What is the best software protection?

Hello!

Please tell me, what is the best software protection known now? Is this Sentinel dongle, or Aladdin HASP, or Shlumburger Java cards or... whatever?

WBR,
FractalizeR

[ArC]

XTREME-PROTECTOR

Ring-0 Protection Code
Patching Engine
References Engine
Trail Engine
etc....

[Squidge]

Also, don't forget the Instability engine

AsProtect & Armadillo are good protections *IF* you use them correctly (ie. not just run your program through them - use their API and interleave the protector with your code).

in my opinion code-lock would be quite good too, if you code your apps in vb. because it's still not cracked.

just look at this one: hoop://www.rtsoftware.org/challenge.php

Thanks to all for answers.
But please ArC and Squidge post links please to these engines.

And please tell me the following.

Assume, the program is protected by whatever SW protection like Armadillo and ASProtect, bought officially and is registered on certain computer. Assume then, that the user, bought the program is a hacker. As he bought the program oficially, so, he has all decryption keys for the program and theoretically he has study, how the protector is working (for ex. by downloading protector's trial version) and then unwrap an application using keys, oficially purchased.

If al above is right, then, cracking the program protected by SW protectors is only a task of time and hacker's brain. Nobody can prevent hacker from dumping application's memory. He can used also hardware ways to do this as I know.

This also is about simple wrapping application by Alladin HASP.

I am not a security specialist, I am guided only by logic, but is all I said right?
So, the only way for an application is to use pure encrypted information for whatever, that must be decrypted by a dongle, which dump can't be read? Because CopyMem II protection in Aramdillo can't be considered uncrackable, because if decryption keys are known, it is no problem for a hacker to decrypt certain memory pages....

[Squidge]

What you say is correct - you can never stop a hacker that has bought a copy of your program from being able to release a version stripped of the protection regardless of whether it is protected by a software program (eg. AsProtect) or hardware device (eg. dongle).

However, what you can do is make there cracking more difficult, and hope that they will give up and hack something else instead. ASProtect contains many routines to do this, but they don't seem to be ever used (authors only seem to use the examples provided with the protector, which the hackers also have, so can easily work around them).

What you need to do is study the protector of your choice and see exactly what can be accomplished. For example, in ASProtect you can do multiple calls into your application before you reach the starting address of your code, such as initialise critical variables and the like. You can also use calls embedded in your code to ensure asprotect is still launching your code and it's not be stripped.

However, even with all these features, it's still just a matter of time before being hacked and distributed. The only thing that stops this is that if your program is specialist app that not many people want, then crackers normally don't bother as they will not get recognition for it (as no-one is interested in the app that they have cracked, so doesn't get distributed as quickly/as wide).

About Armadillo: CopyMem-II has some serious weaknesses, and due to these weaknesses, it's easy to decrypt the entire program without knowing the encryption key unless you protect the program using a custom certificate (so there's no demo version of your program available).

[dj-siba]

by concept; every protection is breackable... it's just a question of time!

but as new as i am, i may choose XTREME-PROTECTOR & ASProtect and add my own stuff to it...

Regards

Ok boys. Why do you didn't tell the boy the truth?
One thing was correct. ASProtect is very good protection. But Armadillo? Are you serious? Its possible create correct license keys for protected application without correct license keys. Otherwise say is possible create keygenerator for protected application. No dumping, no IT rebuilding and etc. Just pure and nice keygen. Is it good protection? No, its not.

ASProtect is very good protection. Yes, but with one big problem. If someone uses it correctly then its good protection. Otherwise is not problem unpack it because its possible find automatic tools for it or many tutorials how do it yourself.

Something about dongles. I tested latest HASP wrapper and it is very simple for unpack. I didn't find automatic tool for it, but if someone used only wrapper without API calls inside of protected application then for cracker with correct dongle its maybe 5 minutes for unpack it.

XProtector is nice protection too. But its doesn't have many features like other commercial products. I don't like some other things about it (compatibility problems, big loader and other things). But here is not automatic tool for it.

I think here are other good protections too. They are not famous like ASProtect, but they are good and maybe its better if they are not famous like AS... (you know why!).

PELock is very nice protection. Simple for use but very good. Like other protection has some problems. Here is tutorial how unpack latest version and I have automatic tool for it. Web site is: pelock.pac.pl One of the biggest problems of this protection is there wasn't update for long time (official).

