Serialization Tuning

Serialization can be defined as the process of storing the state of an object to a storage medium. There are two main kinds of serialization available in .NET:

This chapter covers the binary serialization.

Binary serialization is often used in application state persistence, offline caches and remoting communication. .NET platform has rich services that allow to perform binary serialization of objects within several lines of code. All serializable classes and structures are marked with [Serializable] (or <Serializable()> in VB.NET) custom attribute, so .NET runtime is aware about serialization-ability of every class and structure.

.NET serialization services use reflection to retrieve the data of the serializable objects. That means that obfuscator should take some precautions when it tries to obfuscate serializable elements. Eazfuscator.NET uses the safest approach by default — all serializable classes, structures and fields are automatically excluded from symbol renaming. This guarantees that obfuscation has the minimal impact on application functionality and interoperability. At the same time, this approach has one drawback — all serializable elements are too obviously visible during reverse engineering.

Sometimes absolute interoperability of binary serialization is not required for an application. It's a very common situation when application serializes and deserializes the objects by itself, so no other applications are meant to have an access to the serialized data. If latter is the case then it is possible to improve the obfuscation of serializable elements in your application by using self-interoperable serialization.

If serialized data do not leave the boundaries of the application process then non-stable binary serialization can be used instead of fully interoperable one. This kind of serialization is called non-stable because the names of serializable elements are changed on every obfuscation of the application. Technically, non-stable serialization is achieved by enabling the renaming of serializable elements, so they are not excluded from symbol renaming process anymore.

To enable non-stable self-interoperable serialization you should apply specially formed attribute to your assembly. In order to do that you can use the instructions below.

Stable serialization should be used when the serialized data can leave the boundaries of the application process. This kind of serialization is called stable because the names of serializable elements stay the same between the obfuscations of the application. Some obfuscator vendors use the term incremental obfuscation when they want to say that symbol names remain the same between several obfuscations. Technically, stable serialization is achieved by encrypting the names of serializable elements with a password. The encryption algorithm is the same as in symbol names encryption.

To enable stable self-interoperable serialization you should apply specially formed attribute to your assembly. In order to do that you can use the instructions below.

	Tip
	If you use symbol names encryption and want to use the same password for the stable serialization then apply "encrypt serializable symbol names with password" instead of "encrypt serializable symbol names with password 'XXXXXX'" token at the custom attribute shown above.