Re: Hiding strings in objects code

>I assume you mean so that running "strings" on the binary will not
>lead you to anything, right?  You can use an XOR with some weird value
>to hide the strings.  Just make sure the value you use will, for
>example, set the high bit on the string bytes...
>
>Its is a cheap, free way to hide strings.  It is, by no means, secure.

When rtm used this technique in his worm I'm sure a lot of people,
such as myself, spent the five minutes necessary to hack up a program
that tries XORing the input with all 256 possible bytes.  I had the
program pipe the output of each try through strings and wc, to check
whether any significant text was uncovered.  Only 0x00 and the single
now-forgotten value he used got hits - no second XOR value.

Anyway the point is it's *really* by no means secure, and you can do
much better with a few minutes thought.  Set up a basic framework
using a Makefile that takes a file of
    MNEMONIC	"text string"
and runs it through an encoding program to produce a .h file of
    static char* text[] = {
	...
    #define MNEMONIC 17
	"vb4hv7789sd",
Then in your actual program you just call decode(text[MNEMONIC]);
Given that simple framework you can experiment with lots of different
encoding and decoding functions.
---
Jef

> Jef Poskanzer <jef@ee.lbl.gov> writes:
> When rtm used this technique in his worm I'm sure a lot of people,
> such as myself, spent the five minutes necessary to hack up a program
> that tries XORing the input with all 256 possible bytes.  I had the
> program pipe the output of each try through strings and wc, to check
> whether any significant text was uncovered.  Only 0x00 and the single
> now-forgotten value he used got hits - no second XOR value.

Yes, I did too -- it was 0x81.  I think my message of worm passwords was
the first to make it out, along with my Perl script to try out your own
password file.  Yes, Perl was already around.

What method you use in your program depends on your model of your
opponent.  If it's somebody only mildly interested, flipping the bits is
fine.  For a slightly higher level of anxiety, you could use Vigenere-like
stuff -- XORing with a short key (8 bytes at a time with long longs if
you're in gcc, for example), or use a longer key and restart now and then
(interrupted key).  For the next higher level, you might use DES and hide
the key in your data, making them disassemble it.  Next step... make your
code obscure.  After that... hardware.

You might want to study some virus code to see how they try to thwart
disassemblers and debuggers.

YMMV.

	Jim Gillogly
	Mersday, 30 Foreyule S.R. 1994, 02:06