Question

I’m getting error on second memcpy
memcpy(&check_user, &ZZZ, (int)&main – (int)&check_user);

“Unhandled exception at 0x72cc1f57 (msvcr100.dll) in 11.exe: 0xC0000005: Access violation writing location 0x00f31000.”

What is wrong?

#include <stdio.h>
#include <tchar.h>
#include <windows.h>
#include <stdio.h>
#include <iostream>

#define PASSWD "+++"
#define MAX_LEN 1023
#define MAX_CODE_SIZE (0x10 * 1024)
#define OFFSET_1 0x42
#define OFFSET_2 0x67

#define x_original_1 0xc01b0574
#define x_original_2 0x44681574
#define x_original_all 0x13D4C04B

#define x_crypt 0x66
using namespace std;

int check_user()
{
        char passwd[MAX_LEN];

        cout<< "enter password:";
        fgets(passwd, MAX_LEN, stdin);
        return ~strcmp(passwd, PASSWD);
}

int my_func()
{
        if (check_user())
        {
                cout<<"passwd ok\n";
        }
        else
        {
                cout<<"wrong passwd\n";
                exit(-1);
        }
        return 0;
}

int main()
{
        int a, b = 0;
        #pragma pack(1)
        union f
        {
                char buf[MAX_CODE_SIZE];
                struct
                {
                        int local_var_1;
                        int local_var_2;
                        char gag_1[OFFSET_1 - sizeof(int) * 2];
                        int x_val_1;
                        char gag_2[OFFSET_2 - OFFSET_1 - sizeof(int)];
                        int x_val_2;
                };
        };
  union f ZZZ;

     memcpy(&ZZZ, &check_user, (int)&main - (int)&check_user);

        for (a = 0; a < (int)&main - (int)&check_user; a++)
        {
                (*(char *) ((int)&ZZZ + a)) ^= x_crypt;
        }

     memcpy(&check_user, &ZZZ, (int)&main - (int)&check_user);

        for (a = 0; a < (int)&main - (int)&check_user; a++)
        {
                b += *(int *)((int)&check_user + a);
        }
        if (b != x_original_all)
        {
                fprintf(stderr, "-ERR: invalid CRC (%x)\n", b);
                return 0;
        }


        my_func();

}

Answer 1

OK. It’s weird, but I think I get it. You want some code to be “encrypted” via a XOR.

You’re going to have to do this in a memory buffer you allocate yourself that is read-write and also executable. On Windows you can achieve this with VirtualAlloc() . On Unix you can use mmap() with MAP_ANON. See the protection flags for either of these calls: again you want writable, executable memory.

Also, interacting directly with this via function pointers is kind of sketchy. I think you should write some code, compile/assemble it, apply some kind of cypher, and put in your obfuscated code as a sequence of bytes. Or something like that.

Did I mention this is a bad idea?