Download presentation
Presentation is loading. Please wait.
Published byClifton Hopkins Modified over 9 years ago
1
Code Injection and Software Cracking’s Effect on Network Security Group 5 Jason Fritts Utsav Kanani Zener Bayudan ECE 4112 Fall 2007
2
Background Lab 8 – Viruses – But how are they hidden? Code Injection – Injecting unwanted code into a program. – Used by virus writers to inject a virus procedure in the interior of a executable file (Trojans) Software Cracking – Modifying software to remove protection methods such as copy prevention, trial/demo, serial number authentication.
3
Trojan Statistics
4
Tools Used W32Dasm – Disassembler used to translate machine language to readable assembly language. Hex Workshop – Hex editor used to edit raw binary applications. OllyDBG – Debugger used to trace through program step by step.
5
W32dasm
6
Hex Workshop
7
OllyDBG
8
Software Cracking Major component of software piracy “U.S. software industry lost over $2.9 billion in the U.S. and $11 billion in international sales from software theft” Pre-compiled cracks widely distributed on websites. Often contain malware injected in their code – Windows Vista activation crack
9
Lab Contents Software Serial Crack Key Generator Code Injection Example Defenses against code disassembly
10
Serial Key Crack Software distribution done online Serial Keys used as a type of user authentication
11
Finding authentication code In disassembler W32dasm or debugger Search for string comparison (cmp) Jumps to “Invalid serial” if not equal (jne) Note offset
12
Removing authentication In Hex Editor Go to offset of JNE Change JNE to NOP (0x9090)
13
Checking your crack Code bypasses JNE (Jump to “Invalid serial number”) Any serial number can be used.
14
Key Generators Requirements during Software Installation – Product Id – Serial Key A variety of Authentication algorithms used – Algebraic expression( output = ((pid*2 + 73)*3) - 28) – Key gives a checksum of 25
15
KEY-GENERATORS One of the major contributors to Software Piracy Available for free download on several websites Program that generates a serial key or Registration number for a software Automated knowledge of Assembly language not required by the end user
16
Making a Key-Generator DisassemblingExtractionCode Writing
17
Code Injection Example Find code caves (DB 00) – Unused memory locations in executable Overwrite code caves with malicious codes Redirect JMP instructions to malicious codes Redirect back to original code Resume normal operation
18
Code Caves
19
Code Injection Example
20
Injected code executes as well as original program
21
Prevention Product Activation – Online Activation – Telephone Activation Encryption Self Modifying Code
22
EXECryptor-Bullet Proof Software Protection Features – Anti-cracking, anti-debugging, and anti-trace – Secure creation of custom evaluation and trial versions of your software – Built-in registration and license management – Compatible with several programming languages (Delphi, Microsoft Visual C++, Power Basic, Visual Basic) – Protection of several file types (EXE files, DLL and ActiveX components) Uses Code Morphing – Obfuscates the code on the level of the CPU commands rather than the source level. – “EXECryptor's Code Morphing turns binary code into an undecipherable mess that is not similar to normal compiled code, and completely hides execution logic of the protected code. “
24
Unprotected Code
25
Protected Code
26
References Code Injection – http://www.codeproject.com/KB/system/inject2exe.aspx#BuildanImportTableandReconstructtheOrigi nalImportTable6 Software Cracking – http://en.wikipedia.org/wiki/Software_cracking Windows Vista Crack – http://apcmag.com/node/4737 http://apcmag.com/node/4737
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.