Serialization-Safe .NET Obfuscation:
A Field Guide to JSON and XML Contracts

The pattern is always the same. The protected build sails through smoke tests, deploys clean, and then production starts returning invoices whose Currency is null. Which symptom you get depends on how each serializer reacts to a name it can no longer find.

Every DTO is governed by two contracts. The wire contract — keys, element names, discriminators — is owned by your partners and captured in every payload you have ever exchanged. The symbol contract — the identifiers in your assembly metadata — is owned by you and, ideally, by your obfuscator.

Contract attributes decouple the two: the wire name moves into an immutable attribute payload, and the symbol becomes free to scramble. Bare members weld the two together — the serializer uses the symbol as the wire name, so any rename silently rewrites your public data format.

A serializer treats your assembly metadata like a phone book: hand it the string "Currency" and it looks up which property that names. Renaming is reprinting the phone book with scrambled entries — callers keep asking for "Currency", but no such entry exists.

{
  "$type": "card",
  "payment_ref": "PAY-20391",
  "Currency": "EUR",
  "last_four": "4242",
  "ExpiryMonth": 12
}

And lose the guilt about a readable DTO. It is a data bag with no logic in it, and its names were public the moment the first payload left your network. What an attacker must never read is the code that fills the data bag — and that code keeps every protection you have.

Here is the contract behind that invoice payload: a polymorphic payment hierarchy for System.Text.Json and Newtonsoft.Json, plus an XML envelope for System.Xml.Serialization. Members are annotated with which strategy protects them.

using System;
using System.Text.Json.Serialization;
using System.Xml.Serialization;
using Newtonsoft.Json;

namespace Billing.Contracts
{
    // Polymorphic hierarchy for System.Text.Json. Discriminators are
    // explicit strings, so the class names may be scrambled freely.
    [JsonPolymorphic(TypeDiscriminatorPropertyName = "$type")]
    [JsonDerivedType(typeof(CardPaymentDto), typeDiscriminator: "card")]
    [JsonDerivedType(typeof(WalletPaymentDto), typeDiscriminator: "wallet")]
    public abstract class PaymentMethodDto
    {
        // PINNED: the wire key lives in the attribute payload,
        // so the symbol underneath can be renamed freely.
        [JsonPropertyName("payment_ref")]
        [JsonProperty("payment_ref")]
        public string PaymentRef { get; set; }

        // SHIELDED: no attribute, so the symbol IS the wire key.
        // This exact name must survive obfuscation untouched.
        public string Currency { get; set; }
    }

    public class CardPaymentDto : PaymentMethodDto
    {
        [JsonPropertyName("last_four")]
        public string LastFour { get; set; }

        // SHIELDED: "ExpiryMonth" on the wire depends on this symbol.
        public int ExpiryMonth { get; set; }
    }

    public class WalletPaymentDto : PaymentMethodDto
    {
        [JsonPropertyName("provider_id")]
        public string ProviderId { get; set; }
    }

    // XML envelope. [XmlRoot]/[XmlAttribute]/[XmlElement] pin element and
    // attribute names. Derived type names surface in xsi:type, so shield
    // them - or pin them with [XmlType("...")].
    [XmlRoot("InvoiceEnvelope")]
    [XmlInclude(typeof(CardPaymentDto))]
    [XmlInclude(typeof(WalletPaymentDto))]
    public class InvoiceEnvelope
    {
        [XmlAttribute("InvoiceNumber")]
        public string InvoiceNumber { get; set; }

        [XmlElement("Payment")]
        public PaymentMethodDto Payment { get; set; }
    }
}

Imports System
Imports System.Text.Json.Serialization
Imports System.Xml.Serialization
Imports Newtonsoft.Json

Namespace Billing.Contracts
    ' Polymorphic hierarchy for System.Text.Json. Discriminators are
    ' explicit strings, so the class names may be scrambled freely.
    <JsonPolymorphic(TypeDiscriminatorPropertyName:="$type")>
    <JsonDerivedType(GetType(CardPaymentDto), typeDiscriminator:="card")>
    <JsonDerivedType(GetType(WalletPaymentDto), typeDiscriminator:="wallet")>
    Public MustInherit Class PaymentMethodDto

