AOT Compilation Protection

Shield provides specialized protection for .NET applications that use Ahead-of-Time (AOT) compilation, maintaining compatibility while ensuring strong security.

Understanding AOT Compilation

Ahead-of-Time (AOT) compilation differs from traditional Just-in-Time (JIT) compilation in .NET:

• Application code is compiled to native machine code before deployment
• Runtime compilation is eliminated or minimized
• Execution starts faster with lower memory consumption
• Reflection and dynamic code generation may be limited

.NET supports several AOT compilation approaches:

1. ReadyToRun (R2R): Partial AOT that preserves compatibility with the CLR
2. Native AOT: Full AOT compilation with minimal runtime requirements
3. Mono AOT: Used for mobile and WebAssembly scenarios

Each approach presents different protection challenges that Shield addresses with specialized techniques.

Protection Strategy for AOT Applications

Shield employs a comprehensive approach to securing AOT-compiled applications:

1. Pre-compilation Protection: Applies security transformations before AOT compilation
2. Metadata Obfuscation: Secures metadata while maintaining AOT compatibility
3. Native Code Protection: Applies protections compatible with AOT-generated native code
4. Resource Security: Protects embedded resources in AOT scenarios
5. AOT-Specific Optimizations: Tailors protection techniques for each AOT compilation mode

Key Protection Areas

IL Code Transformations

Shield applies transformations to your IL code before AOT compilation:

• Control flow obfuscation compatible with AOT constraints
• Name obfuscation with AOT-specific limitations in mind
• String encryption with AOT-compatible runtime decoding

Native Code Security

For fully AOT-compiled code, Shield provides:

• Metadata protection that preserves AOT compatibility
• Binary-level protections for the compiled native code
• Anti-tampering measures for the native executable

Resource and Assembly Protection

Shield secures resources in AOT scenarios:

• Resource encryption compatible with AOT constraints
• Assembly reference obfuscation that works with AOT compilation
• Protection for satellite assemblies and resources

Getting Started

Shield integrates with your AOT compilation workflow:

1. Apply Shield protection before the AOT compilation step
2. Configure protections using shield.config.json
3. Build your AOT-compiled application

For specific AOT scenarios, see:

• Native AOT Support - Working with .NET's Native AOT compilation
• Performance Impact - Understanding the performance considerations of protection in AOT scenarios

Recommended Configuration

Below is a recommended configuration for AOT-compiled applications:

{
  "preset": "custom",
  "protections": {
    "rename": {
      "rename_public": false,
      "rename_arguments": true,
      "flatten_namespaces": true
    },
    "control_flow_advance": {
      "intensity": 6
    },
    "constants_encryption": {},
    "resources": {
      "compress": true,
      "encrypt": true
    }
  },
  "aot": {
    "mode": "autodetect",
    "compatibility": "high",
    "preserveReflection": true
  }
}

Testing Protected Applications

After applying Shield protection to your AOT-compiled application:

1. Verify successful AOT compilation with protection applied
2. Test startup performance and memory consumption
3. Test all functionality, especially any reflection-based features
4. Test on all target platforms and architectures

Compatibility Considerations

Shield's AOT protection is compatible with:

• .NET 7+ Native AOT
• .NET ReadyToRun (R2R)
• Mono AOT (Xamarin, MAUI)
• Blazor WebAssembly AOT

The compatibility level can be adjusted based on your application's requirements:

{
  "aot": {
    "compatibility": "high" // Options: "high", "balanced", "aggressive"
  }
}

Learn More

For more detailed information about protecting AOT-compiled applications: