Problem - Kevin Tafuro

*/
printf("CRC is %08X\n", crc);
#else
if (crc != crc32_stored) {
printf("CRC32 %#08X does not match %#08X\n", crc, crc32_stored);
return 1;
}
printf("CRC32 %#08X is OK\n", crc);
#endif
return 0;
}
As mentioned in the comment just prior to the printf( ) call in main( ), you should
compile this program with TEST_BUILD defined, then execute it to obtain the CRC
value that needs to be replaced for crc32_stored in the binary. Then rebuild the program
with TEST_BUILD undefined, and modify the binary with the proper CRC value
from the first run.
It is tempting to generate a checksum of the entire program and use this to determine
whether any bytes have been changed; however, this causes a loss of granularity
for the checksum and can degrade performance. Instead, you should generate
multiple checksums for vital sections of code. These checksums can be encrypted,
and they can even be supplemented with checksums of trivial blocks of code to disguise
which portions of code are significant.
The check used in main( ) performs a simple comparison, if (crc != crc32_stored).
While this demonstrates the basic use of a checksum, use of a straight comparison
such as this is strongly discouraged. When disassembled, the call to crc32( ) and the
subsequent compare are immediately obvious:
804842b: ff 75 fc pushl -4(%ebp)
804842e: ff 75 f8 pushl -8(%ebp)
8048431: e8 f2 fe ff ff call 8048328 ;call crc32( )
8048436: 83 c4 10 add $0x10,%esp
8048439: 89 45 f4 mov %eax,-12(%ebp)
804843c: 8b 45 f4 mov -12(%ebp),%eax
804843f: 3b 05 d0 83 04 08 cmp 0x80483d0,%eax ;compare result
8048445: 74 22 je 8048469 ;jump-if-equal
An attacker simply has to change the je instruction (opcode 0x74) at offset 8048445
to a jmp instruction (opcode 0xEB) to defeat this protection. The generated checksum
should never be checked against a valid one; instead, the generated checksum should
be used as a source of information that the program requires to execute properly. A
byte within the checksum could be used as an index into a jump table, for example,
or the checksum itself could be used as a key to decrypt critical code or data.
The next program demonstrates how to use a table of function pointers to test the
value of a checksum. Each nibble or half-byte in the checksum is used as an index
into a 16-entry table of function pointers; only the correct table entry calls the function
to check the next nibble. This method requires 8 tables of 16 function pointers
so that one table is used for each nibble in the checksum.
656 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.