21.03.2013 Views

Problem - Kevin Tafuro

Problem - Kevin Tafuro

Problem - Kevin Tafuro

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

int bogus_routine(void) {<br />

int x, y;<br />

for (x = 0; x < y; x++) {<br />

y = x + 256;<br />

y /= 32;<br />

x = y * 2 / 24;<br />

}<br />

return 1;<br />

}<br />

SPC_SMC_END_KEY(test)<br />

int main(int argc, char *argv[ ]) {<br />

spc_smc_decrypt(SPC_SMC_BLOCK_ADDR(test), SPC_SMC_BLOCK_LEN(test),<br />

SPC_SMC_KEY_ADDR(test), SPC_SMC_KEY_LEN(test));<br />

#ifdef UNENCRYPTED_BUILD<br />

/* This printf( ) displays the parameters to pass to the smc_encrypt utility on<br />

* stdout. The printf( ) must be removed, and the program recompiled before<br />

* running smc_encrypt. Having the printf( ) at the end of the file prevents<br />

* the offsets from changing after recompilation.<br />

*/<br />

printf("(offsets from _start)offset: 0x%X len 0x%X key 0x%X len 0x%X\n",<br />

SPC_SMC_OFFSET(SPC_SMC_BLOCK_ADDR(test)), SPC_SMC_BLOCK_LEN(test),<br />

SPC_SMC_OFFSET(SPC_SMC_KEY_ADDR(test)), SPC_SMC_KEY_LEN(test));<br />

exit(0);<br />

#endif<br />

test_routine( );<br />

return 0;<br />

}<br />

As mentioned in the comment just prior to the printf( ) call in main( ), this program<br />

should be compiled with UNENCRYPTED_BUILD defined, then executed to obtain the<br />

parameters to the smc_encrypt utility:<br />

/bin/sh>cc -I. smc.c smc_test.c -D UNENCRYPTED_BUILD<br />

/bin/sh>./a.out<br />

(offsets from _start)offset: 0xB0 len 0x36 key 0xEB len 0x66<br />

The program is then recompiled, with UNENCRYPTED_BUILD not defined in order to<br />

remove the printf( ) and exit( ) statements. The smc_encrypt utility is then run on<br />

the resulting binary to produce a working program:<br />

/bin/sh>cc -I. smc.c smc_test.c<br />

/bin/sh>smc_encrypt a.out 0xB0 0x36 0xEB 0x66<br />

Self-modifying code is one of the most potent techniques available for protecting<br />

binary code; however, it makes the build process more complex, as you can see in<br />

the above example. In addition, some processor architectures (such as the x86 line<br />

before the Pentium II) cache instructions and do not invalidate this cache when the<br />

code segment is written to. To be compatible with these older architectures, you will<br />

698 | Chapter 12: Anti-Tampering<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!