1

So I have a program which is highly obfuscated and generates a unique output every time. For ease of reversing I want to make it so that the output is the same for every run (following the logic that if the output is the same, the logic executed will be the same, roughly..)

At one point strace shows that the program does a number of calls to clock_gettime just before it generates an id. So I created a kernel module that makes clock_gettime return exactly the same time. Yet the program is still able to produce a unique output.

In my opinion all programs must make system calls to get unique entropy for seeding random functions and without making any system calls (or if all system calls they did make were made to return non-unique entropy) the program can't produce unique (random) data.

Are there any ways I'm missing that the program can get unique entropy without showing up on strace (i.e. without making a system call)?

Improve this question
10
  • Can you please upload the program?
    – sherlock
    Jan 20, 2017 at 8:39
  • Unfortunately that's not possible in this case. Though I'm looking for a technique I can apply to any program anyway.
    – scruffy
    Jan 20, 2017 at 8:41
  • Does it read from something like /dev/rand ?
    – w s
    Jan 20, 2017 at 8:42
  • rt_sigaction is the only other syscall called before generating the id. No file opens.
    – scruffy
    Jan 20, 2017 at 8:45
  • In addition if it is Intel processor reseed and rdrand instructions may be used, it does not require system call.
    – w s
    Jan 20, 2017 at 8:46

1 Answer 1

Reset to default
2

Generally speaking, yes, there are a lot of ways to generate entropy without system calls (this can be weak entropy, but anyway).

Here is a small (but obviously not even close to pretend to be full) list:

  • rdrand, rdseed instructions from intel random generator(btw, supported by AMD since 2015).
  • rdtsc instruction - which gives you a tick count since power up
  • uninitialized memory
  • internal program addresses generated as a result of ASLR
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.