1

So I have a program which is highly obfuscated and generates a unique output every time. For ease of reversing I want to make it so that the output is the same for every run (following the logic that if the output is the same, the logic executed will be the same, roughly..)

At one point strace shows that the program does a number of calls to clock_gettime just before it generates an id. So I created a kernel module that makes clock_gettime return exactly the same time. Yet the program is still able to produce a unique output.

In my opinion all programs must make system calls to get unique entropy for seeding random functions and without making any system calls (or if all system calls they did make were made to return non-unique entropy) the program can't produce unique (random) data.

Are there any ways I'm missing that the program can get unique entropy without showing up on strace (i.e. without making a system call)?

  • Can you please upload the program? – Holmes.Sherlock Jan 20 '17 at 8:39
  • Unfortunately that's not possible in this case. Though I'm looking for a technique I can apply to any program anyway. – scruffy Jan 20 '17 at 8:41
  • Does it read from something like /dev/rand ? – w s Jan 20 '17 at 8:42
  • rt_sigaction is the only other syscall called before generating the id. No file opens. – scruffy Jan 20 '17 at 8:45
  • In addition if it is Intel processor reseed and rdrand instructions may be used, it does not require system call. – w s Jan 20 '17 at 8:46
2

Generally speaking, yes, there are a lot of ways to generate entropy without system calls (this can be weak entropy, but anyway).

Here is a small (but obviously not even close to pretend to be full) list:

  • rdrand, rdseed instructions from intel random generator(btw, supported by AMD since 2015).
  • rdtsc instruction - which gives you a tick count since power up
  • uninitialized memory
  • internal program addresses generated as a result of ASLR

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.