3

I’m pretty new to reverse engineering, so bear with me...

I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve gathered some data I’m pretty sure belongs to the one of the structs I’m interested in. However, upon closer inspection, I’ve noticed the addresses of these “pieces of data” are scattered all over the place within this binary, instead of being in one contiguous chunk, as a struct should be.

A quick Google search on this issue suggested it might be happening because of “pointer encryption”, which apparently is more like xoring than encrypting(?)... and following searches on the topic lead to nothing.

Which leads me to ask this: what exactly is “pointer encryption”? Can it be undone? And, if so, how can I decrypt it?

Improve this question

2 Answers 2

Reset to default
5

pointer encryption

There is no such thing. There is only pointer obfuscation. This is essentially how Microsoft markets a couple of functions, and they're pretty open about it from the docs on EncodePointer

Encoding globally available pointers helps protect them from being exploited. The EncodePointer function obfuscates the pointer value with a secret so that it cannot be predicted by an external agent. The secret used by EncodePointer is different for each process.

From one of the Microsoft blogs from 2006

All these functions do is XOR a pointer with a random number; the first two functions use a random number held in every application’s process information block, and the system versions use a value that is tied to each system reboot and is accessible to every application running on the box. [...] Rather than using the pointer directly, the pointer is encoded and stays encoded until you’re about to use it. This makes is more difficult for an attacker, because he must overwrite the function pointer with a value that would calculate correctly after the XOR operation. Not impossible, but highly unlikely.

Improve this answer
1
  • Current versions of Windows have an algorithm that is slightly smarter than just XOR because it was easy to break if you had both the plain and obfuscated pointer.
    – mrexodia
    Commented May 26, 2018 at 12:12
1

I don't think there is any encryption going on. Probably the program uses multiple structs to store the data which is completely normal.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.