ysoserial.net VS MessagePack for C# (.NET, .NET Core, Unity, Xamarin)

Any unchecked deserialization is dangerous - as you can see in this repo the same attack works on Json.NET, since you can inject a payload that performs arbitrary remote code execution.

So if you have some type within your application that does something sensitive or disruptive in its constructor, an attacker can craft a stream of bytes that asks the application to create that type. From there, all kinds of crazy things can happen. Here's a privilege escalation exploit discovered in Docker for Windows that relied on BinaryFormatter. Digging into some things he mentioned I found an entire exploit suite for .NET serialization. Through very clever tricks, it creates types that, when deserialized, will execute commands. That's a big deal.

Given it's a binary serialization framework, it should not be too difficult, because the domain is well-explored and numerous libraries exist in C# which address same goals that Fury does.

More popular/newer examples are https://github.com/Cysharp/MemoryPack (which is similar to Fury with its own spec, C#-code first schema), https://github.com/MessagePack-CSharp/MessagePack-CSharp or even gRPC / Protobuf tooling https://github.com/grpc/grpc-dotnet

With Unity/IL2CPP stuff: For general-purpose serialization libraries like JSON, you sometimes need to provide hints to make sure types are included: https://github.com/jilleJr/Newtonsoft.Json-for-Unity/wiki/Fi...

For schema serialization on known types, there are codegen tools (i.e. moc for MessagePack): https://github.com/neuecc/MessagePack-CSharp

MessagePack is migrating to Rosalyn code generators, so basically invisible codegen. Cysharp's newer serialization library, MessagePack, already uses this: https://github.com/Cysharp/MemoryPack

Thanks, I'm sure I'll need it, though I do have my own platform with serialization set up already that I'm hoping I can port relatively easily (It's backended with MessagePack C# which is a lovely serializer for Unity.)

In the Road map of features #119 for MessagePack-CSharp, they checked the box for:

Try MessagePack for serialization. It will help to reduce the size of the message and the time of serialization.

I mentioned JSON, but there are many formats that are much more efficient. I can mention FlatBuffers, MessagePack and ProtoBuf. These are the ones I've used myself, and personally I'm most comfortable with MessagePack and ProtoBuf. I don't think the performance would be an issue if you had to choose between these three, it's mostly the API that is different.

Biblioteca Nuget para C#