Program protection using Cipher lib or 3d Party solution?

Just starting out? Need help? Post your questions and find answers here.
Kale
PureBasic Expert
PureBasic Expert
Posts: 3000
Joined: Fri Apr 25, 2003 6:03 pm
Location: Lincoln, UK
Contact:

Program protection using Cipher lib or 3d Party solution?

Post by Kale »

Has anybody used the PB Ciper lib for protecting a PB exe from crackers? If so have you got any code examples for me to learn from? Or have you used a third party protection solution? I am wondering how unique password protected exe's are created.

Take for example Milkshape (which i bought ages ago), when this is bought you receive a key (as a string) from the author via email, this is then fed into the program's 'About' dialog, then it is registered. How are these strings created and how does the program know if a valid string was entered without 'giving' the cracker an easy to find embedded keygen?

I want to move into coding a few shareware tools/apps/etc... and am now wondering about their security.
Any help is greatly appreciated. :)
--Kale

Image
Manne
User
User
Posts: 30
Joined: Mon Apr 28, 2003 8:49 pm

Post by Manne »

I'm using third party tools for the job.

Have a look here:

http://www.visagesoft.com/vp/
or
http://www.aspack.com/asprotect.html

Manne
ricardo
Addict
Addict
Posts: 2438
Joined: Fri Apr 25, 2003 7:06 pm
Location: Argentina

Re: Program protection using Cipher lib or 3d Party solution

Post by ricardo »

Hi Kale,

Im using this method and works fine for me:

1.- Detecting the HD serial number
2.- Generating a 'serial' that the user send to me when register and then i generate a key.
3.- Changing weekly the algo and of course the downloable file but WITHOUT changing the version number (this is VERY important!!).

The combination of this factors help me to avoid cracks... in fact sometimes i found some cracks on the web, but of course never works with the file that is now available for download.

I dont change the version number when changing the authentication algo, then some users could have the same version of my software but with different algorithms to the key part and that makes very hard to develope a keygen.

I know this method is not perfect, but its working for me. :D :D
ARGENTINA WORLD CHAMPION
Karbon
PureBasic Expert
PureBasic Expert
Posts: 2010
Joined: Mon Jun 02, 2003 1:42 am
Location: Ashland, KY
Contact:

Post by Karbon »

I found the visagesoft.com people a little while back and was looking into purchasing their product. How do you like it? Is the support good? Any problems?

I took a look at the aspack.com product too - any reason you use both of them? Do you like one over the other - if so, why?

Sorry for all the nagging questions - it's just hard to find other developers to talk to about stuff like this!

Thanks!
-Mitchell
Check out kBilling for all your billing software needs!
http://www.k-billing.com
Code Signing / Authenticode Certificates (Get rid of those Unknown Publisher warnings!)
http://codesigning.ksoftware.net
Manne
User
User
Posts: 30
Joined: Mon Apr 28, 2003 8:49 pm

Post by Manne »

@Karbon

AsProtect has definetly the better protection scheme and is cheaper too.
But with Visual Protect you will get an easier Interface.
One thing at all, both Products are crackable.
If you have a look on cracker sites you will found out that Programs protected by Asprotect are only cracked by the Cracker Elite.
The point to found a good commercial product is to seach for cracks.
Only few and older cracks for Asprotect, more for Visual Protect.
At the moment it seems there is a new star of commercial protection apps on the sky.
Have a look here:
http://www.thinstall.com
There is no crack found for Thinstall at the moment.
It might be a good choice to give it a try.
But keep in mind, i think there is no 100% secure protection out for now.

Manne
Karbon
PureBasic Expert
PureBasic Expert
Posts: 2010
Joined: Mon Jun 02, 2003 1:42 am
Location: Ashland, KY
Contact:

Post by Karbon »

Sadly I know there is no such thing as "un-crackable".. But I want to get as close as possible!

Great information, very much appreciated!
-Mitchell
Check out kBilling for all your billing software needs!
http://www.k-billing.com
Code Signing / Authenticode Certificates (Get rid of those Unknown Publisher warnings!)
http://codesigning.ksoftware.net
LJ
Enthusiast
Enthusiast
Posts: 177
Joined: Wed Apr 30, 2003 4:00 pm

Thinstall

Post by LJ »

Thinstall is a great product, but the $749 price tag, well don't get me started on my soapbox about how outrageous that price is for me.

Would be nice to find a program like Thinstall that puts all resources and files into a single compressed .exe that runs from this single .exe at a more, I think I'll say, earthy price if you know what I mean.
Karbon
PureBasic Expert
PureBasic Expert
Posts: 2010
Joined: Mon Jun 02, 2003 1:42 am
Location: Ashland, KY
Contact:

Post by Karbon »

Yeah, at $749 that knocks it right outta there for me..

Honeslty I'm not *that* worried about cracker kiddies being a threat to the software I'm developing as the software is something that requires quite a bit of support to even use.. Still, it's good to make it as tough as possible!

