Random CRC on Application Launch

Started by
26 comments, last by implicit 14 years, 8 months ago
Quote:Original post by RogerThat123
But what are these random areas where you put random junk in?

Can you give me an example?
Well, you can put extra data at the end of an exectuable and it is just ignored, so the simplest solution would be to write 100 (or so) bytes of random data to the end of the executable. A naive CRC check would change everytime you change that last 100 bytes.

But that doesn't actually solve the problem, because a hacker will just perform the CRC check on everything but that last 100 bytes.

You can get more tricky with where in the executable you write your random stuff, but where ever you write it, it's basically the same for the hacker - just exclude that area when they do their CRC check.
Advertisement
Quote:Original post by Codeka
Quote:Original post by RogerThat123
But what are these random areas where you put random junk in?

Can you give me an example?
Well, you can put extra data at the end of an exectuable and it is just ignored, so the simplest solution would be to write 100 (or so) bytes of random data to the end of the executable. A naive CRC check would change everytime you change that last 100 bytes.

But that doesn't actually solve the problem, because a hacker will just perform the CRC check on everything but that last 100 bytes.

You can get more tricky with where in the executable you write your random stuff, but where ever you write it, it's basically the same for the hacker - just exclude that area when they do their CRC check.


Again what do you mean add random 100 bytes at the end. My application loads my DLL. My DLL is the file that needs to change the crc. SO, I can use my executable to do so because the executable does not matter to me.

But yes, what do you mean, random 100 bytes at the end. Thanks
Quote:Original post by RogerThat123
But yes, what do you mean, random 100 bytes at the end. Thanks
Maybe some pseudocode will explain better:

char buffer[100];for(int i = 0; i < 100; i++)  buffer = rand();HANDLE h = ::CreateFile("MyDll.dll", ...);::SetFilePointer(h, 0, 0, FILE_END);::WriteFile(h, buffer, 100, ...);::CloseHandle(h);

The extra data is ignored by the windows loader when it goes to load the DLL, and a naive CRC check on that file would then return a different value each time.
brbbbb

bacK:

char buffer[100];	for(int i = 0; i < 100; i++)	buffer = rand();	HANDLE h = ::CreateFile("Test.dll", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);	OVERLAPPED osWrite = {0};	DWORD dwWritten;	::SetFilePointer(h, 0, 0, FILE_END);	::WriteFile(h, buffer, 100, &dwWritten, &osWrite);	::CloseHandle(h);


I am doing like you say, but each time the CRC is still identical, even after writing the extra 100 bytes onto the end.
How is the CRC being calculated?
http://www34.brinkster.com/dizzyk/crc32.asp

Using that program there.

Is there an alternative way to what you showed me, and I am passing the correct values into writefile?
anyone else have an idea of another method?
maybe try using blocks of random variables (say a block consists of 10 ints) that are initialized randomly on load.

That could possibly change the CRC
--------------------------------------Not All Martyrs See Divinity, But At Least You Tried
Quote:Original post by godsenddeath
maybe try using blocks of random variables (say a block consists of 10 ints) that are initialized randomly on load.

That could possibly change the CRC


Do you mean just creating random variables inside the application itself such as

int random[10];for (i= 0; i < 10; i++)   random = rand()%100;


This will have no affect on the programs crc

I still cant believe what codeka suggested doesnt work.
Yes, there doesn't seem to be any reason why what you've posted would not work. I guess there must be something wrong somewhere, because I believe the method is sound. The only thing which springs to mind is that the "Test.dll" passed to CreateFile is different to the one that you're actually expecting.

In particular, note that LoadLibrary uses a different search algorithm for finding files than CreateFile uses (in particular, LoadLibrary looks in the same directory as the executable (and several other places) before it looks in the current working directory, whereas CreateFile only looks in the current working directory - unless you specify the full path). I suggest you try specifying the full path to the DLL in your call to CreateFile and see how that goes.

This topic is closed to new replies.

Advertisement