Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Can Crack Your App With Just A Shell (And How To Stop Me)

kswizz.com

Post reply on HN
Print view View original

51–60 of 93 posts

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#51

Post by jared314 »

muppetman wrote: post #46
snorkel wrote: post #20

The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were…

Forgive my numbness, but how does this work? How do you know the right signature to be verifying against? It seems (to my not-much-of-a-programmer mind) that you've got a chicken and egg scenario here. But that's obviously not the case, so you can explain briefly how it works? Or just paste a link. Thanks!

You move the UI messages into a separate resource file, as you would for language translation. The executable signature is unaffected by the changed UI messages.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#53

Post by phillco »

snorkel wrote: post #20

The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were…

Brilliant, but be careful about this. There was an article here years ago about an indie game developer who put tons of different piracy checks all throughout his game. He was pretty clever, and made it so that several didn't activate until partway through the levels — that way the crackers might miss them. Also, he didn't show any "pirated copy detected!" messages, which would have made the checks trivial to find. Instead, the application would simply crash with a cryptic error message.

It worked perfectly — the crackers missed the later checks. Anyone who torrented the game found that it crashed reliably as soon as you completed the first level. Game over.

Unfortunately, this did not generate the kind of PR he was hoping for. In fact, all this did was give the impression to everyone who pirated the game that it was a buggy piece of shit. Since there was no obvious reason for the odd behavior, they assumed it was the fault of the application. They stormed the gaming review forums and discussion boards, complaining about how the game was "shitty" and "unplayable". Nobody was keen to mention that they had pirated it, so there wasn't an obvious trend. At the time, the ratio of pirated video games to legal ones was about 10:1, so the bad feedback overpowered the good feedback by about 10:1. He was ruined.

Be careful about anti-piracy. You just might succeed.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#54

Post by Kilimanjaro »

Price your app exactly at a point where people with money will gladly pay for it instead of suffer the hassle of downloading crapware-infested copies. And let people without money copy it freely without barriers, and see it as a marketing tool so everybody use your app, not your competitor's.

That price usually is between $0.99 and $9.99 and thank Apple for showing us that lesson.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#55

Post by morganpyne »

morganpyne wrote: post #15

Another fairly easy way to do this kind of thing is to use the DYLD_INSERT_LIBRARIES variable. You can reverse engineer the classnames with class-dump, subclass a class and override a suitable function e.g. IsLicenseValid() to just return true; You can then start your program and insert your new subclassed class into it like this: $ DYLD_INSERT_LIBRARIES=/path/to/your/Subclassedlibrary.dylib arch -i386 /Applications/…

A quick correction/clarification on the above technique for anybody wondering how this works from my poor explanation.

- I should not have written 'sub-classing'; this technique works by actually extending an existing class (Objective C allows you to extend a class)

- AFAIK this technique only works with Objective-C based apps.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#57

Post by daeken »

EGreg wrote: post #41

I personally like the idea of an application "unlocking" itself every time based on a hash of its binary. You would have to find all the places these hashes are computed -- if you missed even one place, you wouldn't be able to unlock the app. Of course, such an app could still be cracked -- as could any app... because all you have to do is 1) purchase a legitimate copy and enter a fake name 2) take a snapshot of a wo…

> The only way to really prevent cracking of apps that run locally is either challenge-response dongles ...

This doesn't really work. If you have all of the functionality running on your machine but the dongle is there to authenticate, it can be cracked by ripping out the code that does the challenges. The proper way to secure an app using a dongle is to move some key piece of functionality out to hardware instead.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#58

Post by coderdude »

burgerbrain wrote: post #37
TheAmazingIdiot wrote: post #31

Earlier quoted context omitted.

No. Effective means of protection are when you "roach motel" the data. The first rule of software engineering is you never let the shareware stuff do it all. Test version should not save? Rip it out. Shouldn't print? Remove printing. Chop it out wholesale. If you do an unlocking scheme, then make it subtle. Take a hint from Unix development: dont tell the user that the code worked or not. Just take the code or whatev…

"And if it's in the blacklist, don't tell the user at all, and instead start introducing subtle errors everywhere. "What, you saved it yesterday and now it doesn't open? Whoops (snicker)." Or, misalign printing so anything looks good for a draft but not 'professional' use. Or you could go the obvious route of slapping a banner on it, but that is usually easily removable" "Gee, I'm sure glad I decided to pirate [progr…

Spyro: Year of the Dragon used a similar technique to great avail. Don't be so quick to dismiss this method of deterring crackers. It just needs to be done right. There are arguments going both ways on this issue so it's simply not black and white. Perhaps it works better for games than applications, but again, you'll find arguments going both ways for games and apps alike.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#59

Post by coderdude »

phillco wrote: post #53
snorkel wrote: post #20

The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were…

Brilliant, but be careful about this. There was an article here years ago about an indie game developer who put tons of different piracy checks all throughout his game. He was pretty clever, and made it so that several didn't activate until partway through the levels — that way the crackers might miss them. Also, he didn't show any "pirated copy detected!" messages, which would have made the checks trivial to find. I…

I mentioned this game in another comment on this page, but Spyro: Year of the Dragon used this technique and it worked very well for them. It could be that this is because it was on a console and not on the PC, but who knows. The goal for them was to simply keep the crackers at bay for as long as possible to keep the sales high during the initial release of the game. The developers stated that once the game is cracked the sales drop dramatically, so the longer they can keep the game uncracked the more money they made.

Great article from the developers about this: http://www.gamasutra.com/view/feature/3030/keeping_the_pirat...

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#60

Post by btn »

phillco wrote: post #53
snorkel wrote: post #20

The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were…

Brilliant, but be careful about this. There was an article here years ago about an indie game developer who put tons of different piracy checks all throughout his game. He was pretty clever, and made it so that several didn't activate until partway through the levels — that way the crackers might miss them. Also, he didn't show any "pirated copy detected!" messages, which would have made the checks trivial to find. I…

A similar (but much simpler) anti-piracy feature was built into Command & Conquer: Red Alert 2. The game would appear to operate normally, and let you start playing; however, after 30 seconds, all of your buildings would explode and you'd instantly lose.
Post reply on HN