How would you protect this Crypter?

Question

Imagine you are working in a kind of crypter that only works with the current function deciphered, rest of the code is ciphered by symmetric encryption. When a new function is about to be called, the current function is enciphered and the following is deciphered and called.

My assumption is that a analyst can easily dump the deciphered code (real code) each time a function is called, due to is the unique time where code is leaked/deciphered. Also, an analyst could easily repatch the executable in order to extract the protection, but it would need the symmetric key, once he has it, he just has to remove the encryption/decryption blocks and decipher the code.

Question here is: How can I implement a secure system that accomplish:

• Key management without leaking the key, or protecting it from being retrieved. (So the executable isn't patched for removing crypter's protection).
• Avoid dumping per deciphered function. (Thus the analyst wouldn't dump the whole executable's deciphered code just dumping deciphered functions in runtime).

It would be great to read some advices. Thanks!

Answer 1

There is a thing that might help you in modern crypto research, it is called white-box cryptography and relatively good Q&A article resides here .

Generally speaking if the key exists sometimes in the memory you can safely assume that sometimes it will be dumped and reused.

However you can harden the problem by using the following techniques:

• Obfuscate the key (compute them on the fly)
• Obfuscate the encryption/decryption algorithm
• Use different keys for different functions
• Re-encrypting the function back may be done with different keys
• Use checksums for verification of encrypted code before usage
• Use Intel SGX or similar features of other processors to avoid debugging
• Use anti-debugging and anti-dumping techniques

Good luck.