Posted: . At: 9:45 AM. This was 1 year ago. Post ID: 17539
Page permalink. WordPress uses cookies, or tiny pieces of information stored on your computer, to verify who you are. There are cookies for logged in users and for commenters.
These cookies expire two weeks after they are set.


How to obfuscate sections of C code in a program.


It is very easy to obfuscate C code in a program, this simple tip will help you out. The bash one-liner below will encode a string into hexadecimal values in a comma-delimited line.

echo -n "your_string" | xxd -p | sed 's/\(..\)/0x\1, /g'

It will look like this.

0x2f, 0x37, 0xa0, 0x66, 0x99, 0x14, 0x3a, 0x30, 0x7e, 0xd3, 0x6b, 0x3e, 0x72, 0x57, 0x27, 0x8e,
 0xa0, 0x7b, 0xff, 0x49, 0xdf, 0xac, 0xc7, 0x48, 0xed, 0x5b, 0x3d, 0x3d, 0xe5, 0x2c, 0x73, 0x96,
 0x58, 0x7b, 0x06, 0xef, 0xd6

An encoded string of hexadecimal values.

A program like this uses this a lot.

obfuscate.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
#include <stdlib.h>
 
#define bf4217c1(e4973184, \
 fab74730, ea28c65d, e2c3d79f, \
 b61718db, bfd82916, ea98fe41, \
 a3e25fa) \
 a3e25fa ## ea28c65d ## a3e25fa \
 ## bfd82916 ## b61718db ## ea98fe41
 
char b4e0dee7[] = {
 0x49, 0x5e, 0xce, 0x02, 0xb9, 0x6a, 0x1a, 0x1d, 0x0a, 0xaa, 0x1b, 0x5b, 0x52, 0x31, 0x07, 0xa3,
 0xc5, 0x03, 0x9a, 0x2a, 0xff, 0xde, 0xaa, 0x68, 0xc0, 0x29, 0x5b, 0x1d, 0x9e, 0x51, 0x53, 0xca,
 0x63
};
 
int bf29e96c[] = {
 0x2f, 0x37, 0xa0, 0x66, 0x99, 0x14, 0x3a, 0x30, 0x7e, 0xd3, 0x6b, 0x3e, 0x72, 0x57, 0x27, 0x8e,
 0xa0, 0x7b, 0xff, 0x49, 0xdf, 0xac, 0xc7, 0x48, 0xed, 0x5b, 0x3d, 0x3d, 0xe5, 0x2c, 0x73, 0x96,
 0x58, 0x7b, 0x06, 0xef, 0xd6
};
 
int main(void) {
 
 for (int ca4f8421=0; ca4f8421<sizeof(b4e0dee7); ++ca4f8421)
 b4e0dee7[ca4f8421] = 1 + ((-1 * (b4e0dee7[ca4f8421] ^ bf29e96c[ca4f8421]) * -1) * 1) - 1;
 
 bf4217c1(z,x,y,j,e,t,m,s)(b4e0dee7);
 
 return 0;
}

This is a malicious program, do not actually run this. It is just an example.

Here is another obfuscation example.

0x70, 0x72, 0x69, 0x6e, 0x74, 0x66, 0x28, 0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x57, 0x6f, 0x72, 0x6c, 0x64, 0x2e, 0x6e, 0x29, 0x3b,

This is this string.

printf("Hello World.\n");

This gives a nice idea of how to implement obfuscation of source code when distributing a C program.


Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.