Performing Code Checksum
Created the Monday 18 March 2019. Updated 3 years, 6 months ago.
Some malware can perform code checksum to try to identify if a part of the packing code had been modified which suggests that anti-debugging routines may had been disabled.
Technique Identifier
Code Snippets
Description
The below example shows how to calculate the checksum of a function used to detect a breakpoint using INT3. Original source code available here:
DWORD CalcFuncCrc(PUCHAR funcBegin, PUCHAR funcEnd)
{
DWORD crc = 0;
for (; funcBegin < funcEnd; ++funcBegin)
{
crc += *funcBegin;
}
return crc;
}
#pragma auto_inline(off)
VOID DebuggeeFunction()
{
int calc = 0;
calc += 2;
calc <<= 8;
calc -= 3;
}
VOID DebuggeeFunctionEnd()
{
};
#pragma auto_inline(on)
DWORD g_origCrc = 0x2bd0;
int main()
{
DWORD crc = CalcFuncCrc((PUCHAR)DebuggeeFunction, (PUCHAR)DebuggeeFunctionEnd);
if (g_origCrc != crc)
{
std::cout << "Stop debugging program!" << std::endl;
exit(-1);
}
return 0;
} It was originally published on https://www.apriorit.com/