Basic tampering protection

668 views Asked by At

I'm trying to create a basic program that has tampering protection on the licenseCheck function, however it always says it's correct, even if I nop the whole licenseCheck function in Ollydbg or change and rebuild the code.

I'm following the Surreptitious Software book, and wrote the following program:

#include "stdafx.h"

#define HASH 5131241 

void BEGIN() {}

const std::string correctlicense("ABC");

bool licenseCheck() {

    std::cout << "Enter license: ";

    std::string license;
    std::cin >> license;

    volatile DWORD d;

    // Fingerprint
    __asm {
        lea ebx, d
        mov ebx, 0x050b072b
    }

    return license.compare(correctlicense) == 0;
}

UINT hash(UINT *beginAddress, UINT *endAddress) {

    UINT h = *beginAddress;

    for (; beginAddress <= endAddress; beginAddress++) {
        h ^= *beginAddress;
    }

    return h;
}
void END() {}


int main()
{

    UINT uHash = hash((UINT*)BEGIN, (UINT*)END);

    std::cout << "[Protection checks]" << std::endl;
    std::cout << "Tampering: ";

    if (uHash != HASH) {
        std::cout << "Tampering detected! ( " << uHash << " )" << std::endl;
        system("PAUSE");
        return 0;
    }
    else {
        std::cout << "Correct" << std::endl;
    }

    if (licenseCheck()) {
        std::cout << "Correct!" << std::endl;
    }
    else {
        std::cout << "Failed!" << std::endl;
    }


    system("PAUSE");
    return 0;
}

The program basically 'hashes' the code between the BEGIN function and END function, but it doesn't seem to work. The hash is always correct even after tampering.

I'm using Windows 7 and Visual studio 2017 the build/run the program.

0

There are 0 answers