Calculate call instruction offset during dynamic decryption

207 views Asked by At

I have a C++ program with 2 labels. The code between these labels is encrypted in binary file (using 3rd party utils) and then decrypted in runtime. The code for decryption looks like following:

    int a = 0xBAD, b = 0xC0DE;
    std::cin >> a >> b;
    int c = static_cast<int>(pow(a, pow(b, b))) % static_cast<int>(pow(a, b));
    switch (c)
    {
    case 0:
        std::cout << "c = " << 0 << std::endl;
        break;
    case 1:
        std::cout << "c = " << 1 << std::endl;
        break;
    case 2:
        std::cout << "c = " << 2 << std::endl;
        break;
    case 3:
        std::cout << "c = " << 3 << std::endl;
        break;
    default:
        std::cout << "c = " << c << std::endl;
    }
_end:

Decryption process is following: I call VirtualAlloc to allocate a new memory buffer with PAGE_EXECUTE_READWRITE permissions. Then I copy the encrypted part to this buffer and decrypt it. And after that I just do a call of this buffer.

__asm
{
    lea eax, begin
    lea edx, _begin
    mov dword ptr[eax], edx
    lea eax, end
    lea edx, _end
    mov dword ptr[eax], edx
}
LPVOID ptr = VirtualAlloc(NULL, end - begin, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
memcpy(ptr, begin, end - begin);    
//decryption here
((void(*)(void))ptr)();

The problem is in that std::cin and std::cout calls have near call with relative offset which makes this offset absolutely incorrect in newly allocated memory block which I try to execute.

The question is how to calculate correct offset for decrypted code and use it there?

0

There are 0 answers