I'm trying to create a basic program that has tampering protection on the licenseCheck function, however it always says it's correct, even if I nop the whole licenseCheck function in Ollydbg or change and rebuild the code.
I'm following the Surreptitious Software book, and wrote the following program:
#include "stdafx.h"
#define HASH 5131241
void BEGIN() {}
const std::string correctlicense("ABC");
bool licenseCheck() {
std::cout << "Enter license: ";
std::string license;
std::cin >> license;
volatile DWORD d;
// Fingerprint
__asm {
lea ebx, d
mov ebx, 0x050b072b
}
return license.compare(correctlicense) == 0;
}
UINT hash(UINT *beginAddress, UINT *endAddress) {
UINT h = *beginAddress;
for (; beginAddress <= endAddress; beginAddress++) {
h ^= *beginAddress;
}
return h;
}
void END() {}
int main()
{
UINT uHash = hash((UINT*)BEGIN, (UINT*)END);
std::cout << "[Protection checks]" << std::endl;
std::cout << "Tampering: ";
if (uHash != HASH) {
std::cout << "Tampering detected! ( " << uHash << " )" << std::endl;
system("PAUSE");
return 0;
}
else {
std::cout << "Correct" << std::endl;
}
if (licenseCheck()) {
std::cout << "Correct!" << std::endl;
}
else {
std::cout << "Failed!" << std::endl;
}
system("PAUSE");
return 0;
}
The program basically 'hashes' the code between the BEGIN function and END function, but it doesn't seem to work. The hash is always correct even after tampering.
I'm using Windows 7 and Visual studio 2017 the build/run the program.