<p>First, be aware that your issue is probably better covered by some legal approach (a contract reviewed by a paid lawyer) than by technical means.</p>
<p>Your approach is similar to <a href="https://en.wikipedia.org/wiki/Caesar_cipher" rel="nofollow noreferrer">Caesar cypher</a> (which has been broken thousands of years ago: insight: compute frequencies of letters; in human English, <code>e</code> is the most frequent one). Even the German <a href="https://en.wikipedia.org/wiki/Enigma_machine" rel="nofollow noreferrer">Enigma machine</a> did a lot better in WW2. Read about the works of <a href="https://en.wikipedia.org/wiki/Alan_Turing" rel="nofollow noreferrer">Alan Turing</a> during WW2 (his team broke the Enigma machine encryption).</p>
<blockquote>
<p>Is there some elegant way to do it at compile time, perhaps using the C preprocessor and a macro?</p>
</blockquote>
<h2>No, there is not</h2>
<p>(and mathematical proofs of that exist in the literature, covered by <em>books</em> related to <a href="https://frama-c.com/" rel="nofollow noreferrer">Frama-C</a> or cybersecurity or <a href="https://coq.inria.fr/" rel="nofollow noreferrer">Coq</a> proof assistant; be aware of <a href="https://en.wikipedia.org/wiki/Rice%27s_theorem" rel="nofollow noreferrer">Rice's theorem</a>; Read also Berto-Caseran book on <em>Interactive Theorem Proving and Software Development</em> ISBN 3-540-20854-2)</p>
<p>The argument of such a proof is based on cardinality. You could also use a probabilistic approach: store in your program some cryptic hashcode (e.g. computed by <a href="https://man7.org/linux/man-pages/man3/crypt.3.html" rel="nofollow noreferrer">crypt(3)</a> at build time) and ask from user input a secret key, etc...</p>
<p>Any professional hacker will be technically able (perhaps after weeks of work) to find your &quot;secret&quot; string. Or colleagues working on or with <a href="https://binsec.github.io/" rel="nofollow noreferrer">BinSec</a>.</p>
<p>However, you could write some metaprogram generating your obfuscated string as C code (to be <code>#include</code>-d at compile time), and add into your program some deobfuscation routine.</p>
<blockquote>
<p>I'm fine with something that is gcc specific.</p>
</blockquote>
<p>On large programs, consider developing your <a href="https://gcc.gnu.org/onlinedocs/gccint/Plugins.html" rel="nofollow noreferrer">GCC plugin</a> (perhaps starting with <a href="https://github.com/bstarynk/bismon/" rel="nofollow noreferrer">Bismon</a>). See also the <a href="https://decoder-project.Eu/" rel="nofollow noreferrer">DECODER</a> project.</p>
<p>Be however aware of <a href="https://en.wikipedia.org/wiki/Rice%27s_theorem" rel="nofollow noreferrer">Rice's theorem</a>. Read about <a href="https://en.wikipedia.org/wiki/P_versus_NP_problem" rel="nofollow noreferrer">P vs NP problem</a>.</p>
<p>Consider also generating some C code (maybe some <code>#include</code>-d header) with tools like <a href="https://logological.org/gpp" rel="nofollow noreferrer">GPP</a>.</p>
<p><a href="https://en.wikipedia.org/wiki/Obfuscation_(software)" rel="nofollow noreferrer">Code obfuscation</a> is a topic which has conferences. Did you attend any of them? Many papers exist in ACM conferences.</p>
<p>There could be also legal issues (perhaps related to <a href="https://gdpr-info.eu/" rel="nofollow noreferrer">GDPR</a>). You should contact your lawyer. In France, see article <a href="https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000030939438/" rel="nofollow noreferrer">323</a> du Code Pénal.</p>
<p>If your code runs on a computer connected to the Internet and interacting with a user, consider a <a href="https://en.wikipedia.org/wiki/Software_as_a_service" rel="nofollow noreferrer">SaaS</a> approach: you could ask some money with a <a href="https://en.wikipedia.org/wiki/Visa_Inc." rel="nofollow noreferrer">VISA</a> card at every run (or once a month).... Your bank will sell you appropriate software and permissions.</p>
<blockquote>
