x86 Software Reverse-Engineering, Cracking, and Counter-Measures

CHAPTER 14Detection and Prevention

Application developers use various mechanisms to detect and protect against reversing and cracking. However, some of these methods are more effective than others. This chapter explores some of the most common techniques, their relative strengths and weaknesses, and how they can be defeated.

CRC

A cyclic redundancy check (CRC) is a mathematical calculation performed on the bytes of the data to be protected. The result is stored as the CRC, which is often appended to the data (i.e., data data data data data data CRC). To verify the data, recalculate and compare.

CRC algorithms have their advantages, including the following:

• Fast and compact
• Easy to accelerate with hardware
• Quick to calculate and compare
• Numerous options available (IEEE802.3, CRC-32, etc.)

In general, CRCs are great for detecting accidental errors or modification, such as transmission errors.

However, they are a poor defense against intentional errors or modifications. CRCs can be easily recalculated and updated by an adversary. For example, a simplistic CRC might add all of the bytes together and save the result. If a corruption were to occur in the file somewhere in the data, then the new sum would not match, and action could be taken. If the corruption occurred in the CRC portion of the file, then the sum would not match the corrupted CRC, and action could be taken. This is great for detecting if a bit got accidentally flipped while being downloaded, for example.

But because ...