从逆向工程保护的可执行文件？ [英] Protecting executable from reverse engineering?

问题描述

我一直在盘算着如何保护我的C / C ++ code从拆卸和反向工程。通常我绝不会纵容这种行为自己在我的code;然而，当前协议我已经工作绝不能永远进行检查或理解的，因为不同的人的安全。

I've been contemplating how to protect my C/C++ code from disassembly and reverse engineering. Normally I would never condone this behavior myself in my code; however the current protocol I've been working on must not ever be inspected or understandable, for the security of various people.

现在，这是一个新的课题对我来说，和互联网是不适合的对逆向工程prevention真是足智多谋的，而是描绘了大量信息的如何进行逆向工程

Now this is a new subject to me, and the internet is not really resourceful for prevention against reverse engineering but rather depicts tons of information on how to reverse engineer

一些我认为到目前为止，事情是：

Some of the things I've thought of so far are:

• code注射液（之前和之后的实际函数调用调用虚函数）


• code obfustication（轧液的二进制文件的拆卸）



• 写我自己的启动程序（更难调试器绑定到）

• Code injection (calling dummy functions before and after actual function calls)
• Code obfustication (mangles the disassembly of the binary)

• Write my own startup routines (harder for debuggers to bind to)

void startup();  
int _start()   
{  
    startup( );  
    exit   (0)   
}  
void startup()  
{  
    /* code here */  
}

有关调试运行时检查（如果检测出力）

Runtime check for debuggers (and force exit if detected)

功能蹦床

 void trampoline(void (*fnptr)(), bool ping = false)  
 {  
   if(ping)  
     fnptr();  
   else  
     trampoline(fnptr, true);  
 }

毫无意义的分配和释放（堆栈变化很大）

Pointless allocations and deallocations (stack changes a lot)

我的意思是，这些都是一些我想过的东西，但他们都可以围绕工作，或给予合适的时间框架code分析师想通了。是否还有其他替代我？

I mean these are some of the things I've thought of but they can all be worked around and or figured out by code analysts given the right time frame. Is there anything else alternative I have?

推荐答案

琥珀说的是完全正确的。您可以逆向工程困难，但你永远无法prevent它。你应该永远不要相信安全，它依赖于逆向工程的prevention。

What Amber said is exactly right. You can make reverse engineering harder, but you can never prevent it. You should never trust "security" that relies on the prevention of reverse engineering.

这是说，我见过的最好的反逆向工程技术，不是集中在混淆的code，但反而打破了人们通常用它来了解code ++工程的工具。寻找创造性的方式来打破反汇编器，调试器等既可能比可怕的面条code仅产生里姆斯更有效，也更理智的满足。这无助于阻止的攻击者，但它确实增加了，歼随机饼干会走神，对一些比较容易的工作，而不是可能性。

That said, the best anti-reverse-engineering techniques that I've seen focused not on obfuscating the code, but instead on breaking the tools that people usually use to understand how code works. Finding creative ways to break disassemblers, debuggers, etc is both likely to be more effective and also more intellectually satisfying than just generating reams of horrible spaghetti code. This does nothing to block a determined attacker, but it does increase the likelihood that J Random Cracker will wander off and work on something easier instead.

这篇关于从逆向工程保护的可执行文件？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！