1. An execution method of .NET program after encryption, characterized in that said method comprises: loading an HOOK engine and a .NET kernel, starting a .NET process, and beginning to run a .NET program module by an operating system; determining, by the HOOK engine, whether a current program module is encrypted; if the current program module is encrypted, invoking, by the HOOK engine, a decryption module to decrypt the current program module, compiling and executing the current program module in real time by the HOOK engine, and determining whether the current program module invokes a sub-program module by the HOOK engine; if the sub-program module is invoked, obtaining the sub-program module, and determining whether the sub-program module is encrypted; if the sub-program module is encrypted, invoking the decryption module to decrypt the sub-program module, compiling and executing the sub-program module in real time, as a result, going on running, invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted by the .NET process; if the sub-program module is not encrypted, compiling and executing the sub-program module in real time, as a result, going on running and invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted by the .NET process; if the sub-program module is not invoked, going on running and invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted by the .NET process; and if the current program module is not encrypted, compiling and executing the current program module in real time by the HOOK engine, going on running and invoking other program modules by the .NET process, returning and executing the HOOK engine to determine whether the current program module is encrypted.