String security of the hosting program

In the previous article String obfuscation in dotfuscatorAlgorithm It shows that the string is hosted Program The use of obfuscation tools only increases the complexity of static reverse analysis to a certain extent. However, at runtime, the fox's tail is not so easy to hide. So how can we deal with strings that are very important to information carriers to meet high security requirements?
You may have noticed that there is such a section in the final string restoration algorithm. Code : Return   String . Intern ( New   String (Data ));

what is it doing? What is its role?
the msdn explanation is as follows: string. the intern method
retrieves a reference from the system for a specified string .
return value
If the value of STR is reserved, the system reference is returned; otherwise, a new reference to a string with STR value is returned.
remarks
run in Common Language the database stores strings by maintaining a table, this table is called a detention pool and contains a reference to each unique string that is declared or created programmatically in the program. Therefore, there is only one instance of a string with a specific value in the system.
intern uses the detention pool to search for strings with the same STR value as the input string. If such a string exists, it is referenced in the detention pool. If this parameter does not exist, add a reference to the detention pool for the input string STR and return the reference.

Obviously, it means to search for CLR to see if there are any instances of this string and then return directly. If there is no such instance, create one. The most significant role is to reduce memory consumption, the downside is also obvious. Some performance consumption, and string transparency caused by string caching-here you should think of something: if a tool is available, you can view the current CLR memory. Because the string always exists, all the information is hidden. Msdn also mentioned this:Performance Considerations
To reduce the total memory allocated by the application, remember that the reserved string has two undesirable side effects. First, for reservedStringThere is a Common Language Runtime Library (CLR) in the object allocation, which is unlikely to be released before it is terminated. This is because CLR is reserved.StringObjects can be referenced after the application is terminated, or even after the application domain is terminated. Second, to retain strings, you must first create strings. Even ifStringThe memory used by the object will eventually be reclaimed by garbage collection, and the memory must still be allocated.

So how to improve the security of the string ?. Net Framework provides a solution:. NET Framework 2.0 introduces Enumeration members.NostringinterningThe member tags the Assembly as a string-free detention. Available Property willNostringinterningApplies to an assembly.

In this way, the CLR can no longer resident strings, although some memory resources are consumed, but it can greatly improve the security of the string-of course, when encoding, You need to note that the strings that are no longer needed should be put into the collection mechanism in time (scope or set variable reference to null ).