-2

I am trying to make things harder for someone to reverse my code.

I think that implementing a shellcode following this article could work for my case.

How can I access (or share) global variables in the shellcode I am loading?

I assume you can pass variables as arguments.

Thanks

fred26
  • 319
  • 1
  • 11

1 Answers1

4

Writing a shellcode is often a task considerably more difficult than developing a piece of software. To me it seems your assumption about developing your program as a shellcode is incorrect and will create problems for you later on.

This kind of thing is often addressed using Packers and Crypters. There are several relatively simple ones (like UPX), while some are considered quite effective (Themida and ASPack). There are many more available packers to choose from, some are free and some are commercial.

If you are reluctant to use any of the available packers I believe researching that domain will prove more fruitful to your goal. Using a shellcode will more often require:

  1. Writing location independent code.
  2. creating your own DLL loading/locating and API resolving functionalities.
  3. writing or editing assembly directly.

And will however provide only little advantage over code compiled normally. For example, anti-debugging techniques (as mentioned in your comments) are not limited to "shellcode" and can just as easily be injected/written into C/C++ code. Moreover, most packers include anti-debugging tricks by default (or provide such configuration).

NirIzr
  • 11,765
  • 1
  • 37
  • 87
  • I just need to protect some key parts of my code. That's why I thought small shellcodes could be dynamically loaded, decrypted and executed – fred26 Jun 11 '17 at 12:06
  • This is quite simply bypassed without proper protection. One could just as easily breakpoint before shellcode execution and then read your secret parts, either code or data. You might also want to consider packing/protecting a shared object (DLL/SO) with the secret part. – NirIzr Jun 12 '17 at 15:22
  • The ideia is to also have the shellcode check if debugger is present and prevent debuggers from being attached as well. Other alternative is to code my own LoadLibrary, and load and encrypted piece of code ? – fred26 Jun 13 '17 at 20:34
  • @fred26 See my latest edit – NirIzr Jun 14 '17 at 14:15