Article View: comp.lang.asm.x86
Article #80Re: Absolute addresses, relative addresses
From: Bob Masta
Date: Thu, 04 Sep 2003 14:01
Date: Thu, 04 Sep 2003 14:01
51 lines
4148 bytes
4148 bytes
On 3 Sep 2003 09:37:46 -0700, minso@altern.org (Eric Minso) wrote:
<snip>
>A few time ago, some software editors have claimed that the protection
>system is too easy to hack and asked to the company a better
>protection for their softwares.
>
>So I was asked to study a way to protect these executables.
>
What sort of protection is being used now?
I think this is an interesting problem. I don't know how the
typical "exe encryption" programs work, but I see two
general approaches:
1) Treat the final exe, including its PE header, as simple data.
A stub loader will decrypt it into memory and invoke some
Windows API function to run it as if from a file. (I assume
such function exists, but haven't checked.) This would put
the relocation burden on the API, but I would think it would
be vulnerable to crackers who would only have to watch
for that API function in their debugger, and grab the memory
image.
2) You could do the PE relocation as part of your
decryptor, and jump to the start address. The cracker
won't have an easy target for his debugger. But you
will have the whole burden of the relocation. You
may need special consideration of the fact that
Windows sees your loader/decryptor and the final exe
as one program, which it will load to 400000h like
normal programs. To simplify that, put your code
after the (encrypted) exe and change the PE start
point to your code, after saving the true start point
which you can jump to when ready. (Just like a virus!)
Yes, any scheme can be cracked with determination.
But some of us lock our cars and houses when we
leave them, betting on the crooks taking the path
of least resistance and looking for easier pickings
elsewhere.
Bob Masta
dqatechATdaqartaDOTcom
D A Q A R T A
Data AcQuisition And Real-Time Analysis
Shareware from Interstellar Research
www.daqarta.com
Technical Details
Message-ID:
<3f574278.3926611@news.itd.umich.edu>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mailReferences:
<7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com> <bigi38$36e$1@titan.btinternet.com> <7db38e60.0308270023.1d3f4cf@posting.google.com> <bij247$3j$1@titan.btinternet.com> <7db38e60.0308280508.6205dd69@posting.google.com> <bilu4t$g7n$1@titan.btinternet.com> <7db38e60.0308290140.1817fff2@posting.google.com> <fZi5b.138$qL6.113704@newsfep1-win.server.ntli.net> <7db38e60.0309030837.18c5f094@posting.google.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: feaef,44f17f79ebe31523 X-Google-Attributes: gidfeaef,public X-Google-Thread: f7d8d,44f17f79ebe31523 X-Google-Attributes: gidf7d8d,public X-Google-Thread: 1093da,44f17f79ebe31523 X-Google-Attributes: gid1093da,public X-Google-Thread: 114917,44f17f79ebe31523 X-Google-Attributes: gid114917,public X-Google-ArrivalTime: 2003-09-04 07:58:58 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail From: no_spam@aol.com (Bob Masta) Newsgroups: comp.lang.asm.x86,alt.lang.asm,alt.os.assembly,borland.public.tasm Subject: Re: Absolute addresses, relative addresses Approved: CLAX86 Moderators <ccrayne@crayne.org> Date: Thu, 04 Sep 2003 14:01:34 GMT Organization: Interstellar Research Message-ID: <3f574278.3926611@news.itd.umich.edu> X-CLAX86-Policy: http://www.pacificsites.com/~ccrayne/clax86.html X-CLAX86-Faq: http://www.faqs.org/faqs/by-newsgroup/comp/comp.lang.asm.x86.html X-CLAX86-Info-1: Send submissions to comp-lang-asm-x86@moderators.isc.org X-CLAX86-Info-2: Send technical complaints to ccrayne@crayne.org X-CLAX86-Info-3: Send complaints about policy to ccrayne@crayne.org X-Comment: moderators do not necessarily agree or disagree with this article. Reply-To: no_spam@aol.com References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com> <bigi38$36e$1@titan.btinternet.com> <7db38e60.0308270023.1d3f4cf@posting.google.com> <bij247$3j$1@titan.btinternet.com> <7db38e60.0308280508.6205dd69@posting.google.com> <bilu4t$g7n$1@titan.btinternet.com> <7db38e60.0308290140.1817fff2@posting.google.com> <fZi5b.138$qL6.113704@newsfep1-win.server.ntli.net> <7db38e60.0309030837.18c5f094@posting.google.com> X-Newsreader: Forte Free Agent 1.11/32.235 X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=-0.5, required 4, REFERENCES -0.50) X-UIDL: i:l!!mpm"!?EF"!2&X"! X-Complaints-To: abuse@supernews.com Lines: 52