Results 1 to 10 of 10
  1. #1
    WasserEsser's Avatar
    Join Date
    Jul 2015
    Gender
    male
    Posts
    735
    Reputation
    174
    Thanks
    675
    My Mood
    Busy

    Signatures - What Are They and How Can They Be Changed

    Figured i'd post it here aswell inb4 someone copies it.

    "What is a "Signature?"

    A signature is a permutation which the compiler generates out of your code.

    It's the actual code which gets compiled out of your code.

    Different code = different Signature.

    What exactly does the "different code" mean?

    Signature is what the compiler generates.

    Here is some code:



    Once the compiler compiles this, it will get this signature starting at the highlighted position:



    If you look at the decompiler, it will get decompiled into the following code:

    The compiler has optimized it and compares the other way around by comparing SomeParameter <= 15 instead of SomeParameter > 15.



    These are the op codes for this function:





    Now let's change the code a little bit by removing the else statement since it's not necessary and see what it gets compiled and decompiled to:



    Decompiled:



    It's the same decompiled code.

    Now look at the signature:



    It's the same except for these parts:



    Op codes of this function:





    If we take a look at both now we can see that those aren't the exact same as they are compiled differently. If VAC would search for the first part of this function it would trigger, however if it would search for the whole function it wouldn't trigger.

    Now let's change the code.

    Instead of checking if SomeParameter is > 15 and returning SomeParameter + 15 and else SomeParameter - 15 it's now switched up.

    If SomeParameter is <= 15 then we return SomeParameter - 15 and else SomeParameter + 15.

    It has the same purpose but it's switched the other way around.



    Now let's see how the decompiled code looks like:



    Let's take a look at the signature:



    Op codes:





    Difference:



    The signature gets generated by the compiler.

    Change the way a function works, and you get a different signature.

    This is obviously a small example and a very small function, as functions get bigger and bigger and wrap eachother those changes are much larger.
    Last edited by Hunter; 02-14-2016 at 07:54 AM.

  2. The Following 19 Users Say Thank You to WasserEsser For This Useful Post:

    Adrenaline (02-17-2016),andreastampan (03-30-2019),antiichriist (07-21-2018),bazzz_1512 (07-14-2016),CyanRed3 (04-12-2016),DarknzNet (07-12-2016),Delision (11-30-2016),gogogokitty (09-24-2018),Hunter (04-20-2016),jeffpl123 (08-22-2016),kaxeli (07-07-2018),l1m3w1r3 (05-10-2016),LuaHax (12-28-2017),manuelsantos92 (02-07-2018),Organized Chaos (05-06-2019),randomthe2nd (03-10-2016),Smoke (02-10-2016),trajciter (06-14-2017),_NightWare (02-13-2016)

  3. #2
    _haffy's Avatar
    Join Date
    Dec 2015
    Gender
    male
    Posts
    35
    Reputation
    10
    Thanks
    9
    I got asked about changing signature on runtime recently actually:

    Haffy: Just allocate a bunch of bytes where you want to insert your junk code (random nop instructions or whatever), then just remove memory protection on them and write random data over it. And you can just place a jmp instruction before your junk code so you just jump over it

  4. #3
    Orinion77's Avatar
    Join Date
    Jan 2013
    Gender
    male
    Posts
    140
    Reputation
    10
    Thanks
    47
    My Mood
    Relaxed
    You changed the function of the code tho...
    you should check for <= if you switch statements.

  5. #4
    WasserEsser's Avatar
    Join Date
    Jul 2015
    Gender
    male
    Posts
    735
    Reputation
    174
    Thanks
    675
    My Mood
    Busy
    Quote Originally Posted by Orinion77 View Post
    You changed the function of the code tho...
    you should check for <= if you switch statements.
    I knew this would come up

    Yes, i didn't exactly switch the statement.

    Edit: Changes as i remade the screenshots.

    - - - Updated - - -

    Quote Originally Posted by _haffy View Post
    I got asked about changing signature on runtime recently actually:

    Haffy: Just allocate a bunch of bytes where you want to insert your junk code (random nop instructions or whatever), then just remove memory protection on them and write random data over it. And you can just place a jmp instruction before your junk code so you just jump over it
    This could, but does not mean it will work.

    It always depends on what patterns VAC is gathering.

    They could use part of it, they could use wildcards etc.
    Last edited by WasserEsser; 02-10-2016 at 05:59 PM.

  6. #5
    Smoke's Avatar
    Join Date
    Nov 2014
    Gender
    male
    Posts
    11,322
    Reputation
    2557
    Thanks
    4,472
    My Mood
    Amazed
    Awesome tutorial/guide.

    /Stickied.


    CLICK TO BUY NOW!!


    Quote Originally Posted by Liz View Post
    This is my first vouch, ever. Rapidgator account worked perfectly. Would buy in the future.

  7. The Following User Says Thank You to Smoke For This Useful Post:

    WasserEsser (02-10-2016)

  8. #6
    _haffy's Avatar
    Join Date
    Dec 2015
    Gender
    male
    Posts
    35
    Reputation
    10
    Thanks
    9
    Quote Originally Posted by WasserEsser View Post
    I knew this would come up

    Yes, i didn't exactly switch the statement.

    - - - Updated - - -



    This could, but does not mean it will work.

    It always depends on what patterns VAC is gathering.

    They could use part of it, they could use wildcards etc.
    I'm not saying that changing your code's signature is even useful but rather was just answering potention questions.

  9. #7
    bazzz_1512's Avatar
    Join Date
    May 2014
    Gender
    male
    Posts
    26
    Reputation
    10
    Thanks
    24
    Thanks! Really helpfull

  10. #8
    Delision's Avatar
    Join Date
    Aug 2012
    Gender
    male
    Location
    Minnesota, US
    Posts
    197
    Reputation
    10
    Thanks
    781
    My Mood
    Mellow
    Really nice job explaining it. I came into this thread knowing almost nothing about signatures or how they work, and you made it really easy to understand. Well done!
    Here's an actual picture of me.

  11. #9
    manuelsantos92's Avatar
    Join Date
    Jan 2014
    Gender
    male
    Location
    192.168.1.1
    Posts
    307
    Reputation
    10
    Thanks
    130
    My Mood
    Cool
    +rep ! nice tutorial

  12. #10
    skyoo200's Avatar
    Join Date
    May 2019
    Gender
    male
    Posts
    48
    Reputation
    10
    Thanks
    1
    I'm a rookie. I can't understand it at all, but thank you all the same.

Similar Threads

  1. What's RCS and how can you make it work best for you?
    By Leins in forum Counter Strike: Global Offensive Help
    Replies: 0
    Last Post: 03-12-2015, 12:53 AM
  2. [Help] What Are Structs? And How do I Use Them?
    By MoreCheeze77 in forum Call of Duty Modern Warfare 2 Coding / Programming / Source Code
    Replies: 2
    Last Post: 06-17-2011, 02:22 PM
  3. Replies: 29
    Last Post: 05-25-2011, 08:16 PM
  4. What are coupons and how do i get them ?
    By wolvereine in forum CrossFire Help
    Replies: 4
    Last Post: 04-05-2010, 07:51 PM
  5. What Are Boxes And How Do You Make Stand Alone Trainers?
    By condor01 in forum WarRock - International Hacks
    Replies: 2
    Last Post: 04-19-2007, 03:17 AM