Problem - Kevin Tafuro

mprotect(buf, buf_len, PROT_READ | PROT_EXEC);
return(buf_len);
}
The use of mprotect( ), or an equivalent operating system routine for modifying the
permissions of a page of memory, is required on most modern operating systems to
write to the code segment. This is an inherent weakness of the self-modifying code
technique: the call to mprotect( ) is suspicious, and it is trivial to write a utility that
searches the disassembly of a program for calls to mprotect( ) that enable write
access or take an address in the code segment as the first parameter. The use of
mprotect( ) should be obfuscated (see Recipes 12.3 and 12.9).
Once the binary has been compiled, the protected code will have to be encrypted
before it can be executed. The following code demonstrates a utility for encrypting a
portion of an ELF executable file based on the contents of another portion of the file.
The usage is:
smc_encrypt filename code_offset code_len key_offset key_len
In the command, code_offset and code_len are the location in the file of the code to
be encrypted and the code’s length, and key_offset and key_len are the location in
the file of the key with which to encode the code and the key’s length.
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
/* ELF-specific stuff */
#define ELF_ENTRY_OFFSET 24 /* e_hdr e_entry field offset */
#define ELF_PHOFF_OFFSET 28 /* e_hdr e_phoff field offset */
#define ELF_PHESZ_OFFSET 42 /* e_hdr e_phentsize field offset */
#define ELF_PHNUM_OFFSET 44 /* e_hdr e_phnum field offset */
#define ELF_PH_OFFSET_OFF 4 /* p_hdr p_offset field offset */
#define ELF_PH_VADDR_OFF 8 /* p_hdr p_vaddr field offset */
#define ELF_PH_FILESZ_OFF 16 /* p_hdr p_size field offset */
static unsigned long elf_get_entry(unsigned char *buf) {
unsigned long entry, p_vaddr, p_filesz, p_offset;
unsigned int i, phoff;
unsigned short phnum, phsz;
unsigned char *phdr;
entry = *(unsigned long *) &buf[ELF_ENTRY_OFFSET];
phoff = *(unsigned int *) &buf[ELF_PHOFF_OFFSET];
phnum = *(unsigned short *) &buf[ELF_PHNUM_OFFSET];
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Using Self-Modifying Code | 695