问题
I want to hide some strings in my .exe so people can't simply just open the .exe and look at all the strings there. I don't care about the strength of the encrypting method, so I will probably use XOR etc.
How can I do this at compile time? That way my strings won't be stored in the .exe but the encrypted versions would. Then, I would just use my decrypting function every time to display those strings on screen.
回答1:
you can encrypt it using macros or write your own preprocessor
#define CRYPT8(str) { CRYPT8_(str "\0\0\0\0\0\0\0\0") }
#define CRYPT8_(str) (str)[0] + 1, (str)[1] + 2, (str)[2] + 3, (str)[3] + 4, (str)[4] + 5, (str)[5] + 6, (str)[6] + 7, (str)[7] + 8, '\0'
// calling it
const char str[] = CRYPT8("ntdll");回答2:
I also thought this wasn't possible, even though it's very simple, people wrote solutions where you need a custom tool to scan the built file afterwards and scan for strings and encrypt the strings like that, which wasn't bad but I wanted a package that's compiled from Visual Studio, and it's possible now!
What you need is C++ 11 (Visual Studio 2015 Update 1 out of the box)
the magic happens with this new command constexpr
By magic happens in this #define
#define XorString( String ) ( CXorString<ConstructIndexList<sizeof( String ) - 1>::Result>( String ).decrypt() )
It won't decrypt the XorString at compile-time, only at run-time, but it will encrypt the string only in compile-time, so the strings will not appear in the Executable file
printf(XorString( "this string is hidden!" ));
It will print out "this string is hidden!" but you won't find it inside Executable file as strings!, check it yourself with Microsoft Sysinternals Strings program download link: https://technet.microsoft.com/en-us/sysinternals/strings.aspx
The full source code is quite large but could easily be included into one header file. But also quite random so the encrypted string outputs will always change every new compile, the seed is changed based on the time it took it compile, pretty much solid,perfect solution.
Create a file called XorString.h
#pragma once
//-------------------------------------------------------------//
// "Malware related compile-time hacks with C++11" by LeFF //
// You can use this code however you like, I just don't really //
// give a shit, but if you feel some respect for me, please //
// don't cut off this comment when copy-pasting... ;-) //
//-------------------------------------------------------------//
////////////////////////////////////////////////////////////////////
template <int X> struct EnsureCompileTime {
enum : int {
Value = X
};
};
////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////
//Use Compile-Time as seed
#define Seed ((__TIME__[7] - '0') * 1 + (__TIME__[6] - '0') * 10 + \
(__TIME__[4] - '0') * 60 + (__TIME__[3] - '0') * 600 + \
(__TIME__[1] - '0') * 3600 + (__TIME__[0] - '0') * 36000)
////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////
constexpr int LinearCongruentGenerator(int Rounds) {
return 1013904223 + 1664525 * ((Rounds> 0) ? LinearCongruentGenerator(Rounds - 1) : Seed & 0xFFFFFFFF);
}
#define Random() EnsureCompileTime<LinearCongruentGenerator(10)>::Value //10 Rounds
#define RandomNumber(Min, Max) (Min + (Random() % (Max - Min + 1)))
////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////
template <int... Pack> struct IndexList {};
////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////
template <typename IndexList, int Right> struct Append;
template <int... Left, int Right> struct Append<IndexList<Left...>, Right> {
typedef IndexList<Left..., Right> Result;
};
////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////
template <int N> struct ConstructIndexList {
typedef typename Append<typename ConstructIndexList<N - 1>::Result, N - 1>::Result Result;
};
template <> struct ConstructIndexList<0> {
typedef IndexList<> Result;
};
////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////
const char XORKEY = static_cast<char>(RandomNumber(0, 0xFF));
constexpr char EncryptCharacter(const char Character, int Index) {
return Character ^ (XORKEY + Index);
}
template <typename IndexList> class CXorString;
template <int... Index> class CXorString<IndexList<Index...> > {
private:
char Value[sizeof...(Index) + 1];
public:
constexpr CXorString(const char* const String)
: Value{ EncryptCharacter(String[Index], Index)... } {}
char* decrypt() {
for(int t = 0; t < sizeof...(Index); t++) {
Value[t] = Value[t] ^ (XORKEY + t);
}
Value[sizeof...(Index)] = '\0';
return Value;
}
char* get() {
return Value;
}
};
#define XorS(X, String) CXorString<ConstructIndexList<sizeof(String)-1>::Result> X(String)
#define XorString( String ) ( CXorString<ConstructIndexList<sizeof( String ) - 1>::Result>( String ).decrypt() )
////////////////////////////////////////////////////////////////////
回答3:
This probably doesn't apply to the ancient compiler of the question, but on more more modern C++ implementations, we can use a string literal operator template that's declared constexpr to implement compile-time obfuscation. For this, I've used GCC 7.2.0 with -std=c++17 (and a full set of warning options, of course).