I will probably purchase the AsProtect and give it a go. For the small price tag it's worth it even if someone could still crack my software.. At least it makes it harder - which is all we can really do anyway.. I'm sure in time there will be cracks for software protected with the Thinstall product too, then you're out $700 more dollars than you were before and just as vulnerable!
-Mitchell
Check out kBilling for all your billing software needs!
http://www.k-billing.com
Code Signing / Authenticode Certificates (Get rid of those Unknown Publisher warnings!)
http://codesigning.ksoftware.net
LJ
Enthusiast
Enthusiast
Posts: 177
Joined: Wed Apr 30, 2003 4:00 pm

Right..

Post by LJ »

There has got to be a way to just have the single .exe option. I took a program I wrote with over 200 files, some .exe, some jpgs, some .gifs, 45 megs worth in fact. Thinstall put all that junk into a single .exe that was 27 megs! And then it didn't load it all into memory either which was my concern. It functioned exactly as my program was intended to, only loading certain .jpgs when needing for viewing certain screens and then freeing the resources upon termination. Just amazing. I literally cried when I saw the price tag. But note that the price tag includes a bunch of other features I don't care for.

With PB I think Rings posted some code about how to compress files and then extract those files. There has got to be a way to modify his code to compress the files into a .exe, and then when ran, extract the files to a .temp folder and call them from there.

I remember someone on the Blitz web site did just this sort of thing a couple of years ago to help Blitz coders protect their resources a little better. I think Purebasic really needs this kind of application.

Oh yes, the program on the Blitz forum is called DataPak/PakMaker by TeraBit.

I found it again, here is the help file:
DataPak Functions & GUI Packer
Copyright Lee Page
TeraBit Software
2000 - 2002

Version 2.5

Dear Blitz Basic User,

The TeraBit DataPacker and Extraction functions habe been designed to allow you to protect the media which ships with your projects from pilfering hands! It's not crack proof (what is!?) but it will be more trouble than it's worth for most people to break into it! If you want to have a MODable game, then simply allow the users to create their own packs and give them some (different) keys.

The Package consists of:

* A GUI Packer, tooled to make the Packing and protection of your investment, as painless as possible.
* A Include file 'Bones.bb' - Which contains the functions you will need to include in your project to make use of the Data.Pak etc.
* 4 Demonstration Projects which show how to use most of the functions
* A DLL required to run the GUI Packmaker on Windows 2000 & Earlier

FUNCTIONS

PakInit myfile$,mykey,APND$,headermask

PakInit is the function you call to initialise a Data.pak or a pak contained in an .exe. The First Parameter is the FileName (Often Data.pak or the name of your .exe). Then you have your 32 Bit encryption Key (The part that the data is encrypted with), then the Temporary file designator (APND$) which is appended to any file unpacked by the DataPak system (usually "TMP"). Then the HeaderMask, a separate 32 Bit Key used to encrypt separately the Header and directory listings. If you specify 0 for both encryption keys, it's a relatively easy matter to carve files out of a Pak, but it will load and Pack the data faster, so speed vs security.


The initialisation line is shown at the bottom of the GUI Packmaker and can be Cut/Paste into Blitz to save time.



Pak "Filename"

This is the routine that actually recreates a packed file. Use it where you would a filename: eg..

Pic = LoadImage("Wombat.png")

Becomes

Pic = LoadImage(Pak("Wombat.Png"))

This needs to be used AFTER initialising the Pak using PakInit.

NOTE: If you unpack a 3D model file (.x .3ds .b3d etc.) then it will be scanned for texture references and attempt to unpack these in advance of the model, so that it can be textured correctly by blitz.


DLPak()

DL stands for Delete Last. You can use this to remove the Temporary file created when you unpack Data.

eg. Pic = LoadImage(Pak("Wombat.Png")) : DLPak() ; Note this does not apply to 'Exploaded' Textures


PakClean()

This cleans out all files that have been unpacked to date, but have not been cleaned up yet. You could use this after a heavy loading session. It also clears up Textures which are automatically unpacked (Multiple texture upacking I call exploding) in advance of a 3D-Model.



CreatePakFile "Filename", Encryption Key, headerMask
AddtoPak "SomeFile.png"
CloseCreatedPak()
AppendToExe "MyExe.exe","Data.Pak"


This allows you to make your own packs from within Blitz. See the Pack Creation Demo for details as to ho w to use them.

NOTE: You may use the PACKING functions to make your own PACKERS, but not to sell these PACKERS on a commercial basis (or shareware etc.). I put many hours into this project, and would like all related Packers for the format to be free for all.

You are free to use them in all other projects commercial or not and this in no way restricts the use of the unpacking functions.

PakOutputDir "C:\somewhere2

Sets out where DataPak put's it's temporary files. If the location doesn't exist, it will attempt to create it! as will all unpacking functions with a relative path in the name.

Hence

Pak("\media\elmo.png2")

will attempt to create a subdirectory called Media and unpack the elmo.png into it!

