flat assembler
Message board for the users of flat assembler.

Index > Main > String & Proc Encrypting

Goto page Previous  1, 2, 3, 4, 5, 6
Author
Thread Post new topic Reply to topic
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu
revolution wrote:
The algo should be secure. But the implementation can be anything you like. You are free to make your implementation as obfuscated as you please. But obscurity is not real security, just a delay tactic. don't be tempted to fool yourself thinking an unknown algo is better simply because it is obscure and secret.
Why not? They aren't going to unencrypt the code by hand either way. They just need to figure out how to run the decrypter in their debugger. Who cares if it's the most cryptographically secure one when the key is right there in plain text?
Post 23 May 2009, 16:04
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17665
Location: In your JS exploiting you and your system
revolution
No, you would not put the key in plain text (who said it would be in plain sight?). That is why you have the obfuscated code, to "protect" the key. It is much easier to protect a small thing (a key) than a larger entire program with just obfuscation. Remember that often debuggers are not capable enough to debug really well protected code. E.g. the use of exceptions to execute functions can confuse almost all of the debuggers out there. It is not perfect but it makes the reversers job more difficult.
Post 23 May 2009, 16:21
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu
revolution wrote:
No, you would not put the key in plain text (who said it would be in plain sight?). That is why you have the obfuscated code, to "protect" the key. It is much easier to protect a small thing (a key) than a larger entire program with just obfuscation. Remember that often debuggers are not capable enough to debug really well protected code. E.g. the use of exceptions to execute functions can confuse almost all of the debuggers out there. It is not perfect but it makes the reversers job more difficult.
If they are both obfuscated just as good the more secure one wins. I was comparing a well known secure implementation to an obfuscated one though.
Post 23 May 2009, 16:31
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
Who cares? You can just run the executable and dump it from memory with a debugger when it is decrypted. Problem solved. I've done this myself in "obscure" UPX modified programs. Is that even allowed? It's not allowed in the UPX license to modify it for commercial purposes. Confused


This isn't thinking big at all. People have been doing this encryption shit for years with dongles. They have been cracked (not all programs, but the principle has been cracked; as long as you can crack one of them, you can crack them all, but it doesn't mean you WILL crack them all if you don't have patience or don't want, for example).

Now if you would actually compress those strings for the sake of size, then it would be beneficial. Very Happy
Post 23 May 2009, 22:50
View user's profile Send private message Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu
Borsuc wrote:
Who cares? You can just run the executable and dump it from memory with a debugger when it is decrypted. Problem solved. I've done this myself in "obscure" UPX modified programs. Is that even allowed? It's not allowed in the UPX license to modify it for commercial purposes. Confused


This isn't thinking big at all. People have been doing this encryption shit for years with dongles. They have been cracked (not all programs, but the principle has been cracked; as long as you can crack one of them, you can crack them all, but it doesn't mean you WILL crack them all if you don't have patience or don't want, for example).

Now if you would actually compress those strings for the sake of size, then it would be beneficial. Very Happy
That's why you only decrypt the parts that are being ran.. and encrypt them again after.. problem solved.
Post 23 May 2009, 22:52
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
Ever heard of run-trace in Olly?
Post 23 May 2009, 22:53
View user's profile Send private message Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu
Which is why you try to add anti-debugger code and make it as obscure as possible.



BTW I think the question was "How best to encrypt my code?" not "How do I crack someone's program?".
Post 23 May 2009, 23:23
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
Azu wrote:
Which is why you try to add anti-debugger code and make it as obscure as possible.
Yeah one app had that (to my surprise) and I got around it easily once you find it, which is easy.

Azu wrote:
BTW I think the question was "How best to encrypt my code?" not "How do I crack someone's program?".
"best" requires an understanding of potential attacks. Encrypting code is never uncrackable, and by that I don't mean "everything is crackable by brute-force" but in a limited time-frame.

In fact if you have the decrypting routine it's always a, mathematically speaking, short process. And dongles are way more advanced than simple encryption and cracked apps go so deep that users who use warez don't even need the dongles, which means people who buy it have a lot more inconveniences... Razz (wasted USB ports, drivers that fuck and slow your system down, etc etc...)

_________________
Previously known as The_Grey_Beast
Post 24 May 2009, 00:44
View user's profile Send private message Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu
Good for you. In the mean time, some people want to try, and calling their efforts pointless is pointless.
Post 24 May 2009, 00:56
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17665
Location: In your JS exploiting you and your system
revolution
Dongles suck. I have removed the offending code from all of my dongled software. They are just too troublesome and problematic. Worse is dongles that require a kernel mode driver, fuck that, I am not letting some application software access my kernel space. If you don't trust me with your program then I don't trust you with my kernel.

Now days it is becoming popular to make the program access the Internet to get a run key, this is also a stunningly bad idea. It means you can't use the program if your Internet connection is down. Plus it allows the author to track usage and introduces who knows what vulnerabilities for malware to enter.
Post 24 May 2009, 01:24
View user's profile Send private message Visit poster's website Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu
Agreed. So let's get back on topic.
Post 24 May 2009, 01:25
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
Azu wrote:
Good for you. In the mean time, some people want to try, and calling their efforts pointless is pointless.
Why is it pointless to tell them so? Is it bad that I give my own advice that, if they intend to do it for that reason (and not e.g: educational or simply for fun), it would not be very secure at all?

Just being honest mate. Smile

_________________
Previously known as The_Grey_Beast
Post 24 May 2009, 20:02
View user's profile Send private message Reply with quote
Azu



Joined: 16 Dec 2008
Posts: 1159
Azu
Borsuc wrote:
Azu wrote:
Good for you. In the mean time, some people want to try, and calling their efforts pointless is pointless.
Why is it pointless to tell them so? Is it bad that I give my own advice that, if they intend to do it for that reason (and not e.g: educational or simply for fun), it would not be very secure at all?

Just being honest mate. Smile
Because it's more secure then nothing.
Post 28 May 2009, 21:08
View user's profile Send private message Send e-mail AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page Previous  1, 2, 3, 4, 5, 6

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.