How to Obfuscate .NET Applications
That Use JSON and XML Serialization

1 The Problem

Modern .NET serialization engines-including System.Text.Json, Newtonsoft.Json (Json.NET), and System.Xml.Serialization.XmlSerializer-rely directly on metadata reflection to read and write object graphs.

When an obfuscator naively scrambles metadata symbols without rules targeting DTO properties, it renames CustomerName in assembly metadata to a non-descriptive token like a.

• Un-attributed Properties: The serializer reflects over the class, finds property a, and searches incoming JSON for key "a". Because the JSON payload contains "CustomerName", the parser skips binding. The property remains null or default.
• Polymorphic Types: Polymorphic inheritance mechanisms-such as JsonDerivedType in System.Text.Json, $type in Newtonsoft.Json, or [XmlInclude] in XML-rely on exact type names or explicit discriminator strings. Scrambling class names breaks polymorphic type instantiation.

2 Serialization DTO Code Examples

The following practical scenario demonstrates DTO contracts using System.Text.Json, Newtonsoft.Json, and System.Xml.Serialization, including polymorphic inheritance.

using System;
using System.Text.Json.Serialization;
using System.Xml.Serialization;
using Newtonsoft.Json;

namespace MyApp.Contracts
{
    // 1. System.Text.Json Polymorphic Base Contract
    [JsonPolymorphic(TypeDiscriminatorPropertyName = "$type")]
    [JsonDerivedType(typeof(StandardCustomerDto), typeDiscriminator: "standard")]
    [JsonDerivedType(typeof(PremiumCustomerDto), typeDiscriminator: "premium")]
    public abstract class CustomerBaseDto
    {
        // Explicit attribute allows C# symbol renaming without breaking JSON key "customer_id"
        [JsonPropertyName("customer_id")]
        [JsonProperty("customer_id")]
        [XmlElement("CustomerID")]
        public int CustomerId { get; set; }

        // Un-attributed property: MUST remain stable if JSON key is "CustomerName"
        public string CustomerName { get; set; }
    }

    public class StandardCustomerDto : CustomerBaseDto
    {
        public double MonthlyCreditLimit { get; set; }
    }

    public class PremiumCustomerDto : CustomerBaseDto
    {
        [JsonPropertyName("vip_support_level")]
        public int VipSupportLevel { get; set; }
    }

    // 2. System.Xml.Serialization Contract
    [XmlRoot("OrderEnvelope")]
    [XmlInclude(typeof(StandardCustomerDto))]
    [XmlInclude(typeof(PremiumCustomerDto))]
    public class OrderEnvelope
    {
        [XmlAttribute("OrderId")]
        public string OrderId { get; set; }

        [XmlElement("CustomerPayload")]
        public CustomerBaseDto Customer { get; set; }
    }
}

Imports System
Imports System.Text.Json.Serialization
Imports System.Xml.Serialization
Imports Newtonsoft.Json

Namespace MyApp.Contracts
    ' 1. System.Text.Json Polymorphic Base Contract
    <JsonPolymorphic(TypeDiscriminatorPropertyName:="$type")>
    <JsonDerivedType(GetType(StandardCustomerDto), typeDiscriminator:="standard")>
    <JsonDerivedType(GetType(PremiumCustomerDto), typeDiscriminator:="premium")>
    Public MustInherit Class CustomerBaseDto
        
        ' Explicit attribute allows VB symbol renaming without breaking JSON key "customer_id"
        <JsonPropertyName("customer_id")>
        <JsonProperty("customer_id")>
        <XmlElement("CustomerID")>
        Public Property CustomerId As Integer

        ' Un-attributed property: MUST remain stable if JSON key is "CustomerName"
        Public Property CustomerName As String
    End Class

    Public Class StandardCustomerDto
        Inherits CustomerBaseDto
        Public Property MonthlyCreditLimit As Double
    End Class

    Public Class PremiumCustomerDto
        Inherits CustomerBaseDto
        <JsonPropertyName("vip_support_level")>
        Public Property VipSupportLevel As Integer
    End Class

    ' 2. System.Xml.Serialization Contract
    <XmlRoot("OrderEnvelope")>
    <XmlInclude(GetType(StandardCustomerDto))>
    <XmlInclude(GetType(PremiumCustomerDto))>
    Public Class OrderEnvelope
        <XmlAttribute("OrderId")>
        Public Property OrderId As String

        <XmlElement("CustomerPayload")>
        Public Property Customer As CustomerBaseDto
    End Class
End Namespace

3 What Happens Under Naive Obfuscation

Applying default, indiscriminate symbol renaming across DTO assemblies causes severe runtime failures:

4 Step-by-Step Opaquer Configuration

Follow this workflow in Opaquer .NET Obfuscator to protect serialization-heavy assemblies while ensuring 100% contract stability.

5 Before/After Visual Decompiler View (ILSpy)

Observe how decompilers view protected DTO models and processing engines when using Opaquer's selective controls:

6 Testing the Obfuscated Application

Implement automated round-trip testing against protected build artifacts before production deployment:

7 Common Failures and Fixes Matrix

8 Production Recommendations

9 Frequently Asked Questions