.NET6 array new() issue v3.9.0 and speed issue

[AusterX]

Hello,
i've a class with an array as public field (let's say mypubarray), a virtualized method that makes like mypubarray = new byte[size].
VMP 3.8.8 no problem, with 3.8.9 and 3.9.0 the pub array is not substituted with the new one. If instead i do array.resize(ref mypubarray, size) it works normally.

BTW, virtualized functions (compared to v3.8. are like 2x/3x slower, is there a way to speedup? i mean, some coding guideline to suggest?
If i want to virtualize a function, i also virtualize the callers, so that a cracker doesn't know when and how the virtualized function is called, is this the root of the speed issue?
Also, about virtualized huge functions, is it better to split it in several virtualized subfunctions?

//edit
btw, when trying to find the right spot of the bug, i used the .map file and vmp stack trace decoder, but still the excemption had references like this
at 1491851F.E78297A2()
at 1491851F.2AAE079C(Object 5235983F, Int32 B0018830)
which has not and entry in the .map file, so doesn't get decoded....in real in the .map file the crashing method does have an entry, just with different number.
Is it a bug or it's normal, because the virtualized method was part of a class instantiated at runtime?

Thank you

In attach demo for the array bug.

[Admin]

i've a class with an array as public field (let's say mypubarray), a virtualized method that makes like mypubarray = new byte[size].
VMP 3.8.8 no problem, with 3.8.9 and 3.9.0 the pub array is not substituted with the new one. If instead i do array.resize(ref mypubarray, size) it works normally.

Fixed in the 2188 build.

BTW, virtualized functions (compared to v3.8. are like 2x/3x slower, is there a way to speedup?

Virtualized code is always slower that original and it's normal.

btw, when trying to find the right spot of the bug, i used the .map file and vmp stack trace decoder, but still the excemption had references like this
at 1491851F.E78297A2()
at 1491851F.2AAE079C(Object 5235983F, Int32 B0018830)
which has not and entry in the .map file, so doesn't get decoded....in real in the .map file the crashing method does have an entry, just with different number.
Is it a bug or it's normal, because the virtualized method was part of a class instantiated at runtime?

These methods belong to VM, so that's why they don't get decoded.

[AusterX]

Thank you for quick reply, in attach the next bug.

BTW, virtualized functions (compared to v3.8. are like 2x/3x slower, is there a way to speedup?

Virtualized code is always slower that original and it's normal.

I mean, i'm just compiling the same piece of code with some virtualized and some "ultra" methods, same .vmp file with same settings, i just upgrade vmp version and see the execution takes 2x or 3x the time it took the 3.8.8

Thank you

[AusterX]

Thank you for your quick response, 2189 fixed this second issue.

About the speed of virtualize/ultra, in 3.8.8 i used VMComplexity=20, here in 3.9.0 it's 2/3x slower even if i change complexity to 10.
I would like to know if it's something you expect (like you rewrited the whole virtualization code and that's the result), or if it's somethinbg you don't expect, so i must review my coding style, like avoid something (please suggest something), or i must try to spot the slowered functions and try myself different reworks and report you if i find some coding style that makes it so slower?
At the moment i'm forced to use 3.8.8
Thank you

[Admin]

The latest versions have many changes in Mutation/Virtualization/Ultra, so they may be slower than 3.8.8

[AusterX]

So i tried to lighten obfuscation setting on the slowest methods, and found something weird: some methods tooks 20seconds (instead of 0.1s in unprotected exe) even with obfuscation setting set to none.
It took some time to isolate the issue, looks like it's about same/similar piece of code that can be found in different namespaces.
Check attached code

Please follow the code under writefile and writefile_newform buttons

both form1 and form2 has the exact same method (copypaste), savelog(string filepath)
if both forms belongs to same namespace, no problem, each method can be set with different obfuscation settings (mutation+renaming+strings takes 0.5seconds)
if forms belongs to different namespace, it start the issue:
- even if form2.savelog() has obf setting to basically none, both methods takes 20seconds (form1.savelog() has same mutation+renaming+strings that took 0.5seconds if same namespace)
- if form1.savelog() has obf setting to basically none, form2.savelog() reacts to its own obf setting

[Admin]

This happens because "int8 LogStuff.Form2::savelog(string)" decrypts "hh\\:mm\\:ss\\.fff" several times for each iteration of the loop (string "hh\:mm\:ss\.fff" is included in the protection with "Virtualization").

