Problem - Kevin Tafuro

Solution
Detecting whether portions of a binary have been modified is essentially an errordetection
problem; therefore, a checksum algorithm such as CRC32, MD5, or SHA1
can be used to generate a signature for an arbitrary block of code or data. This signature
can then be checked at runtime to determine whether any modification has
taken place.
Discussion
We have chosen the CRC32 algorithm both for its ease of implementation
and for its speed. It is ideal for detecting changes to short
sequences of bytes; however, because there are only 2 32 possible
checksum values, and because it is not cryptographically secure, the
likelihood of a collision is high, giving the attacker a realistic chance to
replace code without changing the checksum. For this kind of application,
cryptographic strength is probably overkill, as there are easier
attacks than forcing a collision in the checksums (e.g., simply patch
the checksumming code).
The checksum API presented here is an implementation of CRC32, which consists of
macros for marking the start and end of the block to be checked, as well as a function
to calculate the checksum of the block. The function crc32_calc( ) is used to
compute the checksum of a buffer.
#define CRC_START_BLOCK(label) void label(void) { }
#define CRC_END_BLOCK(label) void _##label(void) { }
#define CRC_BLOCK_LEN(label) (int)_##label - (int)label
#define CRC_BLOCK_ADDR(label) (unsigned char *)label
static unsigned long crc32_table[256] = {0};
#define CRC_TABLE_LEN 256
#define CRC_POLY 0xEDB88320L
static int crc32(unsigned long a, unsigned long b) {
int idx, prev;
prev = (a >> 8) & 0x00FFFFFF;
idx = (a ^ b) & 0xFF;
return (prev ^ crc32_table[idx] ^ 0xFFFFFFFF);
}
static unsigned long crc32_table_init(void) {
int i, j;
unsigned long crc;
for (i = 0; i < CRC_TABLE_LEN; i++) {
crc = i;
654 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.