Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Finding the size of a function in C

Name: Anonymous 2010-09-05 17:39

Hi there. I have a licensing function that I am trying to protect (I'm working with Windows). Basically, I want to use self-modifying code.

I plan to encode all of the function's instructions until the ret, and I will replace the first byte of the function to 0xCC (int 3). When the function is called, my vectored exception handler will be triggered, and I will decode the entire function.

I've run into a small obstacle though. The byte for a ret, 0xC3, might occur before the function's end (for example, 0xC3 might be a byte in the opcode for a call).

Does anyone know a RELIABLE way of finding the size of a function?

Name: Anonymous 2010-09-06 1:19

>>14
Most are too dumb to do it, besides self-modifiying programs are very common on Windows, contrary to popular belief. You'd be surprised how common are packers and protections on this platform, as for the API calls that the application needs to make to perform its tasks, they're also pretty standard stuff (2 VirtualProtect calls if the code section is not writable). However, the reason I wouldn't ever use this trick is because it's very easy to defeat this trick, only novice crackers would have any trouble with it, and >>1 would be paying the price of portability (VEH is NT-only, compared to SEH which is present on all Windows OSes).

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List