Hacker News Reader

Comment by misja111 | Hacker News Reader

Yes, there are many ways to do that.

When writing in a higher language such as e.g. C, you can use code obfuscators to make your C code extremely hard to read.

If you want to make decompiling even impossible, you could modify the machine code generated by the C compiler. Even slight moderations are already enough.

If you want to make it (virtually) impossible to even disassemble the machine code, you could encrypt your binary itself except for a small bootstrap that will unencrypt the remainder of the binary when it runs.

View on HN

> When writing in a higher language such as e.g. C, you can use code obfuscators to make your C code extremely hard to read.

Obfuscating C code shouldn't have any bearing on the decompilability of the output.

> If you want to make it (virtually) impossible to even disassemble the machine code, you could encrypt your binary itself except for a small bootstrap that will unencrypt the remainder of the binary when it runs.

Unencrypting the binary at startup is somewhat easy to hook into. It's harder to decrypt each individual function when that function is called and then re-encrypt it after the function ends. Bonus points if you re-encrypt after each `CALL`.

This is stuff which was available back in 2003 -- that's when I first used techniques.

There are obfuscators that also make decompilation difficult. See the "two approaches" section at https://www.star-force.com/products/starforce-obfuscator/

> Obfuscating C code shouldn't have any bearing on the decompilability of the output.

This is the entire point of obfuscation and it absolutely does affect how easy the code is to reverse engineer. If it didn’t, there wouldn’t be a market for obfuscators.

> This is stuff which was available back in 2003 -- that's when I first used techniques.

It was available already in the 1980's, so I learned at the time when I was manually disassembling computer games hoping to be able to crack them.

And the countermeasures for that: DEP or pause the program after decryption and inspect its memory.

Yeah true. But at least the virus binary might be able to get passed the heuristic checks of a virus scanner.

Reply on news.ycombinator.com