Static Offset in PE

Question

I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password.

The problem is I use a part of code into the main function to search the opcodes from .text section which could make the corresponding ASCII password.

So, using that part of code I get the offsets but when I remove that code the offsets change and I am left with garbage text.

If I change some code, can it be certain that after compilation the opcodes above it in PE file won't change ?

e.g. :

#include <windows.h>
#include <tchar.h>
#include <vector>
#include <iostream>
#include <iomanip>
#include <string>

#ifdef UNICODE
#  define tcout wcout
#  define tcerr wcerr
#else
#  define tcout cout
#  define tcerr cerr
#endif

const UINT DUMP_SIZE = 96;
const UINT DEFAULT_DUMP_SIZE = 4096;

using namespace std;

VOID ImageInformation( HMODULE& hModule, PVOID& pVirtualAddress,PVOID& pCodeStart, SIZE_T& dwCodeSize,PVOID& pCodeEnd );
int hsearch( LPCVOID pcbStartAddress, LPCVOID pDisplayBaseAddress,DWORD dwSize, int toSearch );
vector<int> calculate_flag(int []);// For checking the user input

int main(int argc, _TCHAR* argv[])
{
    cout<<"\t\t << Welcome to My CrackME >>\n\n"<<endl;
    cout<<"Enter 10 Numbers, I give you the flag "<<endl;
    HMODULE hModule = NULL;
    PVOID   pVirtualAddress = NULL;
    PVOID   pCodeStart = NULL;
    PVOID   pCodeEnd = NULL;
    SIZE_T  dwCodeSize = 0;

    ImageInformation( hModule, pVirtualAddress, pCodeStart,dwCodeSize, pCodeEnd );
    int input[10];
    for(int i=0; i<10; i++){
        cin>>input[i];
    }
    vector<int> result = calculate_flag(input);
    for(int i=0; i<40; i++){
        printf("%c",(((PBYTE)pCodeStart)[ input[i] ]));
    }
    //cout<<result<<endl;
    //
    cout<<endl;
    /*int flg[40] = {....flag array here...};
    vector <int> v;
    for(int characters=0; characters<40; characters++){
            int location = hsearch(pCodeStart, pCodeStart, dwCodeSize, flg[characters]);
            v.push_back(location);
            printf("%d ",location);
    }
    string res;
    for(int i=0; i<v.size(); i++){
        if(v[i] == -1){
            printf(" \n");
        }else{
            printf("%c",(((PBYTE)pCodeStart)[ v[i] ]));
            res.push_back((char)(((PBYTE)pCodeStart)[ v[i] ]));
        }
    }
    for(int i=0;i<100;i++)
        printf(" ");
    printf("%s\n",result);
    cout<<result<<endl;*/
    return 0;
}

vector<int> calculate_flag(int input[]){
....
Other functions defined
hsearch : Used to get the offsets

Problem

If I'm removing the hsearch function, why the offset of previous statements change ?

How do I get the part of code whose offset won't change, so as I can use that to make this crackme ?

Answer 1

Your question is very unclear, but as for this specific question:

If I change some code, can it be certain that after compilation the opcodes above it in PE file won't change ?

The answer is no. If you change part of the program, the compiler may change different parts of the program that you did not modify. The two most accessible examples are functions called by the function you modified, and functions that call the modified function. In both cases, your changes to one function might result in the compiler manufacturing a different calling convention for any of the functions just mentioned, or the compiler may perform something along the lines of interprocedural common subexpression elimination. Then there are other optimizations like profile-guided ones that might drastically change the binary, although you'll know if you're using profile-guided optimizations, which it seems very strongly like you aren't.