You need to rewrite your code to something like this:

Code: Select all

        private byte savelog(string filepath)
        {
            var format_string = @"hh\:mm\:ss\.fff";
            ...
                                sb.Append(ts.ToString(format_string));
            ...
        }

[AusterX]

Thank you, i'll take care to not abuse with strings to not fillup the VM.
I tought [Obfuscation(Feature = "strings", Exclude = true)] would do the job to disable virtualization on strings, which is what i did for form2.savelog() and not for form1.savelog(), when both went to 20s i tried to spot the namespace issue.

[Admin]

Please notice that all objects (methods or strings) that you see in the section "Functions For Protection" will be obfuscated. ObfuscationAttribute just automatically adds methods/strings into this section. You can also add required objects with "Add Function" in GUI. If the string "hh\\:mm\\:ss\\.fff" was added in the project this string will be replaced with calling of decryptor in all methods where this string was used.

Here is your code:

Code: Select all

instance unsigned int8 LogStuff.Form2::savelog(string)
{
...
00402285 72 51000070	ldstr 70000051 → "hh\:mm\:ss\.fff"
...
0040233B 72 51000070	ldstr 70000051 → "hh\:mm\:ss\.fff"
...
}

instance unsigned int8 testbug.Form1::savelog(string)
{
...
00402AA1 72 51000070	ldstr 70000051 → "hh\:mm\:ss\.fff"
...
00402B57 72 51000070	ldstr 70000051 → "hh\:mm\:ss\.fff"
...
}

The string "hh\:mm\:ss\.fff" (with ID = 70000051) was used in both methods, so VMProtect removed this string from the file and replaced "ldstr" with "call InternalDecryptString" in both methods.

[AusterX]

Ok, so the problem is: same "string content" present in different methods (even as local variables), VMP treats them as the verysame one, in the GUI i see only 1 string "hh\:mm\:ss\.fff"

Code: Select all

[Obfuscation(Feature = "strings", Exclude = true)] // don't want string encryption
method1
{
    .....
    string local1 = "abcd";
    .....
}

[Obfuscation(Feature = "strings", Exclude = false)] // here i want enabled
method2
{
    .....
    string local2 = "abcd";
    .....
}

In this case, since VMP does consider only 1 "abcd" (reused whereelse in code is needed), it could be the string encryption will result enabled or disabled for both methods, it just depends on the VMP parsing order, when i used a different namespace i just made the VMP parsin sequence different, resulting in string encr enabled for both (20secs) instead of disabled for both (0.5s).

Could you do something to avoid this? I would like to decide which string gets virtualized and which not, regardless the "same content".

BTW: v3.8.8 takes 8s for the virtualized string loop, v3.9.0 takes 20s (ok i should optimize the loop, i'm just telling the speed difference)

[Admin]

Could you do something to avoid this? I would like to decide which string gets virtualized and which not, regardless the "same content".

"abcd" in both methods is unique string instead of several one as you think. Anyway, you can change obfuscation type from "Virtualization" to "Mutation" for all useless strings and they will decrypt very fast:

Code: Select all

			byte[] array = new byte[30];
			array[3] = 58;
			array[0] = 104;
			array[4] = 109;
			array[5] = 109;
			array[10] = 92;
			array[12] = 102;
			array[8] = 115;
			array[2] = 92;
			array[9] = 115;
			array[11] = 46;
			array[14] = 102;
			array[7] = 58;
			array[13] = 102;
			array[1] = 104;
			array[6] = 92;
			sb.Append(ts.ToString(Encoding.UTF8.GetString(array)));

[AusterX]

"abcd" in both methods is unique string instead of several one as you think

ah ok got it, it's a dotnet compiler thing, i'll use the manually shuffled array in case, thank you.
v2193 is a bit speedy, thank you

[AusterX]

Hi again, tested 3.9.1.2196

I'm getting mad in finding what is slowin down drastically my application since v3.8.9 (every release it gets more and more slow), still i've not found the exact point, anyway when i was experimenting with enums, i saw 3.9.1.2196 produces slow code randomly (at least with mutation), i mean, the verysame method with obf mutation, i compile with VMP and takes 30ms, then i compile again (but same dll, just another VMP compilation) and it takes 300ms.
Check attached code, follow the buttons: speed, speed2, speed3.
Compile it with VMP several times, you'll see some methods are now fast, the next compile are slow, randomly.
Thank you.

[Admin]

Please notice that obfuscated code ALWAYS works slowly than original one.

P.S. The topic is closed.