Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Can Crack Your App With Just A Shell (And How To Stop Me)

kswizz.com

Post reply on HN
Print view View original

71–80 of 93 posts

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#71

Post by yuhong »

moopark wrote: post #47

The fact that most simple copy protection can be broken by someone that knows a bit of assembly shouldn't surprise anyone writing applications, and this post is just self-congratulatory silliness that doesn't actually help someone that wants to protect their software. It wouldn't be any more responsible/ethical/useful of me to post a "I Can Crack Your Non-Mac App With Just A Copy Of IDA Pro and HexRays" tutorial. I c…

The fact that PT_DENY_ATTACH can be easily patched by modifying the xnu source code made me wonder about the politics of open source inside Apple.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#72

Post by yuhong »

bermanoid wrote: post #64

The great danger in the fight against piracy is that it's so damn interesting . You can spend months playing cat and mouse with the people trying to crack your schemes, ratcheting up the complexity to insane levels, and every time you come up with a new scheme and get it working you'll feel like a million bucks because you Won(tm). But the people on the other side feel the same way, there are more of them, and in rea…

Yea, artificial scarcity is fundamentally flawed. I even wrote a series about the various attempts on my blog.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#74

Post by pygy_ »

huhtenberg wrote: post #65
pygy_ wrote: post #44

Earlier quoted context omitted.

Subtly crippling the app may not be the wisest move, unless you make it obvious that it happens because the crack has been detected. Otherwise, the pirates will get the impression that your program is buggy and will look at alternatives rather than opening their wallet. And still... Even if you announce that the crack has been discovered before crippling, you may upset them and send them to your rivals anyway. ==> Po…

As someone who has been down this path I can offer a couple of comments. 1. Crashing or crippling the program indeed has an obvious negative PR side-effect. However it can be mitigated by inducing a very exotic crash, something like "Division by zero" or better yet - "Illegal Instruction", which would clearly point at mangled code being at fault. Also stick a thread titled "Illegal Instruction" in Support forums, exp…

"Division by zero" and "illegal instruction" don't sound exactly exotic. And even with a proper error message, a crshy app is perceived as defective. Assuming that the users will google the message is a long shot. I'd assume that most would simply show your binary the trash can / recycle bin / dev/null and move on.

Your second strategy sounds very interesting. Especially because you can A/B test the licensing period and the text that prompt users to register even in people who have been using the trial version for a long time.

However, I don't understand how it helps paying customers.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#75

Post by mike-cardwell »

phillco wrote: post #53
snorkel wrote: post #20

The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were…

Brilliant, but be careful about this. There was an article here years ago about an indie game developer who put tons of different piracy checks all throughout his game. He was pretty clever, and made it so that several didn't activate until partway through the levels — that way the crackers might miss them. Also, he didn't show any "pirated copy detected!" messages, which would have made the checks trivial to find. I…

If lots of games used similar methodologies then people would slowly learn that "pirated game" == "buggy game". Wouldn't work unless lots of them did the same thing of course.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#77

Post by ZoFreX »

snorkel wrote: post #20

The most stealth cracking countermeasure I ever witnessed was the application would XOR some of its UI messages with the hash sig of the application binary file, so if you edited the application binary file directly the crack seemed to work just fine ... but then the application would gradually go insane. The cracker who finally posted a working crack was impressed with how simple and devious the countermeasures were…

Why bother with stealth? My favourite approach is the Microsoft approach. It pops up, says "I'm cracked, click here", which takes the user to a web page that shows them all the benefits they'll reap if they get a legit version, just type your credit card number in this box and all is forgiven. It's hilariously easy to make your installation legal, which is the point... it's easier than pirating it, AND you get benefits.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#78

Post by lelele »

huhtenberg wrote: post #65
pygy_ wrote: post #44

Earlier quoted context omitted.

Subtly crippling the app may not be the wisest move, unless you make it obvious that it happens because the crack has been detected. Otherwise, the pirates will get the impression that your program is buggy and will look at alternatives rather than opening their wallet. And still... Even if you announce that the crack has been discovered before crippling, you may upset them and send them to your rivals anyway. ==> Po…

As someone who has been down this path I can offer a couple of comments. 1. Crashing or crippling the program indeed has an obvious negative PR side-effect. However it can be mitigated by inducing a very exotic crash, something like "Division by zero" or better yet - "Illegal Instruction", which would clearly point at mangled code being at fault. Also stick a thread titled "Illegal Instruction" in Support forums, exp…

> What worked for one of my projects was to allow multiple consecutive trials.

Awesome. I have always been annoyed at shareware who refused to run after a given time. I sometimes installed it just out of curiosity, then forgotten about it, then came back to it when I had a real need for it and a chance to really think whether to buy it or not and just then... it refused working.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#79

Post by Vlasta »

bermanoid wrote: post #64

The great danger in the fight against piracy is that it's so damn interesting . You can spend months playing cat and mouse with the people trying to crack your schemes, ratcheting up the complexity to insane levels, and every time you come up with a new scheme and get it working you'll feel like a million bucks because you Won(tm). But the people on the other side feel the same way, there are more of them, and in rea…

Agree, playing hide and seek with crackers is waste of time. I decided to make the anti-piracy protection trivial in the latest version of my software. I just wrote a installation date into an .ini file.

I want customers that love the software and are happy to pay the price I ask. Software piracy can be solved by social means, not technical means.

Re: I Can Crack Your App With Just A Shell (And How To Stop Me)

#80

Post by steveklabnik »

mike-cardwell wrote: post #75
phillco wrote: post #53

Earlier quoted context omitted.

Brilliant, but be careful about this. There was an article here years ago about an indie game developer who put tons of different piracy checks all throughout his game. He was pretty clever, and made it so that several didn't activate until partway through the levels — that way the crackers might miss them. Also, he didn't show any "pirated copy detected!" messages, which would have made the checks trivial to find. I…

If lots of games used similar methodologies then people would slowly learn that "pirated game" == "buggy game". Wouldn't work unless lots of them did the same thing of course.

No, they don't have anything to compare it with. They'd never figure out that it's because stuff is pirated.
Post reply on HN