(11-06-2014, 05:53 PM)Bibl Wrote: whats the performance for this method, it would be slower i assume?
also is there a paper or something on this concept
It would certainly be slower, yes. That's often a price obfuscators are prepared to pay.
I can't remember off the top of my head where I first saw this described, however have a quick google. (eg).
http://www.zelix.com/klassmaster/docs/ob...#exception
http://journal.info.unlp.edu.ar/journal/...ul08-3.pdf (describes for msil, but the technique is obviously similar.)
For what it's worth - I don't actually test CFR against any obfuscated code due to potential legality issues - I test against my own implementations of concepts such as this, as well as other sorts of evil thoughts that pop into my head (i.e. putting completely inaccurate information in type table, marking every method as synthetic, etc.).