As part of my research, I came across a technique in a paper which applies checksumming on a portion of code. I want to implement it. Here is the research paper which talks about the checksumming guard techqniue.

Here is the guard template:

      add ebp, -checksum
      mov eax, client_addr

      cmp eax, client_end
      jg end
      mov ebx, dword[eax]
      add ebp, ebx
      add eax, 4
      jmp for

As you can see, here just addition of opcodes is performed. Can someone suggest a stronger method of doing it? Also, someone suggested Message Authentication techniques like MACs, digital signatures, authentic encryption? What would be the best method?

  • 2
    What purpose is this supposed to serve? Protection from code manipulation? When one can patch your business logic, what stops them from also patching your guard routines?
    – Philipp
    May 2 '16 at 7:32
  • Yes, protection from code manipulation is what it intends to. Actually, I am trying to implement this paper and I am a student, so please don't go into the practicality of it. Also, I am also looking into obfuscation of the guard code to make it harder for the attacker to modify it.
    – ak0817
    May 2 '16 at 7:44
  • 5
    I'm sorry, but we can not "suggest a stronger method" without "going into the practicality". When the whole concept is broken by design, using stronger algorithms would just be snakeoil.
    – Philipp
    May 2 '16 at 7:52
  • See, obfuscating the guard code would make it harder for the person to identify that some protection is being applied and therefore if the person changes the code to be protected, the guard code will detect an error. I know the system is not fullproof.
    – ak0817
    May 2 '16 at 7:58
  • 1
    @ak0817 I suggest you read into Kerckhoffs's principle / Shannon's maxim and security through obscurity.
    – Polynomial
    May 2 '16 at 19:34

I hope you understand that this is security through obscurity and provides no meaningful level of integrity against an adversary who is attempting to modify your code in memory. For this to be effective in any way, the CPU's execution unit would have to be the one verifying the checksum, allowing modified code to simply refuse to execute. If the check is entirely in software, an attacker could quite trivially modify the checksum itself to match the modified code before it is executed.

With that said, the method to use would be a hash of some sort. There are three types of hashes:

  • Checksums involve the addition of a numerical representation of each component of the data, multiplied by a weight factor. Checksums are extremely fast, but are not cryptographically secure and can often miss modified data even under ideal circumstances.

    An example is Fletcher-64.

  • Cyclic Redundancy Checks use the remainder of polynomial division of the contents as a digest. The polynomial is carefully selected to increase the chance of detecting modification. They are generally very fast, but a malicious actor can trivially "break" them.

    An example is CRC32.

  • Cryptographically secure hash functions are much slower than the other options, but are designed to reduce the chance that two inputs with differing contents will resolve to the same digest, regardless of how they are generated. Non-collision-resistant functions can have any digest size. To be collision-resistant, they need larger digest size, such as 160 bits.

    A collision-resistant example is SHA-256. A non-collision-resistant example is SipHash.

Given that you are only writing a proof of concept, you should use a simple and fast checksum or CRC. A proper implementation would use custom hardware verifying a cryptographically secure hash such as SHA-256 as part of a digitally-signed hash tree. If you have access to hardware with SSE4.2 (see page 61), you can use a hardware-accelerated implementation of CRC32c (using polynomial 0x11EDC6F41). This allows a digest to be generated using one instruction for every QWORD of data to be processed, using the crc32q instruction. Otherwise, you would want to use a very fast and extremely simple checksum such as CrapWow or Murmur. It will suffice for a proof-of-concept.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.