Nick,
Trying to reverse-engineer the private key is out of the question - no
hacker/cracker would be that stupid.
A much easier route is to use ildasm to disassemble your app, patch it in
the appropriate place and then ilasm it back into a normal (not
strong-named) assembly, which is then distributed. You can try to get around
this by creating a separate licensing assembly and then strong-naming both
of your assemblies and linking them together so that your licensing assembly
can be called only by your app. So then the cracker might need to
ildasm/ilasm both of your assemblies.
The assembly metadata that .NET provides makes reverse-engineering code a
relatively simple exercise. Even using a code obfuscator won't help you much
if all the cracker has to patch is the licensing part of your code.
least. <<
It only needs a single cracker to break your scheme and distribute a cracked
program for everyone else to use. Windows XP activation, for instance, was
cracked within hours of the RTM being available.
anyone else with the task, even if they are "godlike" programmers. <<
You are correct in not trusting some of the commercial copy protection
schemes, which are pure snake oil. But if you think that you can do better
than, say, a team of specialists who've studied this area for years, then
you're just peddling snake oil yourself.
Regards,
Mark
--
Author of "Comprehensive VB .NET Debugging"
http://www.apress.com/book/bookDisplay.html?bID=128
Nak said:
The strength of the encryption isn't the issue here - as you say, RSA is
fine. The problem is how to keep secure the key that you're using to decrypt
the data. The only really secure way to do this is via some sort of
activation scheme involving a remote server.
Aaah, that's were you haven't seen the whole point. It doesn't matter if
someone sees the decrypted data, the whole point is that none else will be
able to make a license file that can be decrypted with my public key. It
isn't possible to simply find the matching key if you have one of the is it?
Not that *I* am aware of anyway.
I had thought about that, but the idea is that when someone purchases
software, I would send them a license file encrypted with *my* private key,
only files encrypted with this key can be decrypted my the application. You
might be thinking that someone could simply crack the program to change the
key that is used to decrypt with, but that would cause my application to
fail as it is "strong named".
I know that *no* software is safe, even with a hardware dongle; software has
been cracked with ease/ But just by adding several layers it fends off the
less able crackers at least. One thing I'm not doing is buying a 3rd party
product, I wouldn't trust anyone else with the task, even if they are
"godlike" programmers.
The finny thing is that Microsoft PA is not a bad way of protecting
software, except for the fact that if you change your hardware configuration
beyond a certain threshold they will de-activate your software. This has
happened to myself before after changing and adding a few components, even
though I have an DELL OEM copy of XP that doesn't need activating my myself.
There are *some* protection software out there that employs similar methods
to PA and they use a points based method, if you change a major piece of
hardware more points are put towards the license being invoked, changing a
hard drive for example would add only a small number of points.
As one wise man once said, "It's all a load of bollocks!"
Nick.
--
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
"No matter. Whatever the outcome, you are changed."
Fergus - September 5th 2003
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
