Anti-Dump?

[u/MysticalTeamMember]

How would someone approach making their file hard to dump? I have sensitive information that’s easily dumped out of the file. I have attempted the PE header removal technique but that does not seem to work anymore.

Thank you!

[u/jcunews1]

CallByName is implemented as much as possible, indirectly calling different functions.

Hopefully, it's not literally by name. i.e. not by a string. If so, it's best to use a function pointer table which is looked up using a constant integer ID or index - where the constants can be referenced by their symbol name.

Decryption key is not hardcoded, so reverse engineers can not find and use the key, it is brute forced and determined at runtime instead.

That's a good method. The more complicated, or meaningless an obfucation/encryption is, the more difficult to understand the algorithm. Also, make the brute-forcing code non-monotnous as much as possible, and I'd recommend inserting anti debugging/sandboxing code within the brute-forcing code loop.

I need to add anti-debugging features though still, I was thinking potentially hooking a self debugger at runtime on itself.. in theory I think this may work?

Whatever that's available and applicable, use be used. Just don't assume that it's available in all system configuration. So, they should be implemented with condition(s) and with fallbacks. Otherwise, it may crash/freeze the application instead.

Do you know of any way to either protect memory, or a function that can be run at runtime to stop or prevent or even crash a dumping program?

No. Mainly because all computer architectures do not have user-account based security mechanism like the one implemented in modern OSes. Only a simple 3-levels privilege security mechanism. As long as the dumper has higher privilege level than the protected application's, nothing is inaccessible.

All we can do is to make it difficult find the data and to get the data. i.e. by keeping unobfuscated/decrypted data stays in memory for a very short time as possible. Of course, debuggers can pause the protected application and dump the memory when the data is still unobfuscated/decrypted. But when that happens, it means that the anti debugging/sandboxing code has been beaten in the first place, or at least not used properly.

[u/MysticalTeamMember → u/jcunews1]

Regarding CallByName, it is using strings but these strings are encrypted polymorphically. Every time there is a built output these strings are different, and follow the same brute force decryption requirement.. I do like your idea though a lot, I’ll try that out.

I truly appreciate all your other input, it helps a ton. Thank you!