I have a small C++ program that contains a "secret" string that must be hard to find in the object code, e.g.,

#include <iostream>

int main() {
    std::string a = "super-secret-string-that-must-be-hard-to-discover";
    std::cout << a;
    return 0;

When compiling this on Unix and running strings on the a.out, one gets around 150 lines with

basic_string::_M_construct null not valid

Well, that was easy.

Is it possible to harden the above code against such decompilation, perhaps as a preprocessing step or as a compiler option?

  • 2
    don't use plaintext, encrypt them. disable debugging info in compilation. use packers and protectors.
    – arman
    Mar 24 at 4:11
  • 2
  • Generally search for "compile time obfuscation" of strings or whatever you have in mind (e.g. arrays/vectors ...). There are several options available. This is another. If you want it take one notch further you can use proper encryption or a salted hash (to compare against passwords or even command line switches which you want to hide). Thing is, this has little to do with decompilation as such.
    – 0xC0000022L
    Mar 24 at 8:31
  • The lengths to which you will need to go depend entirely on your specific circumstances. At the most extreme you can implement something like vault security where the encrypted information is stored on a remote server and transferred securely. However, At the end of the day, if someone has access to the running program there is absolutely nothing you can do to stop them from finding it if they are determined enough.
    – Taekahn
    Apr 1 at 2:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.