ELF 文件的 CRC 校验和

Question

I need an opinion from somebody who has some experince with assuring file integrity. I am trying to protect the integrity of my file with a crc checksum. My primary goal is to make harder bypassing a licence file check (which consist in disassembling the executable and removing a conditional jump).

I came up with the following idea:

unsigned long crc_stored = 4294967295;
char* text_begin = (char*)0xffffffffffffffff;
char* text_end = (char*)0xffffffffffffffff;

int main(){
    unsigned long crc = calc_checksum(text_begin, text_end);
    if (crc == crc_stored)
        //file is ok
}

I edit the .data section of the elf binary in the following way: text_begin and text_end will contain the begin and end address of the .text section, and crc_stored the crc checksum of the .text section.

I would like to know whether this is a proper way of doing this, or there are better methods?

Edit: Karoly Horvath has right. Let's say I use the crc check to decrypt some code. I would like to know which is the best way ro checksum protect the executable. Olaf also has right. I can use a sha algorithm. The question is the same.

Edit2: please stop saying that any protection can bypassed. I know and I just want to make it harder. Please answer the question if you can.

Answer 1

Let me see. You have code that does this:

int main() {
  if (!license_ok()) { exit(1); }
  // do something useful
}

You are worried that someone will disassemble your code, and patch out the conditional jump, so you are proposing to change the code this way instead:

int main() {
  if (calc_checksum() != stored_crc) { exit(1); }
  if (!license_ok()) { exit(1); }
  // do something useful
}

I hope you see that this "solution" is not really a solution at all (if someone is capable of patching out one conditional jump, surely he is just as capable of patching out two such jumps).

You can find ideas for a more plausible / robust solution in one of the many books on the subject.

Answer 2

Do not stop the programme from running. If the license is wrong at the start some strange behaviour is likely after 1 to 5 minutes, causing segfaults, wrong calculations, whatever. But in some indirect ways. Like a 2nd thread that modifies calculations or changes a random bit in the stack of another thread if the license is wrong.

Also get a Map of yourself at runtime by /proc/self and run a checksum on your .text sections at runtime. That way you also can find some runtime modifications.

But the bitter truth is, if it is runnable then it is just a question of how much effort the attacker needs to get a unlicensed copy running. It is not important to make it unrunnable. Just the effort of getting it cracked must be bigger than the effort.