Advanced Defensive Techniques

Summary

This chapter demonstrates some more advanced techniques that are more difficult to defeat, including tamper‐proofing, packing, virtualization, and the use of cryptors. Tamper‐proofing is a series of techniques geared toward making software more difficult for an attacker to modify. Digital signatures can provide strong data integrity and authenticity protections. They use public key cryptography where a public and private key pair is generated. One of the key benefits of digital signatures is that it is effectively impossible to generate a valid signature without knowledge of the private key. With guards, code inside the program checks sensitive areas for modification. Common areas to monitor with guards include key checks, jump instructions, other guards, etc. Packing is a broad term referring to techniques commonly used on executables to compress and obfuscate their contents. Many defensive tools such as packers and cryptors have unpackers and decryptors as well.