Rename Win32 Functions for Security on C++

Question

Is there a way to rename a win32 function like GetVolumeInformationW() using #define ?

For example: #define abc(LPCWSTR a, LPWSTR b, ...) GetVolumeInformationW(Some argumments..)

Why do that? I want to hide the function name on debbuger programms like IDA, is there some way to did that?

Language: C++

question from:https://stackoverflow.com/questions/65599317/rename-win32-functions-for-security-on-c

Answer 1

There is no point in using #define for this, as this will have no effect on the contents of the binary executable. Using preprocessor macros will only affect what you as a programmer will see, but it won't affect what the compiler or linker will see. See this link for information on how the C++ preprocessor works and its relationship with the compiler/linker.

If you do not want the function to appear in the Import Table of your executable, then you can instead load the function dynamically using GetProcAddress. That way, a disassembler will probably be unable to determine which function the address is pointing to, when the function is being called. However, the disassembler will be able to see that you are using GetProcAddress for something, it just won't know what. Using the function GetProcAddress may make someone trying to crack your software suspicious, because that is a common thing to do if you are trying to hide something.

If you do not want the string GetVolumeInformationW to appear in cleartext in your executable file, then you can somehow encrypt or obfuscate it, for example store it in reverse and then reverse it back before passing it to GetProcAddress. This was just a very simple example of how it could be done. Using XOR (which is the ^ operator in C++) on every character with a certain key to encrypt, and then do the same thing again to decrypt, would probably be a better solution, as this would make the the encrypted text not be easily identifiable as text.