Multi-Stage Password Construction and Byte-Level Obfuscation

// WRONG: Current implementation
memcpy(__dest, &DAT_08048910, 0x1f);  // Password in binary!
strcmp(param_1, param_2);              // Plaintext comparison

// CORRECT: Cryptographic hash
#include <openssl/sha.h>

// Store only the hash (computed offline)
const unsigned char stored_hash[SHA256_DIGEST_LENGTH] = {
    0xa3, 0x5f, 0x2e, 0x... // Precomputed hash
};

void validate_password(const char *user_input) {
    unsigned char input_hash[SHA256_DIGEST_LENGTH];

    // Hash the user input
    SHA256((unsigned char*)user_input, strlen(user_input), input_hash);

    // Constant-time comparison
    if (CRYPTO_memcmp(input_hash, stored_hash, SHA256_DIGEST_LENGTH) == 0) {
        blowfish();  // Success
    } else {
        RS4();       // Failure
    }
}

// Using Argon2id (winner of Password Hashing Competition)
#include <argon2.h>

#define HASHLEN 32
#define SALTLEN 16

int validate_password(const char *password) {
    // Salt and hash stored offline (not hardcoded here!)
    uint8_t salt[SALTLEN] = { /* random salt */ };
    uint8_t stored_hash[HASHLEN] = { /* precomputed hash */ };
    uint8_t computed_hash[HASHLEN];

    // Hash user input with Argon2id
    argon2id_hash_raw(
        2,          // iterations
        65536,      // memory (64 MB)
        1,          // parallelism
        password, strlen(password),
        salt, SALTLEN,
        computed_hash, HASHLEN
    );

    // Constant-time comparison
    return (memcmp(computed_hash, stored_hash, HASHLEN) == 0);
}

// WRONG: Hardcoded in binary
memcpy(__dest, &DAT_08048910, 0x1f);  // Embedded password!

// BETTER: Load from secure storage
#include <sys/stat.h>

unsigned char stored_hash[32];
FILE *hash_file = fopen("/etc/app/.password_hash", "r");
if (hash_file) {
    fread(stored_hash, 1, 32, hash_file);
    fclose(hash_file);

    // Set restrictive permissions (owner read-only)
    chmod("/etc/app/.password_hash", 0400);
}

// BEST: Server-side validation
// Don't validate passwords in client-side binaries at all!
// Send authentication requests to a secure server via TLS

#include <sodium.h>  // libsodium for modern cryptography

#define PASSWORD_HASH_SIZE crypto_pwhash_STRBYTES

int main(int argc, char **argv) {
    if (argc != 2) {
        printf("Usage: %s [password]\n", argv[0]);
        return 1;
    }

    // Initialize libsodium
    if (sodium_init() < 0) {
        fprintf(stderr, "Failed to initialize cryptography library\n");
        return 1;
    }

    // Load stored hash from secure file (NOT hardcoded!)
    char stored_hash[PASSWORD_HASH_SIZE];
    FILE *hash_file = fopen("/etc/app/.password_hash", "r");
    if (!hash_file || fread(stored_hash, 1, PASSWORD_HASH_SIZE, hash_file) != PASSWORD_HASH_SIZE) {
        fprintf(stderr, "Failed to load password hash\n");
        return 1;
    }
    fclose(hash_file);

    // Verify password using Argon2id (via libsodium)
    if (crypto_pwhash_str_verify(stored_hash, argv[1], strlen(argv[1])) == 0) {
        printf("Password accepted!\n");
        // Success action
        return 0;
    } else {
        printf("Password rejected!\n");
        return 1;
    }
}

// To generate the hash (done offline with actual password):
// char hash[crypto_pwhash_STRBYTES];
// crypto_pwhash_str(
//     hash,
//     password, strlen(password),
//     crypto_pwhash_OPSLIMIT_INTERACTIVE,
//     crypto_pwhash_MEMLIMIT_INTERACTIVE
// );
// // Store hash in secure file with 0400 permissions