Protections
Method parameter protection
Scramble how arguments are passed between methods.
Setting: protection.methodparameter. Reorders and re-encodes the parameters methods take, and rewrites every call site to match. The method signature in the output no longer lines up with how it reads in your source, which makes it much harder to trace how data flows from one method call to the next.
Key handling
Setting: native.methodParameterKeyMode. Controls how the keys behind this protection are kept at runtime.
| Mode | Trade-off |
|---|---|
VM_EPHEMERAL | Strongest, slowest — the key is worked out fresh on every single call. Needs native protection turned on. |
VM_CACHED | A middle ground — worked out once, then kept in memory for reuse. Needs native protection turned on. |
RUNTIME_RECONSTRUCT | Fastest, weakest — the key is pieced together from constants at runtime without native protection. |
Note
The two VM-based modes only apply if native protection is also turned on — see Native protection. If native protection is off, flowguard falls back to runtime reconstruction regardless of what you pick here.