Hiding that string in the compiled code

[John Smith]

My program includes a use of strstr(). It looks like this:

if(strstr(*str1 , *str2)
...........

After compiling the code, I opened the program with a hex editor
(this is on Windows). Sure enough, I found str2 in the compiled code.

Is there a simple alternative (preferrably still using strstr) to
achieve the same objective without revealing str2 in the compiled
code?

[Jack Klein]

Re: Hiding that string in the compiled code

On Sat, 02 Jul 2005 02:58:11 GMT, John Smith <jsmith@company .com>
wrote in comp.lang.c:
[color=blue]
> My program includes a use of strstr(). It looks like this:
>
> if(strstr(*str1 , *str2)
> ..........
>
> After compiling the code, I opened the program with a hex editor
> (this is on Windows). Sure enough, I found str2 in the compiled code.
>
> Is there a simple alternative (preferrably still using strstr) to
> achieve the same objective without revealing str2 in the compiled
> code?[/color]

Sure, select any mechanism you like to encrypt str2. For a simple
example, xor each character treated as an unsigned char with a
constant value, for example 0x55.

Put the result in your program as an array of unsigned char. At run
time, decrypt it before using.

For "hello", in your source do:

#include <stdio.h>

#define CRYPT 0x55

unsigned char str2 [6] = { 'h' ^ CRYPT, 'e' ^ CRYPT,
'l' ^ CRYPT, 'l' ^ CRYPT, 'o' ^ CRYPT };

int main()
{
int count;
char *cp = (char *)str2;
printf("Before decryption: %s\n", cp);
for (count = 0; count < 5; ++count)
{
str2 [count] ^= CRYPT;
}
printf("After decryption: %s\n", cp);
return 0;
}

Output:
Before decryption: =099:
After decryption: hello

Feel free to use methods other than xor with a constant. Remember to
do your encryption and decryption on unsigned chars.

Be careful in general not to depend on C string functions while your
array is in the encrypted state, as one of the real characters in the
plain text might become '\0' when encrypted. In the example xor with
0x55, the ASCII character 'U' will become '\0' when encrypted.

--
Jack Klein
Home: http://JK-Technology.Com
FAQs for
comp.lang.c http://www.eskimo.com/~scs/C-faq/top.html
comp.lang.c++ http://www.parashift.com/c++-faq-lite/
alt.comp.lang.l earn.c-c++

http://www.contrib.andrew.cmu.edu/~ajo/docs/FAQ-acllc.html

[a.dheeraj.kumar@gmail.com]

Re: Hiding that string in the compiled code

or just upx your executable.

[Jack Klein]

Re: Hiding that string in the compiled code

On 1 Jul 2005 20:53:25 -0700, a.dheeraj.kumar @gmail.com wrote in
comp.lang.c:
[color=blue]
> or just upx your executable.[/color]

Can't find any mention of "upx" in the C standard, so it is quite
off-topic here.

--
Jack Klein
Home: http://JK-Technology.Com
FAQs for
comp.lang.c http://www.eskimo.com/~scs/C-faq/top.html
comp.lang.c++ http://www.parashift.com/c++-faq-lite/
alt.comp.lang.l earn.c-c++

http://www.contrib.andrew.cmu.edu/~ajo/docs/FAQ-acllc.html

[Default User]

Re: Hiding that string in the compiled code



Jack Klein wrote:[color=blue]
> On Sat, 02 Jul 2005 02:58:11 GMT, John Smith <jsmith@company .com>
> wrote in comp.lang.c:
>[color=green]
> > My program includes a use of strstr(). It looks like this:
> >
> > if(strstr(*str1 , *str2)
> > ..........
> >
> > After compiling the code, I opened the program with a hex editor
> > (this is on Windows). Sure enough, I found str2 in the compiled code.
> >
> > Is there a simple alternative (preferrably still using strstr) to
> > achieve the same objective without revealing str2 in the compiled
> > code?[/color]
>
> Sure, select any mechanism you like to encrypt str2. For a simple
> example, xor each character treated as an unsigned char with a
> constant value, for example 0x55.
>
> Put the result in your program as an array of unsigned char. At run
> time, decrypt it before using.[/color]


That's basically what I did for the string file for the text-adventure
game I wrote years back. To make it even more secure I used a "rolling
key" approach. There was an initial seed value for the xor crypt key,
which then incremented after each use. At startup, the game would load
all the text from the file, decrypt it, and store the resulting strings
in a table.




Brian