Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


ASM/C - Checksum

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
Polynomial
Grandmaster Cheater
Reputation: 5

Joined: 17 Feb 2008
Posts: 524
Location: Inside the Intel CET shadow stack
PostPosted: Fri Mar 26, 2010 8:56 am    Post subject: ASM/C - Checksum Reply with quote
I'm attempting to build a checksum algorithm for my code that checks if anything has been modified.

I wrote a small algorithm in C (with inline ASM) that finds the offset of the Main function and copies it byte-by-byte until it hits a retn. It finds the first 4 bytes with no problem, but then throws an exception. I gave up on it and then accidently deleted my code when I was going through and removing crud from my source tree. Fail Sad

The other issue I have is that my comparison algorithm creates a snapshot of the main function at startup, then compares it periodically. Obviously this isn't ideal, since anyone can just screw with my snapshot generator or bypass it completely. What's the best way to create such a snapshot without doing it in the code?

I had an idea that I might store a string in the binary with a preset pattern (e.g. 0x12, 0x34, 0x56, 0x78, 0x12, 0x34, etc) and then create some external tool that analyses the Main function from the PE binary and overwrites the pattern with the appropriate value. No idea how I'd go about finding the Main function in-PE mind you... isn't it specified in the PE header somewhere?

Ugh, this is killing my head. Could somebody give me a hand here please?

Cheers ^_^
_________________
It's not fun unless every exploit mitigation is enabled.
Please do not reply to my posts with LLM-generated slop; I consider it to be an insult to my time.
Back to top
View user's profile Send private message
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Fri Mar 26, 2010 9:05 am    Post subject: Reply with quote
Why only the main function. You could just do a check on the complete code section as well.
Write an external tool that will calculate do your algorithm and get the checksum from the code section and store that somewhere in the data section where the comparison code can find it. (You can use that preset pattern idea to find the place in the code section I guess)
Back to top
View user's profile Send private message
Polynomial
Grandmaster Cheater
Reputation: 5

Joined: 17 Feb 2008
Posts: 524
Location: Inside the Intel CET shadow stack
PostPosted: Fri Mar 26, 2010 10:30 am    Post subject: Reply with quote
Well I was just using main as a starting point really. The issue is that I can't work out how to calculate the checksum at runtime properly. I had it working (sort of) before, but it crashed randomly. What's the best way to do it?

Here's an example I just wrote in Notepad (without checking!) of how my

Code:

int storedChecksum = '0xC712C734'; // checksum would be written to by external tool
void check()
{
   int mainPtr = &main;
        int checksumValue = 0;
   __asm {
      // save registers and reset them
      push eax;
      push ebx;
      push ecx;
      push edx;
      xor eax, eax;
      xor ebx, ebx;
      xor ecx, ecx;
      xor edx, edx;
      push 0x00000000; // initial checksum, will probably replace with something random
      mov ecx, mainPtr;
   loopBegin:
      mov eax, [ecx]; // edx contains 4 bytes of code
      pop ebx; // pop checksum out
      xor ebx, eax; // compute checksum
      push ebx; // push checksum in
      mov edx, ebx; // check first byte of code for retn
      and edx, 0xff;
      cmp edx, 0x%% // replace %% with whatever 'retn' is in hex
      je endLoop;
      mov edx, ebx; // check second byte of code
      and edx, 0xff00;
      cmp edx, 0x%%00;
      je endLoop;
      mov edx, ebx; // check third byte of code
      and edx, 0xff0000;
      cmp edx, 0x%%0000;
      je endLoop;
      mov edx, ebx; // check final byte of code
      and edx, 0xff000000;
      cmp edx, 0x%%000000;
      je endLoop;
      add ecx, 4; // increment code pointer by 4
      jmp loopBegin;
   loopEnd:
      pop eax; // pop checksum out
      mov checksumValue, eax;
      pop edx;
      pop ecx;
      pop ebx;
      pop eax;
   }
   if(checksumValue != storedChecksum)
   {
      printf("Checksum invalid!");
      ExitProcess(0);
   }
}
void main()
{
   // some code here
   check();
}


There's probably errors in this, it's just to show a rough idea of how I did it. Is there a better way to do this?
_________________
It's not fun unless every exploit mitigation is enabled.
Please do not reply to my posts with LLM-generated slop; I consider it to be an insult to my time.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 474

Joined: 09 May 2003
Posts: 25962
Location: The netherlands
PostPosted: Fri Mar 26, 2010 11:12 am    Post subject: Reply with quote
you could probably do it in C easier than in assembler

Also, I recommend getting the .code base and size from the PE header and do a check on that

anyhow, just out of my head, so might be wrong:
Code:

unsigned char *code=&main;
unsigned int checksum=0;

for (i=0; i<mainsize-3; i++)
  checksum=*(unsigned int *)(&code[i]) ^ checksum;


_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Polynomial
Grandmaster Cheater
Reputation: 5

Joined: 17 Feb 2008
Posts: 524
Location: Inside the Intel CET shadow stack
PostPosted: Fri Mar 26, 2010 11:34 am    Post subject: Reply with quote
Wow, that's a lot simpler. I'll give it a go later, I'm at my gf's right now.

Oh, while I'm here, do you know how to tell the make tool in the WDK not treat warnings as errors, or at least not treat indirection warnings as errors. It's currently stopping me from getting the address of procedures in memory in my kernel-mode code.
_________________
It's not fun unless every exploit mitigation is enabled.
Please do not reply to my posts with LLM-generated slop; I consider it to be an insult to my time.
Back to top
View user's profile Send private message
Cpt.Slow
Cheater
Reputation: 0

Joined: 02 Dec 2009
Posts: 28
PostPosted: Sun Mar 28, 2010 4:03 pm    Post subject: Reply with quote
Burningmace wrote:
Wow, that's a lot simpler. I'll give it a go later, I'm at my gf's right now.

Oh, while I'm here, do you know how to tell the make tool in the WDK not treat warnings as errors, or at least not treat indirection warnings as errors. It's currently stopping me from getting the address of procedures in memory in my kernel-mode code.


I'm sure there's a "#pragma warning()" or something along the lines of that.
_________________
Now let's cause some fucking havoc.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 474

Joined: 09 May 2003
Posts: 25962
Location: The netherlands
PostPosted: Sun Mar 28, 2010 4:20 pm    Post subject: Reply with quote
I usually just typecast to show the compiler I'm sure about it

also, easy way to test (assuming you're in visual studio and have the paths setup properly), ctrl+f7 test compiles it for you so you can quickly see warnings
_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites