PureBasic Forums - English

sounds good noah!

heh another problem is: crackers sees decryption method, cracker has encrypted part, cracker crops the decryption instructions and then uses at the encrypted part..
That needs some protection, but its not the encrypters fault..
how fast is your algorithm?

Rescator is right in somehow.. But its easier for purebasic not to have the big protection than it is for several other software.. If i look at myself, i dont mind using cracked software.. eh i mean i dont mind that my friends uses it of course i never use it myself and im very sure you also dont have any unlegal software/games around you
but i bought purebasic. Before i bought it i even found an registered version on the internet, but i dropped it and bought it. Its something else.. A game is for playing for you alone maybe with some friends, and they often sells at high prices.. Purebasic is more value for money, and it keeps gettin updated for free! forum is great.. Of course some unlegal users has been around here, but who cares about that..
Also purebasic allows _you_ to develop something.. Weird enough i always buy the programs i use to develop things with.. Programming tools etc.. I havent developed any programs using unlegal developer tools! yeah i even have a copy of ms visualstudio.net here

well i have been playing with some anti-piracy stuff.. Mostly disassebler protection but also some debugger protection, crc checks, self modyfying(currently working on that.) and all that stuff..

enough of this writing, i must get back to my organic chemistry homework

Would you pay those 10.000 anyway ?

Going serious: Does anyone think about using hardware ids for securing also? (generate keys using a harddrive unique id for example) and such things.

I got an EX friend that was developing those LAME (very lame in my opinion) usb dungles (or how ever you spell those e-keys), HA! he was like "hu you cant crack this, no one will do, we will earn millions!" Still he hasnt sent me 1 of them, because I challenged him, as in one point his stupid dungle would parse some valius INFO and bang! thats it. but still no... hes chicken. He also said "if you try to open it, all the data will be erased" that chimp soldering eproms thinks a cracker needs to open his poor dungle ??? no way (and by the way that "if you open it erases" it might be a simple pull-ping! like grenades, yes, like that, and its the easyest way, of course he took that way). He doesnt really have the technology not the money for developing the most secure electronic key ever... I remember he was asking me for serials of programs like photoshop, that day I knew who he was (a rat). And what would you expect from someone like him?...

ANYWAY I dont think this e-keys are secure, an algorithm can be 10 times more secure than that (of course it complements, yes it does, but again, NO). You know that kind of people.. they say "its impossible to do this, its impossible to do the other" etc... they drive me sick.

thefool: RAT I'm a game developer, you should be punished for your way of thinking!! But lets see if god exists

/me waits for eternity
, seriously though.

If I ever see you playing any of my games for free.. I will first say thanks for playing and later you'll be dead, laugthing because im planning to release a freeware title - But commercial projects are there in the go, we'll see :roll:

hehe

you are even threatning me with god
now if he comes and punish me i dont hope the computer god is bill gates as i bet that some people thinks

Well its my way of thinking
i didnt say that all the games i play are cracked.. i own halflife 2
for instance.

hehe freeware games are nice enough i like them.


now about the dongels: All protections can be avoided. Dongles are usually using these 2 methods:

1: An important part of the software is on the actual dongle.
2: Software just checks if dongle is ok then continiues.

both ways can be cracked. For method 2 there is single bypass and that stuff.
For both 1&2 crackers can get dongle data out of it and then emulate the dongle.


all protections can be avoided somehow. Also hardware keys does _not_ matter if the cracker simply bypases the check. so how to avoid the check bypass/redirection/rewrite: no methods.. But it can be made more difficult! For instance if we use Noahs lib to encrypt the protection routine then uses self modyfying code to Decrypt that place at runtime, it gets more secure. More ways than that of course.!