        ' PINNED: the wire key lives in the attribute payload,
        ' so the symbol underneath can be renamed freely.
        <JsonPropertyName("payment_ref")>
        <JsonProperty("payment_ref")>
        Public Property PaymentRef As String

        ' SHIELDED: no attribute, so the symbol IS the wire key.
        ' This exact name must survive obfuscation untouched.
        Public Property Currency As String
    End Class

    Public Class CardPaymentDto
        Inherits PaymentMethodDto

        <JsonPropertyName("last_four")>
        Public Property LastFour As String

        ' SHIELDED: "ExpiryMonth" on the wire depends on this symbol.
        Public Property ExpiryMonth As Integer
    End Class

    Public Class WalletPaymentDto
        Inherits PaymentMethodDto

        <JsonPropertyName("provider_id")>
        Public Property ProviderId As String
    End Class

    ' XML envelope contract.
    <XmlRoot("InvoiceEnvelope")>
    <XmlInclude(GetType(CardPaymentDto))>
    <XmlInclude(GetType(WalletPaymentDto))>
    Public Class InvoiceEnvelope

        <XmlAttribute("InvoiceNumber")>
        Public Property InvoiceNumber As String

        <XmlElement("Payment")>
        Public Property Payment As PaymentMethodDto
    End Class
End Namespace

The rules are identical in VB.NET: Public Property Currency As String carries the same metadata name, and the same exposure.

Skater .NET Obfuscator is built around a member tree: every namespace, type, and member of the loaded assembly appears as a node, and protection options apply per node. That makes the pin-or-shield doctrine a five-minute setup.

1. 1

   Load the assembly

   Open your DLL or EXE in Skater. It indexes the metadata and lays out the full member tree — namespaces, types, properties, methods.

2. 2

   Locate the contract surface

   Walk the tree to your DTO namespaces — Billing.Contracts in the example. If your contracts share one home, you are a single toggle away from managing them all.

3. 3

   Shield what is symbol-pinned

   On the contract nodes, switch off renaming for types and properties. An exclusion set on a namespace node in Skater cascades down to every DTO beneath it — you never enumerate members one by one.

4. 4

   Let everything else scramble

   Attributed DTOs lose nothing — their wire names are pinned in attribute payloads. Engines, converters, validators, and services keep renaming, string encryption, and control-flow obfuscation at full intensity.

5. 5

   Save the exclusion map as a project

   Skater stores your settings as a reusable project file, so the identical shield list applies on every build — including when your pipeline drives obfuscation without a human at the keyboard.

6. 6

   Protect, then drill

   Run protection, and before anything else leaves the building, execute the round-trip drill from Chapter 07 — against the protected binary itself.

Proof, in ILSpy terms. Same assembly, two configurations:

Five steps, run against the protected binary, before every release:

1. 01Golden payloads. Commit one real payload per shape — JSON and XML, one per polymorphic subtype — as test fixtures.
2. 02Round-trip both directions. Deserialize and assert every property binds to a non-default value; re-serialize and compare key sets, ignoring formatting.
3. 03Cover every discriminator and xsi:type. Each polymorphic subtype must resolve in both directions.
4. 04Drill the artifact, not the source. Swap the obfuscated binary into the test output. Testing the development build proves nothing — it was never renamed.
5. 05Make silence fatal. A null where a value belongs must fail the build, not open a support ticket.

[Fact]
public void Card_payment_binds_every_wire_key()
{
    var dto = JsonSerializer.Deserialize<CardPaymentDto>(Golden.CardPayment);

    Assert.Equal("PAY-20391", dto.PaymentRef);   // attribute-pinned
    Assert.Equal("EUR", dto.Currency);           // symbol-pinned: fails loudly if renamed
    Assert.Equal(12, dto.ExpiryMonth);            // symbol-pinned: fails loudly if renamed
    Assert.Equal("4242", dto.LastFour);           // attribute-pinned
}