Home/ Questions/Q 9127461
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T07:17:15+00:00

I am writing a program which encrypt/decrypts itself in memory and then writes the

  • 0

I am writing a program which encrypt/decrypts itself in memory and then writes the .text memory region to a copy of the executable so I can change the encryption key each time.

This is mainly for a challenge as I am not great with C, and I’m incorporating parts in assembly as well.

My system is x86_64 Linux but I’m compiling with -m32

I am also using -nostartfiles (with gcc) so that I can write my own _start function. This function is written in assembly and this decrypts/encrypts the rest of the .text section. My problem is that the external functions are being compiled in the wrong order, such that when I try to dump the memory after it has been encrypted it calls an encrypted function which therefore doesn’t work.

This is the current order of the functions:

  • some from -static
  • my functions which are in the correct order (assembly functions and then the ones from the main C file)
  • some more from -static

This doesn’t work becuase the assembly encrypts from the main C file ‘downwards’, also encrypting some -static functions which are needed from the assembly functions.

This is the order I would like the functions to be in:

  • all -static functions & anything from an #include <>
  • functions from the .S assembly file (the whole .S in order)
  • functions from the .c main file (the whole .c in order)
  • any non-standard includes for the .c main file (ie not stdio.h etc, things from #include “”)

Is there any way, short of manually mangling the ELF file, for me to reorder these functions so that the functions I need are not encrypted while the ones I want encrypted can be easily?

edit upon compiling with the musl (alternative libc) I can get all of my functions at the start, and the rest of the static functions following. However, This is the wrong way around still.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The “wrong” order of functions inside the binary comes from optimization efforts of the compiler. Functions that are used often (or often together) are near each other, so that no pagefault is generated by calling them.

    You can turn off part of these optimizations with the flag -fno-toplevel-reorder. You can also use the attribute section to order only a subset of functions together (eg to encrypt them) or you can write your own linker scripts.

    See also this question.

    • 0