Firstly, we define a type to hold our obfuscated string data, with a conversion operator to produce a plaintext string on demand:
#include <array>
#include <string>
template<typename Char>
static const Char SECRET = 0x01;
template<typename Char,
typename std::basic_string<Char>::size_type Length>
struct obfuscated_string
{
using String = std::basic_string<Char>;
const std::array<const Char, Length> storage;
operator String() const
{
String s{storage.data(), Length};
for (auto& c: s)
c ^= SECRET<Char>;
return s;
}
};
Now, the literal operator template to convert a source-code literal to an obfuscated string:
template<typename ctype, ctype...STR>
constexpr obfuscated_string<ctype, sizeof... (STR)> operator ""_hidden()
{
return { { (STR ^ SECRET<ctype>)... } };
}
To demonstrate:
#include <iostream>
int main()
{
static const auto message = "squeamish ossifrage"_hidden;
std::string plaintext = message;
std::cout << plaintext << std::endl;
}
We can inspect the object code with the strings program. The binary doesn't contain squeamish ossifrage anywhere; instead it has rptd`lhri!nrrhgs`fd. I've confirmed this with a range of optimisation levels to demonstrate that the conversion back to std::string doesn't get pre-computed, but I advise you conduct your own tests whenever you change compiler and/or settings.
(I'm deliberately ignoring whether this is an advisable thing to do - merely presenting a technical working solution).
回答4:
About the only way to do exactly what you suggest is to write a truly horrible macro. But here are some alternatives.
- Store the encrypted strings in a data file.
- Collect the strings in a single source file, then in the build, before actually compiling, go over it with a tool that will encrypt them (e.g. sed). You can automate this step.
- Use a powerful editor so that you can encrypt/decrypt the strings effortlessly, while you work.
回答5:
If you are only trying to hide the strings, then you could just try compressing your executable with something like UPX.
回答6:
You can't encrypt strings (string literals) by С++ compiler or preprocessor, but you can write a pre-build tool which will parse your source code, and encrypt strings.
Or, you can try to use boost::mpl::string.
回答7:
No matter the details of your solution it will involve encrypting the strings using some encryption program.
You might write a script to encrypt literals in your source code.
Or for a Windows exe you might encrypt literals in an [.rc] file, embedding the strings as a string table resource in the exe.
But probably the best solution is to not try any hiding.
When Microsoft tried the XOR hiding trick on the Windows code that arbitrarily warned about non-Microsoft DOS-es being unreliable and incompatible with this and that, it just backfired on them. Of course the idea of saying bad things about competitors and bundling that bad-saying with Windows was a Really Stupid Idea in the first place. But, trying to hide the code was what made it into a public embarrassment: nobody had really noticed the warnings the code produced, but when people discovered "encrypted" code, naturally their curiosity was engaged, they just had to find out what it was, and write articles about it.
Cheers & hth.,
回答8:
Any crypto that is done at compile time must also be undoable in the raw EXE (unless you're doing something Really Strange). And your app is running on their hardware. Doomed... barring DRM, which is (in my mind) Evil.
