Click here to Skip to main content
15,891,677 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I want to keep an important function encrypted in the exe and while running the program, decrypt it at run time from memory. After execution of the function, I will encrypt it back in the memory (so that memory dump can't be analyzed).

I am able to decrypt and encrypt it in memory successfully. But I am not sure, keeping a function as encrypted in an exe is possible or not. If possible, how can I do it? I am trying to find the function offset and encrypt the function body. Keeping a function body encrypted will corrupt the exe? Please help me with suggestions. Below given is the memory encryption/decryption code:


What I have tried:

<pre>void TestFunction()
{
	MessageBoxA(0, "This will be encrypted", "Test", 0);
}
void stubFunction()
{

}

static bool XORMemory(DWORD pStartAddr, int nLength)
{
	if (!pStartAddr || nLength <= 0)
		return false;

	unsigned char* p = (unsigned char*)(pStartAddr);
	p = p + 4;
	for (int i = 0; i < nLength; i++)
	{
		*p++ ^= 0x5A;
	}

	return true;
}
Posted
Updated 9-Dec-19 22:17pm
v3

 
Share this answer
 
Comments
PECoder 11-Dec-19 0:12am    
Thank you. The link you provided is having a lot of information about different helpful topics. It will definitely help me.
As of now, I found a solution that I have mentioned in the comment below.
CPallini 11-Dec-19 2:58am    
You are welcome.
I do not think that is possible since the actual code to be encrypted is generated by the compiler, and then needs to be modified by the linker. So you cannot encrypt it until it is part of the final exe. But at that point any modification to the content of the executable file could mean the loader cannot handle it. Maybe you need to rethink exactly what you are trying to achieve here.
 
Share this answer
 
Comments
PECoder 11-Dec-19 0:07am    
Thank you for the replay. I found a solution. I encrypted the function in PE and added a stub segment as PE entry point. It will decrypt the function while loading in memory and immediately encrypt it back. So the function will remain encrypted in memory.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900