Imagine you are working in a kind of crypter that only works with the current function deciphered, rest of the code is ciphered by symmetric encryption. When a new function is about to be called, the current function is enciphered and the following is deciphered and called.
My assumption is that a analyst can easily dump the deciphered code (real code) each time a function is called, due to is the unique time where code is leaked/deciphered. Also, an analyst could easily repatch the executable in order to extract the protection, but it would need the symmetric key, once he has it, he just has to remove the encryption/decryption blocks and decipher the code.
Question here is: How can I implement a secure system that accomplish:
- Key management without leaking the key, or protecting it from being retrieved. (So the executable isn't patched for removing crypter's protection).
- Avoid dumping per deciphered function. (Thus the analyst wouldn't dump the whole executable's deciphered code just dumping deciphered functions in runtime).
It would be great to read some advices. Thanks!