Question

Is it possible to know the location of const variables within an exe? We were thinking of watermarking our program so that each user that downloads the program from our server will have some unique key embedded in the code.

Is there another way to do this?

Answer 1

Key consideration #1: Assembly signing

Since you are distributing your application, clearly you are signing it. As such, since you’re modifying the binary contents, you’ll have to integrate the signing process directly in the downloading process.

Key consideration #2: const or readonly

There is a key difference between const and readonly variables that many people do not know about. In particular, if I do the following:

private readonly int SomeValue = 3;

...
if (SomeValue > 0)
    ...

Then it will compile to byte code like the following:

ldsfld [SomeValue]
ldc.i4.0
ble.s 

If you make the following:

private const int SomeValue = 3;

...
if (SomeValue > 0)
    ...

Then it will compile to byte code like the following:

{contents of if block here}

const variables are [allowed to be] substituted and evaluated by the compiler instead of at run time, where readonly variables are always evaluated at run time. This makes a big difference when you expose fields to other assemblies, as a change to a const variable is a breaking change that forces a recompile of all dependent assemblies.

My recommendation

I see two reasonably easy options for watermarking, though I’m not an expert in the area so don’t know how “good” they are overall.

1. Watermark the embedded splash screen or About box logo image.
2. Watermark the symmetric key for loading your string resources. Keep a cache so only have to decode them once and it won’t be a performance problem – this is a variable applied to a commonly used obfuscation technique. The strings are stored in the binary as UTF-8 encoded strings, and can be replaced in-line as long as the new string’s null-terminated length is less than or equal to the length of the string currently found in the binary.

Finally, Google reported the following article on watermarking software that you might want to take a look at.