/*
This code was written and tested using Windows XP, SP2 running inside VirtualBox.
Visual C++ 6.0
*/
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
// Beginning of printfFunction
void printfFunction(char *szText){
printf("%s\n", szText);
}
// Marks the end of printfFunction
void printfFunctionStub(){}
void enc(DWORD dwAddress, DWORD dwSize){
__asm{
mov ecx,dwAddress
add ecx,dwSize
mov eax,dwAddress
C_loop:
xor byte ptr ds:[eax],0x5A
inc eax
cmp eax,ecx
jl C_loop;
}
}
int main(){
DWORD dwPrintFunctionSize = 0, dwOldProtect;
char *fA = NULL, *fB = NULL;
// Obtain the addresses for the functions so we can calculate size.
fA = (char *)&printfFunction;
fB = (char *)&printfFunctionStub;
// Get total function size
dwPrintFunctionSize = (fB - fA);
// Test the function
printfFunction("Hello A!\n");
// We need to give ourselves access to modifify data at the given address
VirtualProtect(fA, dwPrintFunctionSize, PAGE_READWRITE, &dwOldProtect);
enc(fA, dwPrintFunctionSize); // XOR encrypt the function
enc(fA, dwPrintFunctionSize); // XOR decrypt the function
// Restore the old protection
VirtualProtect(fA, dwPrintFunctionSize, dwOldProtect, NULL);
// Test the function
printfFunction("Hello C!\n");
return 0;
}
Comments
Post a Comment