Problem - Kevin Tafuro

Discussion
The techniques for hiding strings presented in this recipe are intended
to prevent their discovery from casual analysis, and should not be considered
a secure way of hiding strings. In cases where a string must be
hidden securely, you should treat the string as if it were a password,
and use a strong encryption method.
The purpose of obfuscating data is to mislead the observer in such a way that he may
not even realize that the obfuscation has taken place. Calling an encryption routine is
a more secure way to hide data, but it defeats the purpose of obfuscation as it makes
obvious the fact that the data is both encrypted and important.
An example of dynamically generating strings from a collection of substrings is presented
below. In the example, the string “/etc/passwd” is created on the fly. A quick
scan of the compiled version of the code will not reveal the string because the characters
that compose it are stored out of order as separate strings. Routines like this one
can be generated automatically by Perl or shell scripts as a separate C source code
file, then linked in with rest of the program’s object files.
#include
#include
char *get_filename(int n, char *buf, int buf_len) {
int x;
char *p;
buf[0] = 0;
p = &((char *)&n)[0];
for (x = 0; x < 4; x++, p++) {
switch (*p) {
case 1:
strncat(buf, "swd", buf_len - strlen(buf));
break;
case 2:
strncat( buf, "no", buf_len - strlen(buf));
break;
case 3:
strncat( buf, "/e", buf_len - strlen(buf));
break;
case 4:
strncat( buf, "as", buf_len - strlen(buf));
break;
case 5:
strncat( buf, "us", buf_len - strlen(buf));
break;
case 6:
strncat( buf, "tc/p", buf_len - strlen(buf));
break;
case 7:
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Hiding Strings | 679