Friday, August 12, 2011

Keeping Pirates at Bay

Anti-Debug, Anti-Cracking, Anti-Trace.  Call it what you will, it’s all about protecting users, ideas and income.

StrokePlay Pro exists because I’m a developer who wants to earn his living developing software that people want to use.  To do that I need to be able to charge for a license.

Hackers and pirates, through their illegal actions, have the potential to stop that from happening. 

They also have the potential to harm users PC’s.  By cracking open software and altering it to remove licensing restrictions they’re also free to insert anything they like. Cracked software is a backdoor to your PC and everything on it.

So, what to do?

There would appear to be two schools of thought on this one.  Either spend a lot of time building numerous countermeasures into your software and, perhaps, use a commercial protection product like Themida, or build two versions of your software, a free trial version and a purchased version.  The free trial version is normally limited in some way and has some code removed or altered.

I’m in the latter camp.  StrokePlay Pro will be offered as a free trial version and a purchased version.  The free trial will have some data limits, a nag screen after 30 days of use and will have some minor feature limitations.  By doing this I reduce the need to spend a massive amount of time protecting the software and can spend more time on new and enhanced features for my paid users.  I’ll include targeted countermeasures which will change from release to release.

Once you realise that you can’t keep a determined cracker out you can change focus to making the software a pain in the neck to crack.  You can also rotate countermeasures from release to release meaning the cracker has to rework every single version to keep up with new features.

For those of you out there who are looking at this topic right now here are some sources of information, as a starter, you might want to take a look at:

Websites

Security Best Practices for C++ (Microsoft)

Anti-Unpacker Tricks (Peter Ferrie) – Very useful PDF file.

Getting Information from Authenticode Signed Executables (Microsoft KB)

An Anti-Reverse Engineering Guide (Josh Jackson - The Code Project)

Windows Anti-Debug Reference (Nicolas Falliere, Symantec)

The Art of Unpacking (Mark Vincent Yason) – PDF file of an IBM presentation.

Books

Writing Secure Code (Michael Howard/David LeBlanc) – This one should be on everyone’s bookshelf.

Debugging Applications (John Robbins) – Another bookshelf essential.

Rootkits: Subverting the Windows Kernel (Greg Hoglund/Jamie Butler) – Fascinating background reading.

Applied Cryptography (Bruce Schneier) – Again, great background information to have at hand.

Others

Reversing : Secrets of Reverse Engineering (Eldad Eilam)This was recommended to me but I haven’t had a chance to obtain a copy yet.

2 comments:

Smart Company Software said...

Isn't this approach risky? How do you control what people do with your purchased version?

Patrick said...

Hello again :)

I think it definitely is risky but at the same time it puts trust in the people buying the software.

I think people are inherently good but I may well see the odd bad apple.

If someone buys the software and then starts distributing it to all and sundry they'll fall foul of some server side activation and update checks.

Similarly if someone buys it then goes for a refund and keeps using it there are some additional server side checks in place.

The anti-hacking code in StrokePlay changes on each release so it's never the same twice.

I'm never going to stop the determined hacker/cracker but I'll aim to make it as hard and annoying as possible.

In the end, this is something that'll always be around and I'm choosing to spend my time on what my users want rather than keeping out the odd one or two.

Time will tell if it's a good risk :)

Patrick