Problem - Kevin Tafuro

if (!s.write) s.write = SPC_RESOLVE_SYM(lib, "write");
return s.write;
case fileop_seek:
if (!s.seek) s.seek = SPC_RESOLVE_SYM(lib, "seek");
return s.seek;
}
return 0;
}
The names of the libraries and functions should of course be stored as encrypted
strings (see Recipe 12.11) to provide the best possible obfuscation; additional unused
library and function names can be stored in plaintext to mislead the analyst.
See Also
Recipes 12.11, 13.2
12.4 Performing Bit and Byte Obfuscation
Problem
Small values such as bytes, shorts, and integers are difficult to disguise while undergoing
mathematical transformations. This makes the values or ranges of constants,
indexes, and counters easy to determine in compiled binary code.
Solution
The Obcode library by Pawel Krawczyk (http://echelon.pl/pubs/) provides an API for
obfuscating bit and byte values, even during the manipulation of those values. The
size of the variables are inflated eightfold, so that a byte variable takes 8 bytes and an
integer variable takes 32 bytes. The library provides for byte operations such as XOR,
AND, OR, and NOT, and operations for integers including ADD, XOR, copy, and
swap.
The Obcode library is still under development and thus is lacking in features; however,
even in its current state it provides an excellent means of obfuscating small values
in memory. Obfuscated values can be stored within data files or within the
program itself, provided that the same seed or key is passed to obcode_init( ) for
both the reading and the writing of the value.
Discussion
In the Obcode data types, each bit is represented by a byte. If the value of the byte is
even, the value of the encoded bit is 1; otherwise, the value of the bit is 0. An
Obcode byte is encoded as a series of 8 Obcode bits; likewise, an Obcode int is
664 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.