hi,
at the moment I am protecting my C# software with a competitor product. But unfortunaly my software got cracked with byte patching with ollydbg.
Is Enigma Protector the answer for this problem? Does Enigma make a rock-solid protection against byte patching with tools like ollydbg (there are others of that kind).
If you have discussed that already please provide me the link, I havenot found that.
Best regards
Andreas
protection against byte patching with ollydbg
Re: protection against byte patching with ollydbg
Yes, EP is a strong antipiracy protection.
It has a lot of plugins designed to fight debuggers like Olly.
Some other feature protect the main app.I want to mentione a very good option:
Encrypt with Hardware ID,this can be beaten very hard,because application is encrypted with hardwareID of every customer. It is a none sense to crack an application if is not running on every computer.If the cracker wants to crack the algorithm is theoretical imposible because it must serve the HWID from the computer which cracked initialy, somehow and the same installer kit.Even then other protection will jump on him like Control Sum
This software is a pain in a cracker a*s and soon this baby come with online activation.
Remember ,100% protection none will give you,i think the Enigma is at current date , one of the best worldwide.
Please check my signature
It has a lot of plugins designed to fight debuggers like Olly.
Some other feature protect the main app.I want to mentione a very good option:
Encrypt with Hardware ID,this can be beaten very hard,because application is encrypted with hardwareID of every customer. It is a none sense to crack an application if is not running on every computer.If the cracker wants to crack the algorithm is theoretical imposible because it must serve the HWID from the computer which cracked initialy, somehow and the same installer kit.Even then other protection will jump on him like Control Sum
This software is a pain in a cracker a*s and soon this baby come with online activation.
Remember ,100% protection none will give you,i think the Enigma is at current date , one of the best worldwide.
Please check my signature
Re: protection against byte patching with ollydbg
Hi All,
scorillo7 - thanks you very much for the reply!
Andreas - yes, there are really some specifics related to .NET protection. We have been asked many times regarding .NET protection, so I will try to explain basic steps in this post.
1. Very good recommendation is using Enigma API and integrate protection with the main application as much as possible. For example, instead of using standard registration dialog that allows to check and enter license information, call the Enigma API functions like EP_CheckKey(W) and EP_LoadAndCheckKey to check and verify the license.
2. Since your application is using external .NET dll, this dll can't be protected as a standard executable file (.net use dll files like a data files, and execute them). You can embed .NET dll to the Virtual Box feature, and protection will emulate this file in memory, without having this file on the disk. If your application contains more files, you can use Virtual Box feature for them too.
3. If you are using standard registration dialog, and you do not allow the program to be run without registration, it is very good to use option Registration Features - Common - Encrypt with Ecnryption Constant. Using this option, the application code will be encrypted with the special constant that exists only in valid registration key. So without registration key nobody will be able to run such protected file.
4. Back to the Enigma API. Use EP_ProtectedStringById function to hide the strings from the protected application, Use Miscallaneous - Environment Variables feature to hide some critical strings and data. Why these features are useful? Firstly, because it allows integration of the program with protection, program won't work if cracker remove the protection. Secondly, because your program won't contain necessary data (protected strings, or environment data) if protection will be removed.
5. If you are worrying about debugging, then use the option Checkup - Anti Debugger.
6. Regarding using of obfuscation tools. No ideas how they are well. But I think that standard obfuscator that included in the Visual Studio is enough.
scorillo7 - thanks you very much for the reply!
Andreas - yes, there are really some specifics related to .NET protection. We have been asked many times regarding .NET protection, so I will try to explain basic steps in this post.
1. Very good recommendation is using Enigma API and integrate protection with the main application as much as possible. For example, instead of using standard registration dialog that allows to check and enter license information, call the Enigma API functions like EP_CheckKey(W) and EP_LoadAndCheckKey to check and verify the license.
2. Since your application is using external .NET dll, this dll can't be protected as a standard executable file (.net use dll files like a data files, and execute them). You can embed .NET dll to the Virtual Box feature, and protection will emulate this file in memory, without having this file on the disk. If your application contains more files, you can use Virtual Box feature for them too.
