This posting is cut down version of the whole thread from a discussion took place towards the start of 2003.
Zaphekiah
One of my worries about .NET programs is that they are intrinsically easy to crack. I remember reading or seeing an interview with someone from Microsoft that said that a future release of .NET could include encryption that would help prevent this (I am not sure how it would work though -if the CLR can decrypt the exe then why couldn’t Jo Cracker?).
Still, has anyone else heard of this? Or does anyone know of a way to make compiled programs more secure?
Forum Admin
When I first started building ideaspad, I read about how .Net programs could easily be decompiled and this really worried me.
After much refinement I build all my programs using batch files. As the process if rather complicated and quite long.
First….
I’ve signed all my DLLs as I’ve got a check for updates feature. This checks the public key against those I have in a DLL and determines whether the files are genuine.
So in my batch file, I have to use SN.exe and turn off public keys…
Then I obfuscate my files…
Then I modify the files directly (using a tool I wrote).
Then I re-sign my exes….
Build my Setup project, based on the new exe and dll files…
Build my self extracting distrib files, using another tools I wrote, which sends keys to winzip etc…
Also, obfuscating makes it a lot more difficult to read the code if they were to decompile it.
So probably not impossible to crack (although what is) but a hell of a lot of work for a hacker.
Zaphekiah
Wow! This sounds like an excellent approach. I will certainly look in to doing something similar. Thanks for the pointers – I may need to come back to you for a couple more though.
Forum Admin
OK.
Another point worth mentioning in relation to your initial posting.
Even if MS did bring out a new security feature, most likely it would require a new framework version or some sort of extra download.
I’m firmly against upgrading to 2003 version as we’d be back at square one. We’ve already got problems with people not having the framework downloaded, let alone having the latest version.
I’m quite happy with VB.Net Standard 2002.
I’ve done a great deal of reading on anti-crack over the last year, of which there’s not a lot of DotNet related stuff.
But there’s one point which I do believe, that is, even if you do get cracked, so what, at least someone who knows quite a bit about software thinks your program is worth enough to spend time cracking it.
I could right a book….
One of the best ideas I’ve read, if someone has cracked your software. Download the crack, screw it up, upload it. Gives the hacker a bad name…
Zaphekiah
Hahaha… I like that Idea. I still worry about the insecurity of the code though – that someone could compile a version that misses out the registration step, or simply nick the code. That is why I am so interested in the suggestions you made about security.
Forum Admin
So what security have you got at the moment?
Obfuscate yeah??
Look at it as a marketing outlet, you aint gonna beat them!
Do you pay for your registration service?
If you do it yourself, have you backup sites?
Zaphekiah
This is going to sound really naive, but at the moment I don’t have much security..I didn’t even know those tools were out there until now. Do you use or can you recommend a particular obfuscation tool?
Forum Admin
You can buy Obfuscating tools, there’s supposed to be some really good up-to-date ones.
But I went for a free command line tool.
I use QNDObfuscate from Desaware Inc.
Let me know if you have trouble finding the web address.
I’ve found it :-
http://www.desaware.com/obfuscator.htm
http://www.desaware.com/downloadsqndl2.htm
Zaphekiah
Thanks for the link. I downloaded the Desaware program and had a little play with it, but without much success. I thought I had better check I was using it right, as it didn’t come with much documentation.
I am using it from the command line with two arguments: the address of an exe I want to obfuscate, and the new address for the output file. When I run it, it produces an exe, but the exe won’t run (I get a null reference exception). Are you supposed to run the program on a compiled exe, or pre compilation?
Any suggestions would be appreciated!
Forum Admin
I don’t think it should cause you any problems…
Erm..
I compile each of my programs / dlls from the command line, in release build mode…
Then, because I have strong names all my files…
I turn off validation of public keys using sn for each
Then obfuscate each of my programs / dlls (after it has been compiled).
I’m not sure why, but I’m copying one of my dll’s into the Executable directory…
Then I obfuscate my main program exe.
Then I re-sign everything using sn.
If your still having trouble send my your growing batch file.
Zaphekiah
Thanks for the offer and suggestions. I have ordered Dan Appleman’s e-book on the subject, so I will see what the great man has to say and how the desaware obfuscator actually works.
By the way, the only obfuscator I could find for .NET was the Aspose obfuscator, which retails at $99 for the basic version.
Forum Admin
So did you get it to work?
Zaphekiah
I got the utility to work with a couple of the more simple programs, but not the others. They have a few features which might prove difficult for obfuscators: external dlls, calls on webservices and unsafe code blocks.
I haven’t had time to look at the Appleman book yet, and it is a bit maddening.
Aspose, I got their program to obfuscate some of my executables and they seem pretty on the ball re support. (They even sent me a help manual!). If it turns out I can do it all with their tool I might just throw a hundred bucks at them as a stop gap. I am really looking forward to getting my teeth into the Appleman book though, at some point in the next couple of weeks. I will just have to see what comes together first.
Forum Admin
Now that I think about it, I’m not sure whether I didn’t get some error myself.
I’m not sure whether this would work, but you could try using a debug build exe, maybe then you could trace which bits are causing the problems.
Zaphekiah
OK…sorry it has taken a little while to get back to this thread. I read through the Appleman book (the ebook download from Desaware) and it helped me sort out what was going wrong. Basically this obfuscation technique works in a novel way, because it doesn’t scramble the IL code which is contained in the exe, instead it replaces strings in the “string heap” in the exe.
I don’t know how much you know about this, but I didn’t know anything about it until I read this book.
If anyone puts the code through a decompiler the result is also pretty unreadable, because all variable and class names look the same.
Public names don’t get replaced, as this could obviously cause other components to crash. That is OK though, because in an exe you don’t really need any public methods, internal (friend) scope is fine.
Anyway, it is working now, so that is great. It is a bit of a hassle with distribution, because you have to obfuscate the assembly and then juggle a bit with the files used by the deployment project. I think that batch files are definitely the way to go there.
Well, I feel it was worth me joining this forum just for this insight it has given me into obfuscation – if any other members read this then I would definitely recommend Desaware’s approach to obfuscation.
axsaxs
Instead of using batch files to compile, obfuscate and sign you can use Nant.
http://nant.sourceforge.net
Forum Admin wrote:
But there’s one point which I do believe, that is, even if you do get cracked, so what, at least someone who knows quite a bit about software thinks your program is worth enough to spend time cracking it. |
|
Well, I was quite happy when I found one version (old!) of Folder Crypt cracked on a pirate site.
At that time I had on another product a real time hashing check (when the program run it checked random if its hash code was the same as the one saved in an obscure registry key… if not, it quit).
I abandoned that security check. I prefer to have cracked version of my products available for hackers.
I think they “make” the market …
webber
anybody have an example of using batch file to process applemans obfuscator ?
and/Or
help file for using ASPose license tool and obfuscator ?
Forum Admin
Its simple.
QNDObfuscate.exe ProgInput.exe Prog.exe
High quality fashion jewellery at a reasonable price!
by JM