回答9:
Building on SSPoke's answer here is a slightly simpler and more robust solution. Tested with MSVC 2017 and gcc 7.3 https://godbolt.org/z/7fc3Zi
Changes:
- Fix integer overflow warning for long strings
- Fix/Make sure MSVC evaluate encrypt_character() at compile time even for very long strings (in the original version some strings would not get encrypted at compile time)
- Support for wide character strings
- Simpler code templates
#include <iostream>
// =============================================================================
namespace crypt {
// =============================================================================
// compile-time seed
#define XSTR_SEED ((__TIME__[7] - '0') * 1ull + (__TIME__[6] - '0') * 10ull + \
(__TIME__[4] - '0') * 60ull + (__TIME__[3] - '0') * 600ull + \
(__TIME__[1] - '0') * 3600ull + (__TIME__[0] - '0') * 36000ull)
// -----------------------------------------------------------------------------
// @return a pseudo random number clamped at 0xFFFFFFFF
constexpr unsigned long long linear_congruent_generator(unsigned rounds) {
return 1013904223ull + (1664525ull * ((rounds> 0) ? linear_congruent_generator(rounds - 1) : (XSTR_SEED) )) % 0xFFFFFFFF;
}
// -----------------------------------------------------------------------------
#define Random() linear_congruent_generator(10)
#define XSTR_RANDOM_NUMBER(Min, Max) (Min + (Random() % (Max - Min + 1)))
// -----------------------------------------------------------------------------
constexpr const unsigned long long XORKEY = XSTR_RANDOM_NUMBER(0, 0xFF);
// -----------------------------------------------------------------------------
template<typename Char >
constexpr Char encrypt_character(const Char character, int index) {
return character ^ (static_cast<Char>(XORKEY) + index);
}
// -----------------------------------------------------------------------------
template <unsigned size, typename Char>
class Xor_string {
public:
const unsigned _nb_chars = (size - 1);
Char _string[size];
// if every goes alright this constructor should be executed at compile time
inline constexpr Xor_string(const Char* string)
: _string{}
{
for(unsigned i = 0u; i < size; ++i)
_string[i] = encrypt_character<Char>(string[i], i);
}
// This is executed at runtime.
// HACK: although decrypt() is const we modify '_string' in place
const Char* decrypt() const
{
Char* string = const_cast<Char*>(_string);
for(unsigned t = 0; t < _nb_chars; t++) {
string[t] = string[t] ^ (static_cast<Char>(XORKEY) + t);
}
string[_nb_chars] = '\0';
return string;
}
};
}// END crypt NAMESPACE ========================================================
#define XorS(name, my_string) constexpr crypt::Xor_string<(sizeof(my_string)/sizeof(char)), char> name(my_string)
// Because of a limitation/bug in msvc 2017 we need to declare crypt::Xor_string() as a constexpr
// otherwise the constructor is not evaluated at compile time. The lambda function is here to allow this declaration inside the macro
// because there is no such thing as casting to 'constexpr' (and casting to const does not solve this bug).
#define XorString(my_string) []{ constexpr crypt::Xor_string<(sizeof(my_string)/sizeof(char)), char> expr(my_string); return expr; }().decrypt()
// Crypt normal string char*
#define _c( string ) XorString( string )
#define XorWS(name, my_string) constexpr crypt::Xor_string<(sizeof(my_string)/sizeof(wchar_t)), wchar_t> name(my_string)
#define XorWideString(my_string) []{ constexpr crypt::Xor_string<(sizeof(my_string)/sizeof(wchar_t)), wchar_t> expr(my_string); return expr; }().decrypt()
// crypt wide characters
#define _cw( string ) XorWideString( string )
int main(void ) {
std::cout << _c("0obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze0\n"
"1obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze1\n"
"2obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze2\n"
"3obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze3\n"
"4obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze4\n"
"5obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze5\n"
"6obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze6\n"
"7obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze7\n"
"8obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze8\n"
"9obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze9\n" ) << std::endl;
std::cout << "Wide strings" << std::endl;
std::wcout << _cw(L"0obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze0\n"
"1obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze1\n"
"2obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze2\n"
"3obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze3\n"
"4obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze4\n"
"5obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze5\n"
"6obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze6\n"
"7obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze7\n"
"8obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze8\n"
"9obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzze obfuscate me pleazzzzzzeobfuscate me pleazzzzzze obfuscate me pleazzzzzze9\n") << std::endl;
return 0;
}
来源：https://stackoverflow.com/questions/4102320/c-how-to-encrypt-strings-at-compile-time