3. If you are using standard registration dialog, and you do not allow the program to be run without registration, it is very good to use option Registration Features - Common - Encrypt with Ecnryption Constant. Using this option, the application code will be encrypted with the special constant that exists only in valid registration key. So without registration key nobody will be able to run such protected file.
4. Back to the Enigma API. Use EP_ProtectedStringById function to hide the strings from the protected application, Use Miscallaneous - Environment Variables feature to hide some critical strings and data. Why these features are useful? Firstly, because it allows integration of the program with protection, program won't work if cracker remove the protection. Secondly, because your program won't contain necessary data (protected strings, or environment data) if protection will be removed.
5. If you are worrying about debugging, then use the option Checkup - Anti Debugger.
6. Regarding using of obfuscation tools. No ideas how they are well. But I think that standard obfuscator that included in the Visual Studio is enough.
Re: protection against byte patching with ollydbg
Thanks for that explaination!
I am also selling development components (only dlls) for SEO. Can dlls also be effective protected with Enigma?
At the moment I am using a competitor product for the software protection, that also uses hardware ID licensing, but it got broken with a byte patch. But we have a license website, that will manage the licensing, which allows to control, that 1 license is activated only once and that I can deactivate licenses anytime (for example when a customer asks for a refund). Does Enigma provide something like this, too? Or must that be build up "by hand"?
regards, Andreas
I am also selling development components (only dlls) for SEO. Can dlls also be effective protected with Enigma?
At the moment I am using a competitor product for the software protection, that also uses hardware ID licensing, but it got broken with a byte patch. But we have a license website, that will manage the licensing, which allows to control, that 1 license is activated only once and that I can deactivate licenses anytime (for example when a customer asks for a refund). Does Enigma provide something like this, too? Or must that be build up "by hand"?
regards, Andreas
Re: protection against byte patching with ollydbg
I just re-read your post... Are you asking of the protection that will avoid file patching? If so, then Enigma Protector surely can do this even without any protection integration and so on. If you just protect your file, it will be impossible to patch it to change the sources of the program.
But, program code can be patched in memory, and to avoid it, you have to integrate protection with the program as I wrote.
Also, protection of .NET program is specific, you can't use modern code protection - Virtual Machine (code virtualization) and any kind of markers. If you can carry out some functional of your .NET program to unmanaged DLL and protect this dll with Enigma (with Virtual Machine and different kind of markers), then it will also increase protection level.
Regarding web licensing, yes, we have the service that allows online activation, and same as you wrote - control number of activations per order.
Online Activation scripts are located on our server. You can simply integrate it with different registrars and automate ordering process.
If you plan to use it, then we give you Enigma Protector for free (both x86 and x64 versions).
You will need to pay monthly subscription for licensing server. Price differs depending on the number of orders/activations per month. The lowest price is 19$ per month, it includes up to 300 orders/activations.
I can send you manual and create a test account if you are interesting.
But, program code can be patched in memory, and to avoid it, you have to integrate protection with the program as I wrote.
Also, protection of .NET program is specific, you can't use modern code protection - Virtual Machine (code virtualization) and any kind of markers. If you can carry out some functional of your .NET program to unmanaged DLL and protect this dll with Enigma (with Virtual Machine and different kind of markers), then it will also increase protection level.
Regarding web licensing, yes, we have the service that allows online activation, and same as you wrote - control number of activations per order.
Online Activation scripts are located on our server. You can simply integrate it with different registrars and automate ordering process.
If you plan to use it, then we give you Enigma Protector for free (both x86 and x64 versions).
You will need to pay monthly subscription for licensing server. Price differs depending on the number of orders/activations per month. The lowest price is 19$ per month, it includes up to 300 orders/activations.
I can send you manual and create a test account if you are interesting.
Re: protection against byte patching with ollydbg
yes, I am interested in that. Please send manual and demo account. Thank you.