<p>I'm writing a game for 8 year olds and the string to be hidden is a URL to be called only once they beat the game and their name will be added to the hall of fame. It's reasonable to assume that most 8 year olds will not have skills that go beyond opening the binary file in a hex editor.</p>
</blockquote>
<p>I now no 8 years old kid able to do that, and those who do deserves to be added to your hall of fame. If indeed you are coding a <em>game</em>, I recommend putting the URL as clear text.</p>
<p>NB. The old <a href="https://en.wikipedia.org/wiki/X_PixMap" rel="nofollow noreferrer">XPM</a> program could be inspirational, and so can be <a href="http://refpersys.org/" rel="nofollow noreferrer">RefPerSys</a> and Jacques Pitrat's last book <em>Artificial Beings, the conscience of a conscious machine</em> (ISBN-13: 978-1848211018). Feel free to contact me by email <code>basile@starynkevitch.net</code> (home) or <code>basile.starynkevitch@cea.fr</code> (office, at <a href="https://www-list.cea.fr/" rel="nofollow noreferrer">CEA LIST</a>) for more.</p>
<p>PS. Consider of course starting your PhD on that topic! In France, at <a href="https://www.ens.fr/" rel="nofollow noreferrer">ENS</a> or <a href="https://en.wikipedia.org/wiki/%C3%89cole_Polytechnique" rel="nofollow noreferrer">Ecole Polytechnique</a>. There are interesting related talks at <a href="https://www.college-de-france.fr/site/college/index.htm" rel="nofollow noreferrer">College de France</a>. In Germany, <a href="https://www.fraunhofer.de/en/institutes/cooperation/learning-labs-cyber-security.html" rel="nofollow noreferrer">Frauhaufer CyberSecurity lab</a>. Probably, the <a href="https://www.bundeswehr.de/de/" rel="nofollow noreferrer">Bundeswehr</a> will fund your research in Germany (but I have no connections there), and also <a href="https://itea4.org/" rel="nofollow noreferrer">ITEA4</a>. Of course, you will spend three or four years full-time to find a good enough solution. Please publish papers on <a href="https://arxiv.org/corr" rel="nofollow noreferrer">arxiv</a>.</p>
Hide string in binary at compile time?
<p>I want to obfuscate a particular string in the binary of a C program to make it harder to analyze. I <em>know</em> this will not prevent someone from seeing the string if running it in a debugger. Yes, this is merely obfuscation.</p>
<p>Every instance of obfuscation triggers a discussion saying it has no value whatsoever. So did this one! <em>I am aware that a capable and determined attacker will be able to recover the string. For the sake of the argument let's say I'm writing a game for X year olds and the string to be hidden is a URL to be called only once they beat the game and their name will be added to the hall of fame. It's reasonable to assume that most X year olds will not have skills that go beyond opening the binary file in a hex editor. Thanks!</em></p>
<p>Is there some elegant way to do the hiding at compile time, perhaps using the C preprocessor and a macro?</p>
<p>What i have seen so far is <a href="https://yurisk.info/2017/06/25/binary-obfuscation-string-obfuscating-in-C/" rel="nofollow noreferrer">a suggestion by Yuri Slobodyanyuk</a> resulting in this:</p>
<pre><code>#define HIDE_LETTER(a)   (a) + 0x50
#define UNHIDE_STRING(str)  do { char * ptr = str ; while (*ptr) *ptr++ -= 0x50; } while(0)

...

  char str1[] = { HIDE_LETTER('s'), HIDE_LETTER('e'), HIDE_LETTER('c'), HIDE_LETTER('r'), HIDE_LETTER('e'), 
    HIDE_LETTER('t'), '\0' };

  UNHIDE_STRING(str1);  // unmangle the string in-place
</code></pre>
<p>It works but it's a bit ugly.  Perhaps someone knows a better solution?</p>
<p>I'm fine with something that is gcc specific.</p>
<p>PS: For C++ there is <a href="https://github.com/adamyaxley/Obfuscate" rel="nofollow noreferrer">a solution by Adam Yaxley on github</a> but I'm looking for C, not C++. And there's a solution with a little helper program at <a href="https://github.com/TwizzyIndy/hkteam_obfuscator" rel="nofollow noreferrer">https://github.com/TwizzyIndy/hkteam_obfuscator</a></p>