#Program security
4 messages in this thread
Good day people.
While writing one of my programs I came on a situation I hope someone here
can remedy. I noticed that any printf messages in my source were left as text
strings in the compiled program. What I don't like about this is that anyone
with a good editor can change what I have written to the user. So, this is
where I need more of your unfaultering great advice.
How can I code constant strings into my program and make them less vulnerable
to changes?
Please accept my thanks in advance. Henry
Henry,
If it really is a problem, at the start of your program, have it read in it's
own file from disk and do a CRC check to verify that the file has not been
changed.
//
\X/ Amiga lives? Gerald Bonnstetter, Bonnsoft
>I noticed that any printf messages in my source were left as text
>strings in the compiled program.
Yes.
> What I don't like about this is that anyone
>with a good editor can change what I have written to the user.
Yes.
>How can I code constant strings into my program and make them less vulnerable
>to changes?
Well, I'd first review whether the effort is worth it.
If so, you have a few options:
* Write a program to scan you source and look for string literals
and change them to be somethink else, as well as call a myprintf
which re-establishes them.
* Or at least put them all into one header or .c that you convert.
* Build your strings one character at a time.
* Put your messages in an external file.
* Etc.
Some of these suggestions are more practical than others.
One approach would be to store your strings in encrypted form and decrypt them
just before they are displayed. A simple method which would deter the casual
hacker (but not a determined code breaker) would be to exclusive or each
character in the string with a fixed bit pattern. This garbles the characters
but if you exclusive or the result with the same bit pattern again you get the
original characters back. You would have to write a routine to do this, run all
of your strings through it and save them in a file. Then the program would read
the strings from the file and feed them through the decryption function before
passing them to printf.
A couple of things to bear in mind if you use this method. You probably can't
use the line based file functions like fputs and fgets to read and write the
file becase the encryption may create extra linefeeds in the strings. A
possible method of marking the end of your encrypted strings would be to not
encode the terminating null. If you do this (or if you use any string handling
functions on the encrypted strings) chose a bit pattern for the key which is
not the same as any ascii character you are using, this will make sure you
don't get any extra nulls in the encrypted strings.
Peter Wade
Autopiloting from London, England