Is it possible to extract constants and other predefined values from binary executables?

Question

Let's say we have this program here

class Message{

public static SUPER_SECRET_STRING = "bar";

    public static void Main(){
        string SECRET = "foo";
        Console.Write(sha(SUPER_SECRET_STRING) + "" + sha(SECRET));
    }

}

Now, after building this program, is there any way using a hex editor or some other utility to extract the values "foo" and "bar" from the compiled binary file?

Also let's assume that memory editors are not allowed.

Is this applicable to all compiled languages like C++? What about ones that are run in another environment like Java or C#?

Weave

Yes; it's certainly possible. What language? – Bemuse

There's a standard program, strings, that will print out printable data from object files — it can be used to find strings in executables, and is extremely useful. You may need to use the -a option to get maximum benefit. – Appellation

Answer 1

Yes you could easily use a decompiler to extract those kinds of constants, especially strings (since they require a larger chunk of memory). This will even work in machine-code binaries and is even easier for VM-languages like Java and C#.

If you need to keep something secret in there you will need to go great lengths. Simply encrypting the string for example would add a layer of security, but for someone who knows what she does this won't be a big barrier. For example scanning the the file for places with uncommon entropy is likely to reveal the key which was used for encryption. There are even systems which encode secrets by altering the used low-level commands in the binary. Those tools replace certain combinations of commands with other equivalent commands. But even thous systems are not too hard to circumvent, as the uncommon combination of commands will reveal the use of such tools.

And even if you manage to protect the string by some kind of encryption in your binary, you will at some point require a decrypted version for your execution. Creating a memory-dump at a point in time where the string is used will thus also contain a copy of the secret value. This is especially problematic in Java as you cannot deallocate a chunk of memory and a string is immutable (meaning that a "change" to the string will lead to a new chunk of memory).

As you see the problem is far from trivial. And of course there is no way to give you 100% security (think of all the cracked games and so on).

Something that can be implemented in a secure way is using Public-key cryptography. In that case you will need to keep the private key hidden. That might be possible if you could for example send things to your server to encrypt them or you have hardware which provides a Trusted Platform Module. But those things might not be feasible for your case.

Immobility

Related question #7436480 – Weave

Answer 2

The answer from Mene is correct, but I wanted to put in my two cents to let you know how ridiculously easy it is to extract strings from compiled binaries (regardless of the language). If you have Linux, all you have to do is run the command strings <compiled binary> and you have the extracted strings. You don't have to be any sort of reverse engineer to pull this off. I just ran it against the eclipse binary on my Ubuntu machine and check out the (truncated) output:

> strings eclipse
ATSH
0[A\
8.uCH
The %s executable launcher was unable to locate its 
companion shared library.
There was a problem loading the shared library and 
finding the entry point.
setInitialArgs
-vmargs
-name
--launcher.library
--launcher.suppressErrors
--launcher.ini
eclipse

Notice how the string "The %s executable launcher was unable to locate its companion shared library. There was a problem loading the shared library and finding the entry point." appears in the output. This string is no doubt hard coded into the program.

When strings (and other data) are hard coded into a program, most compilers place them into a special section in the binary where they can be mapped directly into memory for access by the program as it needs them. If you were to open the binary with a hex editor, you could find this string easily.

Aliunde