Ensuring a function doesn't change.
Posted on 2002-06-19
I have a problem as follows. We have a piece of software that is written for an MSDos platform and has one VERY important function in it. We need to perform security checks on the executable file to ensure this function hasn't changed. I have already written code to allow me to isolate the function position within the actual exe file on the hard drive. This means I can open an exe file in hex mode search for the start and end of the function and export it to a file on its own. (I this managed with help from SteveGTR here in Experts Exchange)
The way I do this is by inserting assembly before and after the function and then searching for specific text in the exe file. An example of function marking is as follows:
#pragma optimize("", off)
// Begin tag
// Your code
#pragma optimize("", on)
The above ultimately allows me to search for the following hex codes in an executable:
If program was written using Microsoft Visual C++ 6:
EB 16 B0 2A B4 2A B0 2A B4 53 B0 54 B4 41 B0 52 B4 54 B0 2A B4 2A B0 2A
If program was written using Microsoft Visual C++ 1.52:
E9 16 00 B0 2A B4 2A B0 2A B4 53 B0 54 B4 41 B0 52 B4 54 B0 2A B4 2A B0 2A
You can search for these codes by opening an exe file in hex mode using Microsoft Visual C++ 6.
The next step we take is performing a CRC check on the file the function is exported to. This is all working fine apart from the following. If I change a piece of code OUTSIDE of my function, some of the codes BETWEEN the two mentioned markers will change (in the above sample the codes for the 'printf("Test test\n");' will change. As an example I composed the following two 'main' functions:
// VERSION 1
// VERSION 2
By using these two differences the codes between the assembly markers changed from:
68 B4 02 9A B2 06 00 00 83 C4 02
68 C8 02 9A B2 06 00 00 83 C4 02
This means that the CRC value now has changed!!! So if we change some other piece of code within the software that has NOTHING to do with this 'very important function', we have to issue a new CRC every time. This we cannot do for legal reasons. If we keep issuing new CRC's then we cannot say the function has DEFINITELY NOT changed...
My question is as follows:
Is there any way that you can say "THIS FUNCTION MUST BE COMPILED/LINKED INTO THE SAME CODES EVERY TIME"?
I hope my question is clear!
Any help is highly appreciated.