by the way it doesnt help to encrypt everything then decrypt at program start.. you need to encrypt specific app places etc, even better only decrypt a line at a time. Why? there is nice apps as memory dumpers

so write an self mod-code that decrypts a single line at a time, and even have those lines mixed around other junk/working code that are real working instructions will absolutely make it more difficult. Also check the checks and have more checks than cracker expects.
and do NOT when a serial is not correct write "Serial incorrect. Please try again".!! IF you do it, then ENCRYPT the text messages! You dont even have to encrypt rest of the text in the program, but encrypt the reg routine text & some other junk text (junk text so they will not just know its the reg routine text thats encrypted) etc..
best thing and most annoying for cracker: NO good/bad serial messages! just a "please restart program" message! thats the best way i think. then change in about box text to "registered" or so ALSO encrypted i know cracker maybe will find out but at least its better!


if you get a good idea well send the exe to me and ill test it. I know im not a good cracker, but at least im good enough to test it for a lot "n00b crackers" ... Of course i wont distribute anything etc etc and no im not cracking any pro apps and no im not distributing an unlegal version of purebasic because i play cracked games

and no i wont crack your games even if they come as shareware
or at least i wont distribute a crack
[joking ]

If you only encrypt the vital parts, then you (as badass cracker in this case. but in reallife, game stealing rat ) already got a pointer of where to look at even if you have trash at there, the important routines are encrypted and thats where they should look forward.

I think this is a whole dilemma -and I like it- but maybe all this trickery, could get better, with just a little quote of imagination.

ohHhhhh forgot to mention, what about remote databases? and you only offer online registration (no phone crap, thats the way they crack now many programs). and validate key on remote server.... but it should be VERY secure I imagine...

remove online registration routine & remove the check..
or just remove check in first place.

but of course it could scare of some crackers, that it tries to connect..

ok i know that if you only ecrypt vital parts you got a pointer.. but idea was that then whenever you try to take a memory dumb, you cant get that part.

well at least you should NOT decrypt all at same time..

The badass cracker rat, thats me
nah really im not that bad... Im not the one cracking games/programs
and even if i download a crack i always try first myself
i have only sucessfully cracked 2-3 shareware prgorams and not the big ones.. im not that bad.. really

edit: well i only use legal software now

You already signed your entrance to the jail with that

I mean checking the keys -validating- server-side, not client-side, what about that.

I woudlnt like to add fake connections in my applications, as someone might think its adware/spyware! (and I certainly HATE spyware and all that crap!). I might yes programm something that would tell me the interests of my customers, but keep it private (and maybe even tell them if possible, about this). but spyware no way.

The problem with all protection systems is that the program need to be able to verify itself, or able to decrypt itself or parts of it self.
Or as mentioned, modify itself.

It's strength is also it's weakness. The method to decrypt etc. is THERE,
in the software. all a cracker need to do is bypass or reverse engineer it.
Or trick it or emulate it.

The systems that truly work well (and is insanely hard to crack/circumvent)
are usually so sluggish (due to all the security/encryption stuff).
They are unstable (anything remotely suspicious can trigger them).
If they tied into the hardware you might end up with a headache each time you change hardware. Or want to use it on your laptop etc.

At the top of my head the only truly secure method against cracking in any form,
is remote applications.
I.e. you login remotely and run the program on a secure server,
the program is never ever run on your system,
nor can it be "downloaded".
Obviously, hardly anyone would use such software, it's way to inconvenient.

As I said earlier, good protection is a lot of work and expensive.
And not really worth the effort (in my eyes).
So my method/idea described in a post above somewhere plus a standard
entering of the serial into the program.
(the program won't really do anything fancy with it, just for update checks
and thinks like that, i.e the app won't poke the net without the user having allowed it first.
(i.e manual or automatic updates etc)

The application serial + user login & pass would be enough.
The server/database would after the user login/authenticate,
check that the serial is valid/registered, and then allow the update.
Fake serials won't work as I said earlier, there only exist as many application serials as there are buyers of that application.
The serials won't be anything fancy either,
just a serial/product id. Maybe like:

00000001-20050225-00000001

In this example, the first is a 32bit hex indication of what application it is, (product id)
then the date the serial/app was registered or bought.
(in this case year month day)
and finaly the "serial"

This example serial is very simple, it basically allows the server to see that
this is product 1, bought on the 25th February 2005, and that this serial was the 1st one bought on that day.
The database also has this cross-referenced to user 0000000001 or something.
There is no way to fake these serials as they are made at buy time only.
(confirmed purchase) and is only used as a proof of purchase in the database.

