String & Proc Encrypting

Index > Main > String & Proc Encrypting

Goto page Previous 1, 2, 3, 4, 5, 6

Author

Thread

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 23 May 2009, 16:04

revolution wrote:

The algo should be secure. But the implementation can be anything you like. You are free to make your implementation as obfuscated as you please. But obscurity is not real security, just a delay tactic. don't be tempted to fool yourself thinking an unknown algo is better simply because it is obscure and secret.

Why not? They aren't going to unencrypt the code by hand either way. They just need to figure out how to run the decrypter in their debugger. Who cares if it's the most cryptographically secure one when the key is right there in plain text?

23 May 2009, 16:04

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20486
Location: In your JS exploiting you and your system

revolution 23 May 2009, 16:21

No, you would not put the key in plain text (who said it would be in plain sight?). That is why you have the obfuscated code, to "protect" the key. It is much easier to protect a small thing (a key) than a larger entire program with just obfuscation. Remember that often debuggers are not capable enough to debug really well protected code. E.g. the use of exceptions to execute functions can confuse almost all of the debuggers out there. It is not perfect but it makes the reversers job more difficult.

23 May 2009, 16:21

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 23 May 2009, 16:31

revolution wrote:

No, you would not put the key in plain text (who said it would be in plain sight?). That is why you have the obfuscated code, to "protect" the key. It is much easier to protect a small thing (a key) than a larger entire program with just obfuscation. Remember that often debuggers are not capable enough to debug really well protected code. E.g. the use of exceptions to execute functions can confuse almost all of the debuggers out there. It is not perfect but it makes the reversers job more difficult.

If they are both obfuscated just as good the more secure one wins. I was comparing a well known secure implementation to an obfuscated one though.

23 May 2009, 16:31

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 23 May 2009, 22:50

Who cares? You can just run the executable and dump it from memory with a debugger when it is decrypted. Problem solved. I've done this myself in "obscure" UPX modified programs. Is that even allowed? It's not allowed in the UPX license to modify it for commercial purposes. Confused

This isn't thinking big at all. People have been doing this encryption shit for years with dongles. They have been cracked (not all programs, but the principle has been cracked; as long as you can crack one of them, you can crack them all, but it doesn't mean you WILL crack them all if you don't have patience or don't want, for example).

Now if you would actually compress those strings for the sake of size, then it would be beneficial. Very Happy

23 May 2009, 22:50

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 23 May 2009, 22:52

Borsuc wrote:

Who cares? You can just run the executable and dump it from memory with a debugger when it is decrypted. Problem solved. I've done this myself in "obscure" UPX modified programs. Is that even allowed? It's not allowed in the UPX license to modify it for commercial purposes.

This isn't thinking big at all. People have been doing this encryption shit for years with dongles. They have been cracked (not all programs, but the principle has been cracked; as long as you can crack one of them, you can crack them all, but it doesn't mean you WILL crack them all if you don't have patience or don't want, for example).

Now if you would actually compress those strings for the sake of size, then it would be beneficial.

That's why you only decrypt the parts that are being ran.. and encrypt them again after.. problem solved.

23 May 2009, 22:52

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 23 May 2009, 22:53

Ever heard of run-trace in Olly?

23 May 2009, 22:53

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 23 May 2009, 23:23

Which is why you try to add anti-debugger code and make it as obscure as possible.

BTW I think the question was "How best to encrypt my code?" not "How do I crack someone's program?".

23 May 2009, 23:23

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 24 May 2009, 00:44

Azu wrote:

Which is why you try to add anti-debugger code and make it as obscure as possible.

Yeah one app had that (to my surprise) and I got around it easily once you find it, which is easy.

Azu wrote:

BTW I think the question was "How best to encrypt my code?" not "How do I crack someone's program?".

"best" requires an understanding of potential attacks. Encrypting code is never uncrackable, and by that I don't mean "everything is crackable by brute-force" but in a limited time-frame.

In fact if you have the decrypting routine it's always a, mathematically speaking, short process. And dongles are way more advanced than simple encryption and cracked apps go so deep that users who use warez don't even need the dongles, which means people who buy it have a lot more inconveniences... Razz

(wasted USB ports, drivers that fuck and slow your system down, etc etc...)

_________________
Previously known as The_Grey_Beast

24 May 2009, 00:44

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 24 May 2009, 00:56

Good for you. In the mean time, some people want to try, and calling their efforts pointless is pointless.

24 May 2009, 00:56

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20486
Location: In your JS exploiting you and your system

revolution 24 May 2009, 01:24

Dongles suck. I have removed the offending code from all of my dongled software. They are just too troublesome and problematic. Worse is dongles that require a kernel mode driver, fuck that, I am not letting some application software access my kernel space. If you don't trust me with your program then I don't trust you with my kernel.

Now days it is becoming popular to make the program access the Internet to get a run key, this is also a stunningly bad idea. It means you can't use the program if your Internet connection is down. Plus it allows the author to track usage and introduces who knows what vulnerabilities for malware to enter.

24 May 2009, 01:24

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 24 May 2009, 01:25

Agreed. So let's get back on topic.

24 May 2009, 01:25

Borsuc

Joined: 29 Dec 2005
Posts: 2465
Location: Bucharest, Romania

Borsuc 24 May 2009, 20:02

Azu wrote:

Good for you. In the mean time, some people want to try, and calling their efforts pointless is pointless.

Why is it pointless to tell them so? Is it bad that I give my own advice that, if they intend to do it for that reason (and not e.g: educational or simply for fun), it would not be very secure at all?

Just being honest mate. Smile

_________________
Previously known as The_Grey_Beast

24 May 2009, 20:02

Azu

Joined: 16 Dec 2008
Posts: 1159

Azu 28 May 2009, 21:08

Borsuc wrote:

Azu wrote:
Good for you. In the mean time, some people want to try, and calling their efforts pointless is pointless.
Why is it pointless to tell them so? Is it bad that I give my own advice that, if they intend to do it for that reason (and not e.g: educational or simply for fun), it would not be very secure at all?

Just being honest mate.

Because it's more secure then nothing.

28 May 2009, 21:08

Goto page Previous 1, 2, 3, 4, 5, 6

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum