decrypt function at run time and use it QT c++

Question

I'm new to QT and I'm trying to create an encrypted function. Overall what you do in C / C ++ is:

• Take pointer to function
• make the function page rwx
• Encrypt it (for the example I encrypt and decrypt in the same program)
• Decrypt it and run it

A simple code in C will happen roughly like this:

    void TestFunction()
{
    printf("\nmsgbox test encrypted func\n");
}
// use this as a end label
void FunctionStub() { return; }

void XorBlock(DWORD dwStartAddress, DWORD dwSize)
{
    char * addr = (char *)dwStartAddress;
    for (int i = 0; i< dwSize; i++)
    {
        addr[i] ^= 0xff;
    }
}

DWORD GetFuncSize(DWORD* Function, DWORD* StubFunction)
{
    DWORD dwFunctionSize = 0, dwOldProtect;
    DWORD *fnA = NULL, *fnB = NULL;

    fnA = (DWORD *)Function;
    fnB = (DWORD *)StubFunction;
    dwFunctionSize = (fnB - fnA);
    VirtualProtect(fnA, dwFunctionSize, PAGE_EXECUTE_READWRITE, &dwOldProtect); // make function page read write execute permission
    return dwFunctionSize;
}



int main()
{

    DWORD dwFuncSize = GetFuncSize((DWORD*)&TestFunction, (DWORD*)&FunctionStub);
    printf("use func");
    TestFunction();
    XorBlock((DWORD)&TestFunction, dwFuncSize); // XOR encrypt the function
    printf("after enc");
    //TestFunction(); // If you try to run the encrypted function you will get Access Violation Exception.

    XorBlock((DWORD)&TestFunction, dwFuncSize); // XOR decrypt the function
    printf("after\n");
    TestFunction(); // Fine here

    getchar();
}

When I try to run such an example in QT I get a run time error.

Here is the code in QT:

    void TestFunction()
{
    QMessageBox::information(0, "Test", "msgbox test encrypted func");
}
void FunctionStub() { return; }

void XorBlock(DWORD dwStartAddress, DWORD dwSize)
{
    char * addr = (char *)dwStartAddress;
    for (int i = 0; i< dwSize; i++)
    {
        addr[i] ^= 0xff;                // here i get seg. fault
    }
}

DWORD GetFuncSize(DWORD* Function, DWORD* StubFunction)
{
    DWORD dwFunctionSize = 0, dwOldProtect;
    DWORD *fnA = NULL, *fnB = NULL;

    fnA = (DWORD *)Function;
    fnB = (DWORD *)StubFunction;
    dwFunctionSize = (fnB - fnA);
    VirtualProtect(fnA, dwFunctionSize, PAGE_EXECUTE_READWRITE, &dwOldProtect); // Need to modify our privileges to the memory

    QMessageBox::information(0, "Test", "change func to read write execute ");
    return dwFunctionSize;
}




void check_enc_function()
{

    DWORD dwFuncSize = GetFuncSize((DWORD*)&TestFunction, (DWORD*)&FunctionStub);
    QMessageBox::information(0, "Test", "use func");
    TestFunction();
    XorBlock((DWORD)&TestFunction, dwFuncSize); // XOR encrypt the function -> @@@ i get seg fault in here @@@
    QMessageBox::information(0, "Test", "after enc");


    TestFunction(); // If you try to run the encrypted function you will get Access Violation Exception.

    XorBlock((DWORD)&TestFunction, dwFuncSize); // XOR decrypt the function
    QMessageBox::information(0, "Test", "after dec");
    TestFunction(); // Fine here

    getchar();
}

Why should this happen? QT is supposed to behave like precision as standard C ++ ...

post Scriptum.

Interestingly in the same matter, what is the most legitimate way to keep an important function encrypted (the reason it is encrypted is DRM)?

Legitimately I mean that anti-viruses will not mistakenly mark me as a virus because I defend myself.

PS2

If I pass an encrypted function over the network (say, I will build a server client schema that the client asks for the function it needs to run from the server and the server sends it to it if it is approved) How can I arrange the symbols so that the function does not collapse?

PS3

How in QT can I turn off the DEP and ASLR defenses? (In my opinion so that I can execute PS 2. I have to cancel them)

Thanks yoko

Answer 1

The example is undefined behaviour on my system.

The first and main issue in your code is:

void TestFunction() { /* ... */ }
void FunctionStub() { return; }

You assume that the compiler will put FunctionStub after TestFunction without any padding. I compiled your example and FunctionStub in my case was above TestFunction which resulted in a negative dwFunctionSize.

dwFunctionSize = (fnB - fnA);

TestFunction located at @ 0xa11d90
FunctionStub located at @ 0xa11b50
dwFunctionSize = -0x240

Also in XorBlock

addr[i] ^= 0xff;

Is doing nothing.

I assume you want to write in XorBlock to the memory location to XOR the entire TestFunction.

You could do something like this:

void XorBlock(DWORD dwStartAddress, DWORD dwSize)
{
    DWORD dwEndAddress = dwStartAddress + dwSize;
    for(DWORD i = dwStartAddress; i < dwEndAddress; i++) {
        // ...
    }
}

Answer 2

I can't see any Qt-specific in your example. Even if it's Qt function call it's just a call. So I guess you have undefined behaviour in both examples but only second one crashes.

I can't see any reason for compiler and linker to keep function order. For example GCC let you specify the code section for each function. So you can reorder it in executable without reordering in cpp.

I think you need some compiler specific things to make it work.