Problem - Kevin Tafuro

Discussion
For the code presented in this recipe, we’ll be using RC4 to perform our encryption.
We’ve chosen to use RC4 because it is fast and easy to implement. You will need to
use the RC4 implementation from Recipe 5.23 or an alternative implementation
from somewhere else to use the code we will be presenting.
The actual code to decrypt and replace the code in memory is minimal. The complexity
arises from having to obtain the code to be encrypted, encrypting it, and making
it accessible to the code that will be decrypting and executing it. A set of macros
provides the means to mark replaceable code, and a single function, spc_smc_
decrypt( ), performs the decryption of the code. Because we’re using RC4, encryption
and decryption are performed in exactly the same way, so spc_smc_decrypt( )
can also be used for encryption, which we’ll do later on.
#include
#include
#include
#include
#include
#define SPC_SMC_START_BLOCK(label) void label(void) { }
#define SPC_SMC_END_BLOCK(label) void _##label(void) { }
#define SPC_SMC_BLOCK_LEN(label) (int)_##label - (int)label
#define SPC_SMC_BLOCK_ADDR(label) (unsigned char *)label
#define SPC_SMC_START_KEY(label) void key_##label(void) { }
#define SPC_SMC_END_KEY(label) void _key_##label(void) { }
#define SPC_SMC_KEY_LEN(label) (int)_key_##label - (int)key_##label
#define SPC_SMC_KEY_ADDR(label) (unsigned char *)key_##label
#define SPC_SMC_OFFSET(label) (long)label - (long)_start
extern void _start(void);
/* returns number of bytes encoded */
int spc_smc_decrypt(unsigned char *buf, int buf_len, unsigned char *key, int key_len)
{
RC4_CTX ctx;
RC4_set_key(&ctx, key_len, key);
/* NOTE: most code segments have read-only permissions, and so must be modified
* to allow writing to the buffer
*/
if (mprotect(buf, buf_len, PROT_WRITE | PROT_READ | PROT_EXEC)) {
fprintf(stderr, "mprotect: %s\n", strerror(errno));
return(0);
}
/* decrypt the buffer */
RC4(&ctx, buf_len, buf, buf);
/* restore the original memory permissions */
694 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.