscator will be completely perfect.
You can add rows like if (Debugger.IsAttached) Environment.FailFast() , but the user can delete them using Reflexil .
You can use the hash of the assembly file as (part of) the encryption key, but the user can replace it with a hard-coded byte array using Reflexil.
If you replace the database with a web service, you can change the web service to detect suspicious requests, but the user can wait between requests and / or use different machines.
You can return images instead of data, but the user can use OCR.

In short, you can make it very complex and time consuming, but you cannot make it impossible.

0
source

I have applied a working solution for your needs. Here is a link to it.

http://www.ardabasoglu.com/1/post/2010/12/encrypting-the-windows-forms-application-settings.html

0
source

More articles:


All Articles