SVKP is very nice protection too. It has some features which doesn't have famous ASProtect. I found only one tutorial how unpack SEPP, but it was for very old version. It was used for nice games Chaser and Gothic2 which is mark of quality of product. Its possible use dongles (I thinkl very good dongles from their description). No other protection like ASProtect, PELock or Armadillo can use dongles. I didn't find automatic tool for it. Of course its possible crack it like ASProtect and other protections.

Its very hard to say which protection is the best. I don't know. Its possible only say which protection is better than other and what is better for one protection than other. Then please boys don't write stupid posts. Please ....

[ArC]

Anti wrote:

XProtector is nice protection too. But its doesn't have many features like other commercial products. I don't like some other things about it (compatibility problems, big loader and other things). But here is not automatic tool for it.

The versions before 1.05 were very feature limited.
But in version 1.05 they have added a lot of new features like hardware-locked-licenses.

Also Xtreme-Protector has not been unpacked so far .
Neither by a cracker nor by an unpacker.

@Squidge:
What do you mean with "Instability engine" :?
For me it's working fine....
(Ok, I could not protect any command-line apps; but I can protect any other gui app w/0 probs)

At the moment Armadillo and Xtreme Protector seems to be the best choice. ASProtect has been almost totally defeated. Only last month I've cracked almost 10 apps protected with AsProtect 1.23 - but what i must admit is the truth: I'VE NEVER SEEN ASPROTECT USED PROPERLY (since I've been cracking it more than 50-60 times).

What would I do is to use one of them together with latest HASP or SENTINEL dongle. That should be hard enough to stop 95% of crackers. Pe Lock is quite good although executable protected with it is easy to dump, then reverse etc... I've tried version 1.06 (pelock.prv.pl).

HASP or SENTINEL standalone are REALLY EASY to crack. If someone couldn't crack it itself then he(she) should search the web. If he(she) couldn't still force it then he(she) is probably blind.

And about Code-Lock.... I've never had this software in hands - in this moment I'm downloading it and thinking who is so silly and wrote that Code-Lock hasn't been cracked since 3 years.... That's really IMPOSSIBLE and if someone really believe it then he(she) haven't anything common with cracking (or maybe for he(she) the time stopped 5-6 years ago). I've also officially contacted Code-Lock authors about the competition and described my rules (I won't show them how I cracked (hope I will) their program, I'll send them cracked version manually protected with me, etc.) - let's see if they will accept it.

And as I see, during the last years authors of commercial protectors became more and more shameless. They could do EVERYTHING to fool potential customers and earn few $. That's a fuc***g cheat.

Let's face these problems....
During 1-2 days I'll post here one of the latest protector disassembled and cracked. EXESHIELD. Why this one? Just read the introduction in help file and You'll understand (I mean these "sophisticated" techniques, etc.) why... That's not the only one I've dancing with but I won't publish all my work just to let commercial authors learning step by step how we (i assume You're with me ) are dealing with them and what they do wrong.

Ok. this discussion goes boring...

Greetings.

dxn@wp.pl

[Squidge]

Originally posted by anti
One thing was correct. ASProtect is very good protection. But Armadillo? Are you serious? Its possible create correct license keys for protected application without correct license keys. Otherwise say is possible create keygenerator for protected application. No dumping, no IT rebuilding and etc. Just pure and nice keygen. Is it good protection? No, its not.

Are you saying that an application protected with Armadillo that does not use the default certificate (so requires a key to run) is keygen-able ? I've never noticed this. Sure, it's keygenable once you have the program up and running (and so either have a valid key already, or a default certificate) but not when you don't have a key to use.

Originally posted by Squidge
Are you saying that an application protected with Armadillo that does not use the default certificate (so requires a key to run) is keygen-able ? I've never noticed this. Sure, it's keygenable once you have the program up and running (and so either have a valid key already, or a default certificate) but not when you don't have a key to use.

..r u sure?

[ArC]

Originally posted by Squidge
Are you saying that an application protected with Armadillo that does not use the default certificate (so requires a key to run) is keygen-able ? I've never noticed this. Sure, it's keygenable once you have the program up and running (and so either have a valid key already, or a default certificate) but not when you don't have a key to use.

Why is a program keygenable when you got a valid key for it?



If an app uses RSA 4096-bit for the serial validation you won't be able to keygen it even if you got a valid key for it....

Originally posted by ArC


Why is a program keygenable when you got a valid key for it?

thats a bullshit - u dont need it

If an app uses RSA 4096-bit for the serial validation you won't be able to keygen it even if you got a valid key for it....

if app use rsa (more than 512) and its good implemented, u loose

no chance do a keygen without exponents patching

[ArC]

Yeah, 512-bit is already enough

What public key algo does Armadillo use?