c++ - Checksum of a function in memory -


i making kind of anti-hack thing program, , want able create checksum of bytes of function see if has been modified. know how checksum, how how many bytes should checksum? there way size of function?

don't try. cannot assume function contiguous in memory: may have basicblocks lower start addresses entrypoint; may share trailing basicblocks other functions; may contain interspersed data or alignment bytes or may disappear entirely, depending on calling site (due compiler deciding inline function).

there no way code know size of generated function. think it: size entirely dependent on compiler emits , depends on kinds of compiler settings , flags (think optimizing, heavily inlined release build vs debug build or using enhanced instruction sets sse vs not using them).

also, indicated, such checksum check trivial work around hacker - branch have invert.

and lastly, exercise curious , because potential malicious hackers use too, i'd recommend locking @ binary via ida pro disassembler. make lot of problems intended anti-hack mitigation obvious...

if want continue down path i'd recommend anti reversing resources or running post processing step on code that
a) chains of functions inserting jumps connecting them never taken. hide branches behind opaque predicates. make disassembly hard read/understand , break disassemblers doing static flow analysis due resulting immense function size.
b) redirects function calls through single big branching function. have performance impact on code make callgraph unusable/unreadable.


Comments

Popular posts from this blog

asp.net - repeatedly call AddImageUrl(url) to assemble pdf document -

java - Android recognize cell phone with keyboard or not? -

iphone - How would you achieve a LED Scrolling effect? -