0

I am attempting to write a packer / bootstrapper around an application binary.

I build my initial application, then encrypt it, and embed the bytes inside a second application with a function to decompress the bytes (along with other things). I want to now execute this decompressed data without saving it as a file and then launch it. How do I do this programatically in either C / C++ or rust? I am using tauri to build both the bootstraper and the original application.

I attempted to use goto via a void pointer to the heap of decompressed bytes, but this just causes a seg fault. As shown here.

Why am I doing this? It's an attempt to making reverse engineering more difficult. The application has a different variation compiled and sent to clients, hence doing this encryption can slow down reverse engineering and any cheats / hacks because they have access to the real binary only when its about to be used. This is for a remote examination application.

t348575
  • 674
  • 8
  • 19
  • I think this is completely out of the scope of the C++ language. I'm not sure the tag is appropriate. – François Andrieux Sep 21 '21 at 17:48
  • @FrançoisAndrieux I am looking for a solution in c++ or rust – t348575 Sep 21 '21 at 17:50
  • If you still insist on writing this yourself: you are likely running into https://en.wikipedia.org/wiki/Executable_space_protection – Greg Inozemtsev Sep 21 '21 at 17:57
  • 1
    Most likely, you need to make your decompressed code executable by calling the appropriate OS routines. On linux that would be mprotect, but I'm not sure what the right thing is on windows – Chris Dodd Sep 21 '21 at 18:00
  • @ChrisDodd: VirtualProtect? – ninjalj Sep 21 '21 at 18:05
  • @ChrisDodd using mprotect I managed to set the memory as executable, but because it was not created as a process, it would not have a stack, and all the jump offsets for functions would be different right? Where in the executable bytes should I point the PC to? – t348575 Sep 21 '21 at 18:30
  • You'll need to make sure that the code is correctly (dynamically) linked for the location in which you decrypt it. As long as it was compiled as PIC (position independent code), that should be fairly easy. You would use the current process stack; basically just treating your decrypted code as if it was a (dynamic) library you were calling. Most commonly, you would use a call (via a function pointer in C) rather than a jump. – Chris Dodd Sep 21 '21 at 18:52
  • @ChrisDodd could you answer the question with example code? – t348575 Sep 22 '21 at 13:59

0 Answers0