Hi to all,
Here come just some my ideas I got after reading your discussion about
cracking and how to stop it.
1. Nobody can stop cracking, all you can do is to make it more complicated.
2. To make cracking harder you should have large practice in it. You should
know methods and technique of your enemies. It's seems me that in this
discussion the more actively one speaks about it the less he knows it.
Please don't consider my following remarks as an ad. Also I have no wish to
hurt anybody. It's my [IMHO] below:
---------------------------------------------------------
i am taking the second.. i spent my 6 hours today making it
harder.. not much more we can do.
az.
- --
Aaron Ardiri
Lecturer
----------------------------------------------
[IMHO] The lecturer should know his subject better... :-) You should not
invent things done before. Just be a student for some time and learn more.
------------------------------------------------
From: Aaron Ardiri <[EMAIL PROTECTED]>
Subject: Re: No code is crack proof!
not prevention.. just keep it uncrackable long enough for me to
make some money :P
az.
--------------------------------------------
[IMHO] It's seems me that you are going to publish one new version/per day
(as you do it :-)). Nice way of protection.
----------------------------------------------------------------------
From: Aaron Ardiri <[EMAIL PROTECTED]>
Subject: Re: cracking site - how do we shut it down?
On Wed, 9 Jun 1999, Sudipta Ghose wrote:
>
>BTW, most cracking/hacking sites I have seen, operate from US, or Europe.
>The third world is too dumb for that, you know!
true.. very true.. :P
-----------------------------------------------------------------------
What to say here? You are the GREATest, aren't you? Is Russia
Europe/Asia/third world? May be it not exists?
--------------------------------------------------------------
From: Jason Dawes <[EMAIL PROTECTED]>
Subject: Re: No code is crack proof!
The solution to this is to use public
key encyption to encrypt the alogorithm, but this still just adds a very
small amount of complexity - after all, the algorithm must be decrypted in
memory at some stage - it's easy to halt the program and dump the memory.
If you really want to make your program secure, you need to use something
unique about the device you intend to target within the algorithm. If
there was a software readable serial number in the device, you could use
that as your key (dongles work this way)(don't be suprised to see this sort
of application once serialized Pentiums are released). This would require
crackers to modify their actual hardware to get your application to run.
Unfortunately, your clients may have problems if they change their
device... but theoretically, they have a support contract or something.
-------------------------------------------------------------
[IMHO]98% correct. 1% because I hardly can imagine how can HaCkeRs modify
the hardware. Another 1% is because to halt the program you should put a
breakpoint in the code. But if the code is decrypting using both Serial
number and itself as a data it would be a real headache to put a breakpoint
anywhere. I know it by my practice both as developer and hacker ;-)
----------------------------------------------------
From: Jean Cyr <[EMAIL PROTECTED]>
Subject: Re: No code is crack proof!
At 10:15 AM 6/9/99, you wrote:
>Aaron Ardiri wrote:
> > this means you need to do the following:
> >
> > a) write your algorithm (in C or whatever)
> > b) compile to assembly, get opcodes
> > c) encrypt opcodes, and store in an array,
> > d) when "regcheck" occurs, decrypt, and execute.
>
>I still don't see the point of this. Presumably after you've done all
>this magic, you make some decision: did the regcode check out ok or
>not? A cracker just needs to find this bit of logic and make it look
>like the decision came out "ok". Alternatively, he can find the place
>where you start the regcode process and branch around the whole thing.
>Or am I missing something?
>--Mark
You are absolutely right. Usually a simple NOP will do. We have been
fighting
software piracy in the Windows application arena for close to half a decade.
This discussion sounds a lot like those we were having 5 years ago. There
are
many techniques that can be used, but one of the first lessons you will
learn
is that you do not discuss them in forums such as this one. You can be
assured
that these are monitored by those who would attempt to defeat your
protection.
---------------------------------------
[IMHO] Are you going to develop you checking code in C? The hackers will get
control just after your decrypt will be completed. As for discussion I dare
say again that there OPEN algorithms of open keys alowing you to get
knowledge of algorithm only but not decrypted code.
--------------------------------------------------------
From: Eric Davis <[EMAIL PROTECTED]>
Subject: RE: No code is crack proof!
You have gone to a lot of trouble. A hacker will go to much greater lengths.
They are interested in the challenge. I see their main goal as overcoming
the challenge.
They often (usually) don't care about making money from your software.
---------------------------------------------------------------
[IMHO] 50/50. I have published HackMe Challenge in http://klyatskin.da.ru
I've monitored discussions on few warez board about challenge. It wasn't
accepted or beaten
------------------------------------------------------------
From: Mark Nudelman <[EMAIL PROTECTED]>
Subject: Re: No code is crack proof!
I still don't see the point of this. Presumably after you've done all
this magic, you make some decision: did the regcode check out ok or
not? A cracker just needs to find this bit of logic and make it look
like the decision came out "ok". Alternatively, he can find the place
where you start the regcode process and branch around the whole thing.
Or am I missing something?
--------------------------------------------------------------
[IMHO] Again have a look at HackMe Challenge from my site. My
self-modified code (compatible with staying in Flash memory) does decrypt
some VITAL information with a key (FlashID number). You can't fool me and
pass me another key, you can't patch the code since it use itself also as a
key, and application can't work without this VITAL information (it's just
some code also). Nowhere a simple comparison is used.
---------------------------------------------------------
From: Aaron Ardiri <[EMAIL PROTECTED]>
Subject: BEATING HACKERS: some sucess..
hi!
ok.. i went home last night.. had a really good think about
how i could at least... DELAY these hackers.. :) (i dont
ever expect to "stop" them)..
i have written a prototype.. and it works! :P
... not so easy to crack.. these crackers now have to crack
two pieces of code.. :)
i use an RC4 based encryption algorithm.. decrypt my
registration code generation code and then zap a function
pointer to my "undecompilable" memory chunk..
and all my registration codes still work.. lovely.
thats ONE step of the way.. does anyone have any code
lying around that checks the "CRC" of the .prc file?
i have made it harder for the crackers to get the regcode
algorithm (which is what i was worried about first),
now what i would like to have is some code that allows
me to check if they screw with the opcodes directly
(NOPing etc..)..
anyone got it? before i spend hours doing it myself?
az.
------------------------------------
[IMHO] Who is going to break RC4 algorithm? It will be either your code
patched or skipped, either foo data passed as an input or smth else. As for
CRC there are so many sources that for the time you spent here... Again
CRC32 is implemeted in HackMe Challenge. It's about 800 bytes long (table is
generated on a fly...) and no sensable delay is found for 50Kb data.
Regards to all. Sorry for the size of letter.
Constantine Klyatskin
----------------------
http://klyatskin.da.ru
______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com
