Re: Hiding strings in objects code
I assume you mean so that running "strings" on the binary will not lead you to anything, right? You can use an XOR with some weird value to hide the strings. Just make sure the value you use will, for example, set the high bit on the string bytes...
Its is a cheap, free way to hide strings. It is, by no means, secure.
When rtm used this technique in his worm I'm sure a lot of people, such as myself, spent the five minutes necessary to hack up a program that tries XORing the input with all 256 possible bytes. I had the program pipe the output of each try through strings and wc, to check whether any significant text was uncovered. Only 0x00 and the single now-forgotten value he used got hits - no second XOR value. Anyway the point is it's *really* by no means secure, and you can do much better with a few minutes thought. Set up a basic framework using a Makefile that takes a file of MNEMONIC "text string" and runs it through an encoding program to produce a .h file of static char* text[] = { ... #define MNEMONIC 17 "vb4hv7789sd", Then in your actual program you just call decode(text[MNEMONIC]); Given that simple framework you can experiment with lots of different encoding and decoding functions. --- Jef
Jef Poskanzer <jef@ee.lbl.gov> writes: When rtm used this technique in his worm I'm sure a lot of people, such as myself, spent the five minutes necessary to hack up a program that tries XORing the input with all 256 possible bytes. I had the program pipe the output of each try through strings and wc, to check whether any significant text was uncovered. Only 0x00 and the single now-forgotten value he used got hits - no second XOR value.
Yes, I did too -- it was 0x81. I think my message of worm passwords was the first to make it out, along with my Perl script to try out your own password file. Yes, Perl was already around. What method you use in your program depends on your model of your opponent. If it's somebody only mildly interested, flipping the bits is fine. For a slightly higher level of anxiety, you could use Vigenere-like stuff -- XORing with a short key (8 bytes at a time with long longs if you're in gcc, for example), or use a longer key and restart now and then (interrupted key). For the next higher level, you might use DES and hide the key in your data, making them disassemble it. Next step... make your code obscure. After that... hardware. You might want to study some virus code to see how they try to thwart disassemblers and debuggers. YMMV. Jim Gillogly Mersday, 30 Foreyule S.R. 1994, 02:06
participants (2)
-
Jef Poskanzer -
Jim Gillogly