Problem - Kevin Tafuro

Because library functions are loaded into a predictable range of memory, the upper
half of a library function’s address can be used as a runtime constant. In the previous
code, the second half of the logical AND operation always evaluates to true.
Most programs link to shared libraries using dynamic linking resolved by the program
loader, which creates references to the shared library functions at the point
where they are called. To make compiled code more difficult to understand, shared
library functions should be referenced as far away as possible from the calls to
them—if not replaced entirely with custom code. By explicitly loading a library with
functions like dlopen( ) on Unix or LoadLibrary( ) on Windows, you can refer only to
the function pointers where the function is called. The function pointers can be reused
during the course of execution so that different library functions are stored in
the same function pointer. Alternatively, a function can be used to return the function
pointer from a list or table of such pointers, thereby frustrating automatic analysis:
#ifdef WIN32
#include
#define SPC_C_RUNTIME "msvcrt.dll"
#define SPC_LIBRARY_TYPE_HMODULE
#define SPC_LOAD_LIBRARY(name) LoadLibrary((name))
#define SPC_RESOLVE_SYM(lib, name) GetProcAddress((lib), (name))
#else
#include
#define SPC_C_RUNTIME "libc.so"
#define SPC_LIBRARY_TYPE void *
#define SPC_LOAD_LIBRARY(name) dlopen((name), RTLD_LAZY);
#define SPC_RESOLVE_SYM(lib, name) dlsym((lib), (name))
#endif
enum file_op_enum {
fileop_open, fileop_close, fileop_read, fileop_write, fileop_seek
};
void *file_op(enum file_op_enum op) {
static SPC_LIBRARY_TYPE lib = 0;
static struct FILEOP {
void *open, *close, *read, *write, *seek;
} s = {0};
if (!lib) lib = SPC_LOAD_LIBRARY(SPC_C_RUNTIME);
switch (op) {
case fileop_open:
if (!s.open) s.open = SPC_RESOLVE_SYM(lib, "open");
return s.open;
case fileop_close:
if (!s.close) s.close = SPC_RESOLVE_SYM(lib, "close");
return s.close;
case fileop_read:
if (!s.read) s.read = SPC_RESOLVE_SYM(lib, "read");
return s.read;
case fileop_write:
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Obfuscating Code | 663