Babel 11.8.0 Release Notes

We are pleased to announce the release of Babel 11.8.0.0. This release makes protected applications start on FIPS-enabled hosts, delivers a major speed-up when obfuscating very large assemblies, and fixes a number of long-standing runtime failures in Avalonia, WPF and .NET MAUI applications.

Babel Obfuscator

Babel Obfuscator 11.8.0.0 introduces a managed AES encryption algorithm for hosts where the platform cryptographic provider cannot be used, significantly reduces obfuscation time on large assemblies, and resolves several issues that could cause protected applications to fail at runtime.

Enhancements

• FIPS-Enabled Hosts — Managed AES Encryption: A new opt-in encryption algorithm, enabled with --use encryption=aesmanaged (or <Use>encryption=aesmanaged</Use> from MSBuild), lets assemblies protected with Code, String, Value/Array or Resource Encryption start on hosts where the system cryptographic provider is unusable — most commonly Linux containers in a broken OpenSSL FIPS state, where protected applications previously failed at startup before any of your code could run. Your assemblies are encrypted exactly as before; only the decryption routine carried inside them changes. Available on .NET Framework and .NET (Core). Because the managed decryptor runs at roughly 40 MB/s, we recommend not combining it with non-cached Code Encryption on performance-critical methods.
• Faster Obfuscation of Large Assemblies: Three of the slowest stages of the obfuscation process have been reworked. Full-feature obfuscation of a 7.9 MB assembly is about 24% faster end to end, and very large attribute-heavy assemblies that previously could not complete the renaming phase — such as a 41 MB assembly with around 69,000 types — now finish in about 20 seconds. The obfuscated output is identical to 11.7.0.
• Dynamic Target Runtime Detection: Babel now detects the target runtime version of the assemblies it processes automatically.
• Hardware Dongle Binding Sample: A new runnable cross-platform sample shows how to bind an application protected with Code Encryption to a hardware licensing dongle — KEYLOK, SafeNet Sentinel, Wibu CodeMeter, Marx CrypToken and similar — so that a swapped or stubbed dongle library cannot bypass the protection.
• New Warning OB0009: When map files are supplied but cross assembly obfuscation is not covered by your license, the map is skipped and references to renamed external symbols keep their original names. This previously surfaced only as a TypeLoadException when the application ran; it is now reported as a warning at build time.

Bug Fixes

• Avalonia — Resource Encryption: Fixed obfuscated Avalonia applications crashing at startup with FileNotFoundException on avares:// assets and XAML when Resource Encryption was enabled. Avalonia keeps all of an assembly’s XAML and assets in a single resource blob that its asset loader reads directly, so that blob is now left unencrypted while every other resource is still encrypted. Avalonia applications can now be obfuscated with Resource Encryption enabled. WPF is not affected. To produce a single-file Avalonia application, use assembly embedding rather than merging.
• WPF — Theme Dictionary Merge: Fixed control themes being lost when merging assemblies that each contain a resource dictionary at the same path, typically themes/generic.baml. Colliding dictionaries are now preserved and linked through merged dictionaries, keeping the primary assembly’s lookup precedence.
• .NET MAUI — XAML Language Primitives: Fixed the x: prefix being dropped from language primitives in x:TypeArguments (for example x:Double becoming Double), which crashed .NET MAUI iOS Release builds with XamlParseException ("Type Double not found").
• Renaming — Self-Referencing Types: Fixed a System.TypeLoadException at type initialization caused by renamed types keeping stale self-references. This affected assemblies processed by IL weavers such as ArxOne.MrAdvice, as well as applications using C# top-level statements.
• Renaming — String-Keyed Lookups: Fixed renaming rewriting unrelated string arguments — XAML control lookups, dictionary keys and custom registries — on any type deriving from a base class that implements INotifyPropertyChanged. Only recognised PropertyChanged calls are rewritten now.
• Control Flow Obfuscation — Runtime Load Failures: Fixed intermittent FileNotFoundException errors at runtime, such as SSIS error 0xC0011008, caused by control flow helper methods being placed in types that pull in an external assembly when loaded.
• Invalid License No Longer Falls Back to Demo Mode: When a license file was supplied explicitly but was not valid for the version being run, Babel silently continued in demo mode and produced a time-bombed assembly without the licensed features — something typically discovered much later. A license provided explicitly must now be valid for the product and version, otherwise Babel stops with Error: the license provided is not valid for Babel Obfuscator <version>. and produces no assembly. Running with no license at all still starts demo mode with the reduced feature set, as before.
• Trial Licenses on Linux: Fixed licenses carrying a run-time or instance-count trial restriction failing to validate on Linux hosts, including the Babel Obfuscator NuGet task running in Linux containers.

Changes

• Distributed Tools Self-Obfuscated with Managed AES: The Babel Obfuscator NuGet package and the shipped command line tools are now self-obfuscated with the managed AES algorithm, so the tools themselves start on FIPS-enabled hosts.

Babel Licensing

Babel Licensing 11.8.0.0 keeps license validation working on FIPS-enabled hosts, lets you add features to activation licenses without asking users to re-activate, and fixes several issues affecting gRPC clients, webhooks and Linux deployments.

Enhancements

• FIPS-Enabled Hosts — Startup Resilience: License validation no longer fails with BabelLicenseException: Internal error on FIPS-enabled hosts whose container lacks a certified OpenSSL FIPS provider, for example a RHEL host running an Ubuntu-based .NET container. The license store now falls back to a managed file store when isolated storage cannot be initialised, and to in-memory tracking when no storage is usable, so license validation no longer depends on the operating system cryptographic stack. Existing license store files remain readable in both directions. When the Babel Licensing Service is obfuscated with the managed AES algorithm, the obfuscated service also starts on these hosts.
• Activation Licenses — Feature Updates Reach Activated Clients: Adding a feature to an activation license now reaches already-activated clients on their next validation, instead of requiring a full deactivate and re-activate cycle.

Bug Fixes

• gRPC UserKey Authentication: Fixed all gRPC UserKey logins failing after the security hardening introduced in 11.7.0. If you have many client applications already deployed in the field, an opt-in EnableLegacyUserKeyFallback setting (disabled by default) restores compatibility without redeploying them, while new installations use the corrected path.
• Webhook Payloads: Fixed license, order and report webhook payloads being delivered with single-letter JSON keys when the Licensing Service is obfuscated with symbol renaming. Webhook payload keys are now fixed in camelCase and are no longer affected by obfuscation.
• Trial Licenses on Linux: Fixed licenses carrying a run-time or instance-count trial restriction failing validation on Linux hosts, where the same license validated correctly on Windows and macOS. Application start time and instance count now fall back to per-process values where the shared memory region is unavailable instead of failing. Alpine and musl-based hosts were not affected. This also restores cross-process instance counting and shared application start time on Linux, which previously reported per-process values on all Linux hosts.
• Babel Licensing Service — Auto-Generated Signing Key: Fixed every call made with an issued token failing with 401, and therefore no license being activatable, when the application signing key was left empty in the configuration. Tokens are now signed and validated with the same automatically generated key. Configuring an explicit signing key remains the recommended production setting, since a generated key changes at every restart and is not shared across instances.

Upgrade today to benefit from the latest improvements and bug fixes in both Babel Obfuscator and Babel Licensing!