When apending data to an .exe file, I recommend compressing the .exe BEFORE attaching the data to it. I prefer to use UPX for this job

http://upx.sourceforge.net/

Then Pak with the Append to EXE checked to finish the job!

It is sensible to copy the PackMaker.exe into the root folder of your project. When run, it will scan subfolders to find files for you to add to a pack.

Have fun! The best way to learn is to play around with it, see what it can do! Take the demo's apart and see what they do and why!

Bug reports / suggestions to:

TeraBit@Btinternet.com

Of course we don't need the upx sourceforge compression, Purebasic already has this.

Any chance of converting this into Purebasic?
User avatar
Paul
PureBasic Expert
PureBasic Expert
Posts: 1285
Joined: Fri Apr 25, 2003 4:34 pm
Location: Canada
Contact:

Post by Paul »

Just use IncludeBinary to include all your resources in your program when you compile it. Then UPX your final EXE.

Temperary extraction to hard drive is not needed.

Lee's DataPak stuff was needed for Blitz because Blitz has no IncludeBinary commands for including resources.
Image Image
LJ
Enthusiast
Enthusiast
Posts: 177
Joined: Wed Apr 30, 2003 4:00 pm

Hmmm....

Post by LJ »

Not sure about that Paul. I've got sprawling .exe's, over 150 graphic files, some .jpg, some .gif, etc... it's really a Suite. Going back and changing all that code, for all those images, in each different .exe would be very, very hard and then I don't want to have all the files included in the .exe's because of memory limitations. Currently the .jpg is loaded when it is needed to be viewed, then destroyed and resources freed when done. That is how all of the 150 graphic files work. Then I have a web control to view many other images. Including these files into the main web control doesn't work because the web control loads this information from embeded code in the .html file.

Was hoping for a solution that put together all my files for me in a single .exe like Thinstall. Check it out and you will see what I mean. There is a free time limited demo on the web site at: http://thinstall.com/
Karbon
PureBasic Expert
PureBasic Expert
Posts: 2010
Joined: Mon Jun 02, 2003 1:42 am
Location: Ashland, KY
Contact:

Post by Karbon »

Already made software could use thinstall but if you're currently writing software then just remember to IncludeBinary the files.. I'm nearly positive that it works the same way and I doubt there is any limit on IncludeBinary's...
-Mitchell
Check out kBilling for all your billing software needs!
http://www.k-billing.com
Code Signing / Authenticode Certificates (Get rid of those Unknown Publisher warnings!)
http://codesigning.ksoftware.net
LJ
Enthusiast
Enthusiast
Posts: 177
Joined: Wed Apr 30, 2003 4:00 pm

hmm.

Post by LJ »

Paul's comment that Terabit software made the DataPak program because Blitz didn't have the Includebinary command is incorrect. As Terabit state's they did it to offer limited protection for resources by putting them all into a .exe

Karbon, Includebinary is not the Purebasic equivalent of Thinstall, especially if you don't want the binary included. No one wants to includebinary 30 megs worth of resources for memory efficiently reasons. Includebinary is only a viable solution for a small number of resources that can all be loaded into memory.

Notice Purebasic has an option called IncludePath, now this would be handy for a .exe that extracts itself to a temp folder.
Max.
Enthusiast
Enthusiast
Posts: 225
Joined: Fri Apr 25, 2003 8:39 pm

Re: hmm.

Post by Max. »

LJ wrote:Karbon, Includebinary is not the Purebasic equivalent of Thinstall, especially if you don't want the binary included. No one wants to includebinary 30 megs worth of resources for memory efficiently reasons. Includebinary is only a viable solution for a small number of resources that can all be loaded into memory.
I'm no expert in how Windows does memory managment, but from my observation, a 35 MB executable doesn't necessarily consume 35 MB memory.

For example, I made a small installer, where the PAK file is included as binary.

- on startup: only 4MB RAM consumption...
- ...until clicking Install & extracting the pak file: 39 MB
LJ
Enthusiast
Enthusiast
Posts: 177
Joined: Wed Apr 30, 2003 4:00 pm

Hmmm

Post by LJ »

Hmmm... I think in many cases it actually consumers more memory. Take for example a compiled .exe. Open it up with taskbar manager and you'll notice that the file in memory is in fact much larger because it loads in additional resources into memory to execute it. And as I said, my Suite has many .exe's that are loaded into memory, and then free'd when they are done, a true modular design to maximize memory efficency.

Look, at this point I don't want to keep going round and round about this. I think I've showed that the IncludeBinary command is only a solution for a very limited number of resources and then lacks some functionality because it's loaded into memory whereas Thininstall doesn't do this.

Your PAK file is an intriguing concept. You haven't explained enough about it for me to assertain if this is a viable solution. Can you go to the Thinstall web site and see Thinstall so you can actually see what it does? You can create an .exe out of an entire folder in about 30 seconds.

The only free program that duplicates this functionality is the one for Blitz DataPak by Terabit software that I posted above. Is there a way to modify your PAK program to duplicate the functionality of Thininstall and DataPak?
Post Reply