NODE 263cf296looking for anti-tamper software
ecarp@netcom.com (Ed Carp)Thu, 12 Oct 95 22:06:55 PDT
I used to have this C source that I could embed in a program, and it
would tell me if the software had been tampered with at runtime. I've
lost/mislaid/whatever the source, and I was wondering if anyone had anything
that would do the same thing. As I recall, it calculated a simple CRC and
embedded it into the .EXE file (it was written for MS-DOS).
It doesn't need to be cryptographically secure - I just need to check to see
if the executable has been corrupted. I've leafed through alt.sources and
comp.sources.*.
Thanks in advance...
--
Ed Carp, N7EKG Ed.Carp@linux.org, ecarp@netcom.com
214/993-3935 voicemail/digital pager
Finger ecarp@netcom.com for PGP 2.5 public key an88744@anon.penet.fi
"Past the wounds of childhood, past the fallen dreams and the broken families,
through the hurt and the loss and the agony only the night ever hears, is a
waiting soul. Patient, permanent, abundant, it opens its infinite heart and
asks only one thing of you ... 'Remember who it is you really are.'"
-- "Losing Your Mind", Karen Alexander and Rick Boyes
NODE b4b733f7Re: looking for anti-tamper software
fc@all.net (Dr. Frederick B. Cohen)Fri, 13 Oct 95 04:03:17 PDT
>
> I used to have this C source that I could embed in a program, and it
> would tell me if the software had been tampered with at runtime. I've
> lost/mislaid/whatever the source, and I was wondering if anyone had anything
> that would do the same thing. As I recall, it calculated a simple CRC and
> embedded it into the .EXE file (it was written for MS-DOS).
>
> It doesn't need to be cryptographically secure - I just need to check to see
> if the executable has been corrupted. I've leafed through alt.sources and
> comp.sources.*.
You are aware that there is a generic attack against all such defenses -
aren't you? It has been published for 7+ years. For details see:
A Short Course on Computer Viruses - Wiley and Sons - 94
--
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236