Hide visible string in variable

Hi,

> Is there a way to modify the string such as char a or char b? Could I
> use the way like "Replace an instruction with another Value" in Programm
> Manual? In fact, what I am interested in is string with visible
> expression, not all string, and I am trying to hide the orignal string
> by using simple way like XOR..

Yes, there is. At the C level, what transformation do you want to do?
The LLVM code is a pretty straight-forward translation from the C code in

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

this case.

sorry, I still don't understand the way you mentioned. Would you mind giving me a example?
What I have tried is that I used the following code

for(Module::ginterator gI=M->gbegin(), gE=M->gbegin; gI!=gE;++gI){
    std::cout<< *gI<< gI->getName()<<gI->getInitializer();
}

With *gI, I could get all string
With gI->getName, I could get the global variable name.
With gI->getInitializer(), I could get the init value for the GV.

Next, what I want to do is to modify the value of the GV, and I tried to use setInitializer(), but I don't know to do it. setInitializer() need contant parameter. I tried several ways, but I failed.

As you said, I can do it like in C level. For C, if I can get the address of the GV, I can read the value and do XOR and then write it back. But for this case, I don't know how to do that. Maybe I am not familar with STL. I really need your help. Sorry again.

for C level,

char a="global string test";
for(i=0;i<strlen(a);i++){
   a[i]= a[i]^RANDMON;
}

For llvm,
%a = internal global [20 x sbyte] c"global string test\0A\00"
Would you mind telling me how to do it.

Qiuyu

> Yes, there is. At the C level, what transformation do you want to do?
> The LLVM code is a pretty straight-forward translation from the C code in
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> this case.

sorry, I still don't understand the way you mentioned. Would you mind giving me a example?
What I have tried is that I used the following code

for(Module::ginterator gI=M->gbegin(), gE=M->gbegin; gI!=gE;++gI){
    std::cout<< *gI<< gI->getName()<<gI->getInitializer();
}

With *gI, I could get all string
With gI->getName, I could get the global variable name.
With gI->getInitializer(), I could get the init value for the GV.

Next, what I want to do is to modify the value of the GV, and I tried to use setInitializer(), but I don't know to do it. setInitializer() need contant parameter. I tried several ways, but I failed.

As you said, I can do it like in C level. For C, if I can get the address of the GV, I can read the value and do XOR and then write it back. But for this case, I don't know how to do that. Maybe I am not familar with STL. I really need your help. Sorry again.

Here are some observations:

for C level,

char a="global string test";
for(i=0;i<strlen(a);i++){
   a[i]= a[i]^RANDMON;
}

If you compile this C code, "global string test" will occur in the program
binary, so you have not obfuscated anything. You can construct exactly
what you have above in LLVM (just write it as C, compile it to LLVM and
you'll see what you need to generate), but I don't think this is what you
want. What you really want is:

char a="GLOBAL STRING TEST";

and when the program starts up (perhaps in main), you want to insert this:

for (i=0...)
  A[i] = tolower(a[i]);

Note that you can use whatever function you wanted, obviously uppercasing
the string isn't much obfuscation.

To do this on LLVM, you have to do these things:

1. Read the string data as a constant (It's an instance of ConstantArray,
   which you get form the Globalvaraible with getInitializer() as you are
   doing.
2. Construct a new ConstantArray with all of the elements of the original
   string, but modified according to the function you want (exclusive or
   is a reasonable start).
3. Change the initializer of the global variable to the new constant with
   setInitializer().
4. Clear the "constant" flag on the string, because the program will be
   dynamically hacking on the string: GV->setConstant(false);
5. Insert the for loop that translates the string when main runs.

For #5, write the for loop you want, compile it with llvmgcc, then figure
out how to generate it at compile time. Alternatively, you could put the
'decryption' routine in a library and just insert a call to the library.

-Chris