Babel Obfuscator Tool ★Ultimate

What the Package Contains

Babel.Obfuscator.Tool is a .NET tool  package that installs the babel command. It is the same command line tool shipped in the babel_net* zip packages, with the same options, and it comes with the Ultimate edition and the Babel Licensing site editions (Server and Data Center). The package ships one build of the tool for each supported runtime, .NET 6.0 through .NET 10.0, and the dotnet CLI picks the build that matches the SDK on the machine. Each build contains:

• babel.dll, the command line tool, with its runtime configuration.
• The BabelEncrypt plugin, ready to be loaded with --plugin.
• Babel.Build.dll, the Babel MSBuild task assembly, for build scripts that reference the Babel task by file path.

Like Babel.Obfuscator, the tool package is not on nuget.org: host it on your own feed as described in Hosting the Package.

When to Use the Tool

Use the tool when you want to run Babel yourself rather than as a step of an MSBuild build:

• Obfuscating assemblies that are already built, for example .NET Framework binaries produced by another build system.
• Scripted or batch obfuscation of many assemblies, and agent-driven automation through the AI-friendly mode.
• Running the command line tool on Linux and macOS build machines and agents.
• Utility commands such as decoding a stack trace (--stacktrace), checking the license (--license) or generating an MSBuild project from a command line (--makeproject).

Installing the Tool

Global tool

A global tool is installed once per user and available from every terminal:

dotnet tool install Babel.Obfuscator.Tool -g

When the feed is not listed in a NuGet.config file, pass it explicitly. The source can be a feed URL or a local folder:

dotnet tool install Babel.Obfuscator.Tool -g --add-source ~/NuGet

On Linux and macOS make sure the tools folder is on the path, or the babel command is not found:

export PATH="$PATH:$HOME/.dotnet/tools"

Local tool

A local tool is pinned to a repository through a tool manifest, so every developer and CI agent runs the same Babel version:

dotnet new tool-manifest
dotnet tool install Babel.Obfuscator.Tool

This records the tool in .config/dotnet-tools.json, which you commit. On any other machine, dotnet tool restore installs the pinned version. A local tool is invoked through the dotnet CLI:

dotnet babel --version

Updating and removing

dotnet tool update Babel.Obfuscator.Tool -g
dotnet tool list -g
dotnet tool uninstall Babel.Obfuscator.Tool -g

Drop -g for a local tool. The same commands are described in Install.

Licensing the Tool

The tool needs the same license as the product. A dotnet tool has no installation folder you can copy babel.licenses into, so give Babel the license in one of these ways:

• Set the BABEL_LICENSE_PATH environment variable to the full path of the license file. This is the recommended setup on developer machines and build agents:

export BABEL_LICENSE_PATH=~/Babel/babel.licenses

• Pass --license on each invocation, with the path of the license file or of a folder to search.
• Pass --license env:BABEL_LICENSE, where the variable holds a license key: the right choice on build servers, where the key lives in a secret. For a floating license, store the user key as floating:<user key>.

babel --license with no argument prints the license in use. Remember that a license file is valid for one product version: use the file that came with the same version as the tool, and update both together.

Using the Tool

The babel command accepts the syntax and the switches documented in Command Line and in the Command Line Reference. A typical invocation names the assembly to obfuscate, the output file and the features to enable:

babel MyApp.dll --output obfuscated/MyApp.dll --stringencryption stream --controlflow if=on --controlflow switch=on --iterations 3 --resourceencryption --rules babelRules.xml --mapout

Every feature described in this manual is available from the tool: rules with --rules, merging and embedding with extra assembly arguments and --embed, map files with --mapin and --mapout, plugins with --plugin, and the managed AES decryptor with --use encryption=aesmanaged. With a local tool, prefix the command with dotnet.

Scripting and automation

Since version 11.7 the command line has an AI-friendly mode designed for scripts and agents:

babel MyApp.dll --stringencryption stream --format ndjson --quiet --strict-exit

--format json or ndjson turns the output into a machine-readable stream and routes human diagnostics to standard error, --quiet removes the banner and makes any interactive prompt fail fast, and --strict-exit returns a distinct exit code for invalid arguments, missing input, obfuscation, licensing and signing failures.

Running on a build server

The tool fits pipelines that obfuscate build artifacts as a separate step. With a tool manifest committed to the repository and the feed configured in NuGet.config (see the GitHub Actions example for a configuration that authenticates against GitHub Packages), a GitHub Actions job looks like this:

steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-dotnet@v4
    with:
      dotnet-version: '10.0.x'
  - name: Restore tools
    run: dotnet tool restore
    env:
      PACKAGES_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
  - name: Obfuscate
    run: dotnet babel artifacts/MyLib.dll --license env:BABEL_LICENSE --stringencryption stream --strict-exit
    env:
      BABEL_LICENSE: ${{ secrets.BABEL_LICENSE_SECRET }}

FIPS-Enabled Hosts

Since version 11.8 the tool binaries are self-obfuscated with the managed AES algorithm, so babel starts on hosts whose OpenSSL FIPS provider is broken. The assemblies you protect on such hosts still need a managed decryptor of their own: use the STREAM string encryption algorithm and --use encryption=aesmanaged for the other encryption features, as explained in FIPS Compliance.

Troubleshooting

• babel: command not found — the global tools folder is not on the path; add ~/.dotnet/tools to PATH, or use a local tool and run dotnet babel.
• A message asking to install .NET — the selected build of the tool needs the matching .NET runtime, from 6.0 to 10.0. Install that runtime, or set DOTNET_ROLL_FORWARD=Major to run the tool on a newer runtime.
• A valid license could not be found — check BABEL_LICENSE_PATH or the --license argument, then run babel --license to see what Babel loaded. A license file for a different version is reported as not valid.
• The output differs from a Babel Desktop run — Babel Desktop applies the settings stored in its .babel project, while the tool applies only the switches on the command line. Compare the two configurations, in particular the obfuscation agent and the rules.