title: Difference between const and static readonly for string obfuscation?
body: <p>We run our .NET binaries through an obfuscator (with at least string obfuscation enabled), and later in the build process make some basic checks to validate this.  I was surprised to notice that by changing strings from <code>static readonly string</code> to <code>const string</code>, the changed strings were now visible in plain text when viewing the disassembled code (via <code>ildasm</code> output).</p>
  
  <p><strong>With regards to string obfuscation, what is the difference between <code>const string</code> and <code>static readonly string</code>?</strong>  </p>
  
  <p>EDIT:
  For the sake of example, here's a small program:</p>
  
  <pre><code>class Program
  {
      private const string MyConstString = "MyConstString";
      private static readonly string MyStaticReadonlyString = "MyStaticReadonlyString";
  
      static void Main(string[] args)
      {
          string myLocalString = "myLocalString";
  
          Console.WriteLine(MyConstString);
          Console.WriteLine(MyStaticReadonlyString);
          Console.WriteLine(myLocalString);
  
          Console.WriteLine("Hit &lt;ENTER&gt; to exit");
          Console.ReadLine();
      }
  }
  </code></pre>
  
  <p>After looking at the .il code, the only value in plain text is for the <code>const string</code>.  This is true for two different obfuscation tools:</p>
  
  <pre><code>.field private static literal string a = "MyConstString"       // using Dotfuscator
  .field private static literal string '[SOH]' = "MyConstString" // using RedGate SmartAssembly
  </code></pre>