Re: protection against byte patching with ollydbg
I am not sure, if I have understood that correct. To protect a C# software against patching in memory, I must use markers. Correct?Enigma wrote: But, program code can be patched in memory, and to avoid it, you have to integrate protection with the program as I wrote.
Also, protection of .NET program is specific, you can't use modern code protection - Virtual Machine (code virtualization) and any kind of markers. If you can carry out some functional of your .NET program to unmanaged DLL and protect this dll with Enigma (with Virtual Machine and different kind of markers), then it will also increase protection level.
But markers cannot be used in a .net (C#) software? Correct?
So protecting a C# software against patching in memory is not possible. Correct?
Re: protection against byte patching with ollydbg
No, you are not correct. Software can be protected from memory patching, but with multiple ways.spa24m wrote:I am not sure, if I have understood that correct. To protect a C# software against patching in memory, I must use markers. Correct?But markers cannot be used in a .net (C#) software? Correct?So protecting a C# software against patching in memory is not possible. Correct?
When the program is run, protection unpack all the application code in memory. This memory can be viewed (no ways to avoid it), and it can be patched in runtime (there is also no way to avoid such patching).
Protection is a complex solution:
1. We have to make the application code more difficult to analyze. If you carry out some code from managed .NET application to unmanaged dll and protect it, this will increase protection, because for unmanaged dll you can use VM markers for example,
2. Then you should know the weak places of the code of your application that can be patched. For example, some code that runs at startup and check trial period. There is no problem if cracker will patch this code in memory after application run, we have to avoid patching before trial check will be executed. In this way you can use Anti-Debugger protection.
3. To avoid patching of the protection loader, try to use Inline Patching protection. Also, use function EP_CheckProtection inside the code of your application.
I can give you some advices, if you tell me what code is usually being modified by the cracker? Do they unpack your application, or make patch in memory?
Re: protection against byte patching with ollydbg
Usually a cracker will make a patch in memory. From the feedback that I have from a cracker the software is quiet secure (with the existing protection-software) and memory patching would be the biggested opportunity to crack the software. The cracking scenario looks like this: The cracker creates a loader.exe that starts our software and then our software makes a license check via a hardwareId bound license file on the local maschine and additional a license server check to see if the license is deactivated. Then the loader.exe patches the variable in memory to the correct value (after she contains the false result).
Is Enigma doing this? Or must that done by the developer by hand? Do you have any examples / help files how that is working?Enigma wrote:If you carry out some code from managed .NET application to unmanaged dll and protect it, this will increase protection, because for unmanaged dll you can use VM markers for example,
Re: protection against byte patching with ollydbg
It could be possible, if your C# application stores a license status somewhere in the global variable. So cracker change the value of this variable and the software becomes registered. Comparing to Enigma Protector, I advice you to always use EP_RegLoadAndCheckKey function to check license status.spa24m wrote:Usually a cracker will make a patch in memory. From the feedback that I have from a cracker the software is quiet secure (with the existing protection-software) and memory patching would be the biggested opportunity to crack the software. The cracking scenario looks like this: The cracker creates a loader.exe that starts our software and then our software makes a license check via a hardwareId bound license file on the local maschine and additional a license server check to see if the license is deactivated. Then the loader.exe patches the variable in memory to the correct value (after she contains the false result).
The protection part can't be patched such way because it is too complex.
Anyway, this is because I told you to carry some functionality to the unmanaged dll. If you will use unmanaged dll (which will be also protected with Enigma Protector) you will be able to use Reg_Crypt markers. These markers encrypt the part of code, and until user has a valid registration key it will be impossible to decrypt this code. Using Reg_Crypt markers there is no chance to patch license routines, because without valid key the code stays encrypted.
Send me a PM message with the name of software protection you are using, maybe I can give you some comparison.
Regarding online activation, just a demo account is located there: http://test.enigmaprotector.com/
Manual is there: http://enigmaprotector.com/assets/tmp/s ... manual.zip
Online Activation embeds very easy, configuration takes just few clicks. When you will start protected file, startup dialog will ask you to enter Activation Id. Without activation program will not start.