Problem - Kevin Tafuro

When this program is compiled with TEST_BUILD defined, the resulting binary will
print the CRC32 computed for the function test_routine( ). If the computed CRC32
is 0xFFF7FB7C, the following table indices will represent valid function pointers:
b1[12], b2[7], b3[11], b4[15], b5[7], b6[15], b7[15], b8[15]. Each of these contains a
pointer to the function that will process the next nibble in the checksum, except for
b8[15], which contains a pointer to the function that is called when the checksum
has proven valid. The tables in the source can now be rewritten to reflect these correct
values:
crc_check_fn b1[16] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, crc_nib2, 0, 0, 0 },
b2[16] = { 0, 0, 0, 0, 0, 0, 0, crc_nib3, 0, 0, 0, 0, 0, 0, 0, 0 },
b3[16] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, crc_nib4, 0, 0, 0, 0 },
b4[16] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, crc_nib5 },
b5[16] = { 0, 0, 0, 0, 0, 0, 0, crc_nib6, 0, 0, 0, 0, 0, 0, 0, 0 },
b6[16] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, crc_nib7 },
b7[16] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, crc_nib8 },
b8[16] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, crc_good };
Obviously, the NULL bytes will have to be replaced with other values to disguise the
fact that they are invalid entries. They can be replaced with pointers to functions that
handle incorrect checksums, or they can be filled with garbage values to make the
program unstable. For example:
crc_check_fn b8[16] = { crc_good - 64, crc_good - 60, crc_good - 56, crc_good - 52,
crc_good - 48, crc_good - 44, crc_good - 40, crc_good - 36,
crc_good - 32, crc_good - 28, crc_good - 24, crc_good - 20,
crc_good - 16, crc_good - 12, crc_good - 8, crc_good - 4,
crc_good };
In this table, the use of incrementally increasing values causes the table to appear to
be valid data, as opposed to addresses in the code segment. Note that you can use
the techniques for disguising function pointers described in Recipe 12.9 so that
casual scans through the data segment do not reveal this to be a table of function
pointers.
See Also
Recipe 12.9
12.3 Obfuscating Code
Problem
Most C programs use common programming idioms based on C statements, default
data types, and function invocation/return conventions based on the C standard
library. Those familiar with C and how it is compiled to assembly language can easily
identify these idioms in compiled binary code.
658 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.