The program will pass along the serial each time a update is done,
along with the user login and pass. (just like when you update PureBasic for example).

Most likely a lot of crackers will try to disable the entering for a serial.
Which is pointless as the software doesn't really check it at all
Other crackers may disable the updating.
Which kinda is silly (except for ensuring they don't accidentaly get "caught" when trying to update

Most likely (and really the only way to "crack" this) is that somebody
who IS a original byer and registered user pass around HIS copy.

Some of you might think. "OOh, we could make custom versions with a embed/secret tracking id"
Yeah you could, but most likely crackers etc would catch on to that quickly and just hack that part of the software replacing it with some fake id instead. so instead of catching the "bad" users you will only be able to follow the migration of it around the net instead.

Also, if crackers does make a keygen that on accident happen to match
a real serial. it is very easy to catch that.
First of all, the ones using the fake id (if it happens to match at all that is)
won't be able to do updates or get extra content since they have no user account at all.
Even if they did have a user account, the database/server knows that THEY aren't the rightful owner of the serial,
and will raise a warning flag localy, and also BAN that ip semi-temporarily.
And make sure the person knows that he/she has been "caught" as well,
and their account would be disabled along with all their serials if any.

The thing is, you could sell full boxed versions.
And also have a super simple variation available for download.
But once a serial has been bought the user can just use the updater
and get the full app and all extras.

dagcrack wrote:Going serious: Does anyone think about using hardware ids for securing also? (generate keys using a harddrive unique id for example) and such things.

Mine is machine dependant, as well as user dependant. I use ID's from
lots of places. Including the usersID and the computerID ..

As for the fools decrypting/cracking thought. The output of the algorythm
is different every time it is run.

- np

PB wrote:> At the top of my head the only truly secure method against cracking in
> any form, is remote applications. I.e. you login remotely and run the
> program on a secure server, the program is never ever run on your
> system, nor can it be "downloaded"

This is not a solution because I've seen "loaders" that modify the app in
memory, so running it from a remote location doesn't protect against that.

The only true form of security. Is no security.

Do not realease a fully functional application, unless they pay for it..

* limit how many records it can hold
* hinder it in some fashion
* make it not be able to export the data
* etc...

You will basically have two apps, the 'demo version' .. and the full version.

Trials usually never work.

- np

I didn't mean running it "from" a remote location,
I ment running it "at" a remote location.
Ala. VNC or Microsoft Remote Desktop etc.

That is the only perfect (altough that can be disgussed I guess) solution,
as the program is never on the client computer, disk nor memory.

Personaly I would never use a software that required such a use tough.
Another alternative (depending on what the software does obviously)
Is to just have a webpage the user log into, and "use" the program that way.
Thru a variety of php scripts, or possibly custom cgi programs.

> I didn't mean running it "from" a remote location,
> I ment running it "at" a remote location.
> Ala. VNC or Microsoft Remote Desktop etc.

So if I wanted to edit a Word document I'd have to do it remotely? Nah, that
would NEVER work. Too many issues to wreck it (ISP down, modem breaks,
too slow due to network lag, security concerns, etc). Not a workable solution.

*scratches his head* um.. PB did your post a bit up sorta vanish?
I can see NoahPhense quoting you but I'll be damned if I can't see the post. *laughs*

> PB did your post a bit up sorta vanish?

I deleted it but he replied just before I did.