Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Question

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these types of binary code protections? I've only found one or two that offer comprehensive solutions:

1. Arxan GuardIt http://www.arxan.com/software-protection-products/index.php
2. PikeWerks http://pikewerks.com

Of these even Arxan seems the most comprehensive in terms of its protection mechanisms. The types of features I'm looking for include:

• protection against reverse engineering
• protection against BORE attacks (break once run everywhere)
• protection against tampering
• protection against binary modification

To provide these features the products would implement many different techniques in the larger categories of:

• static and dynamic binary obfuscation
• virtual machines
• static and runtime encryption
• checksums and timing
• anti-debugging
• authentication

For example, to implement static binary obfuscation the product should offer many different techniques from basic constant and export renaming to path chaffing, fake code insertion, and others. For a good reference see Andrew Griffith's paper on Binary Protection Schemes at felinemenace.org.

I don't know much about PikeWerks but I like how Arxan's product sounds like it conveniently integrates into a build environment so no custom code is required. Furthermore it seems to have capabilities not only to defend but to detect and react to attacks.

* Update * I should have listed the platform requirements: Linux, x86, x64, Java, C, and C++.

Answer 1

The more you invest in protecting your binary from crackers:

• the less of your project cost is being invested in adding value for the customer
• the more expensive your product becomes, driving away legitimate customers
• the longer your time to market, allowing a less conservative competitor to execute faster

Virtual machines are part and parcel of the way IT departments are run now. Avoid running in a VM and you avoid selling your product to part of the market.

Tamper-proofing/Authentication should probably be handled by an OS feature: I know that Windows, Mac OS and many smartphone platforms already support that. My main area of expertise is OS X, which has a "kill" flag such that a process that becomes unsigned can voluntarily suicide. An application can test its own signature, which comes with the proviso that if your app's been cracked you can assume that the test has been changed or removed too.

Obfuscation/encryption techniques are worthless: at some point the CPU has to see the instructions that it actually needs to run, and at this time those instructions can be dumped out to result in the "clean" binary.

Answer 2

Summarizing all previous answers - it is impossible to protect your application with 100% guarantee. If the software is good, then it will be cracked sooner or later, if protection is hard, then it will carded (bought illegally, but with legal licence) and there will be found way how to run your software without paying for it. Just look at IDA Pro - I think author of this software really knows how to protect his software, however, we can find cracked versions all over the internet. So, if you want to start selling your program, be ready for eternal race between crackers and developers, that are trying to think what to do next release to change/improve protection.

Without philosophical aspects of binary protection, several methods by protectors are usually used:

• linking to hardware;
• CRC checks;
• Original Entry Point hiding;
• different unpacking tricks - applying unusual unpacking algorithms;
• import and other sections damaging;
• different anti-debugging tricks via debugger bugs;

All of that is able to be bypassed. And plus to that, it slows down your software, sometimes leads to new bugs and instability issues.

What developers usually apply to their software:

• code mixing (scrambling), obfuscation;
• application encryption;
• pseudo-code usage;
• deliberate errors popping via EH;

Again, in any way it is able to bypass these protection. However, encryption looks like more advisable and best solution today. But could be hard to implement securely, additionally, it may slow down software significantly.

And finally protection software. From what I have heard to be good:

• ASProtect - http://www.aspack.com/asprotect.html
• Themida - http://www.oreans.com/themida.php
• Obsidium - http://www.obsidium.de/show/home/en
• Armadillo - http://www.siliconrealms.com/

I wont delve into observe of each of above mention software, you should do it on your own. If you are considering buying license of one of those protectors, think through on your effort, possible issues regarding protections.

Answer 3

I use SLP Server from InishTech. http://www.inishtech.com It was formerly developed by Microsoft, and was spun off into a 3rd party company.

SLP is a technology that protects software running on Windows platforms and addresses many, if not all of your concerns. I've been communicating with their sales rep and they have some cost-effective plans for small developers, startups, and custom deployments of the software.

It also handles software licensing, metering, and try-before-you-buy in conjunction with the base code protection.

Answer 4

I will start by saying there is no guaranteed way to enforce these things. My recommendation is don't ship out your custom algorithms to the client, keep them on a server that is under your control.

Answer 5

Those products you have identified do what they say they will do, but what Woot4Moo and Graham Lee said is true. You can not prevent reverse engineering. It isn't a philosophical discussion, it is simple reality.The people who do it best seem to be the bad guys, so far, but all anyone can expect to do is slow down an attack.

What are you trying to get out of it? If you are simply protecting your IP, forget it. If the core mechanism is top secret, do not put the app in the public domain. If you are simply trying to slow the bad guys down, use one of those apps you already mentioned.

But just remember - don't believe it won't be hacked, and don't promise anything of the sort to stakeholders :-)

Answer 6

What you're trying to do isn't just a difficult problem to solve, it's a provably impossible problem to solve. If you deliver the program to a user who has complete control of his own operating environment, you simply cannot control how it will be run. It's not just hard, it's impossible.

You can make it more difficult for him to do, but each of these tactics and techniques has a cost, and in a very real way decreases the overall value of your software to the consumer as is discussed in other answers.

Instead, if you're worried, you should focus on a value-add service that connects your paying customers to a system you control, not them. If users get additional value by tying their software to some outside account (e.g. an account on your server) then you can use that link to help positively identify your paying customers.

Answer 7

Strongly agree with the other posters, @Graham, @Rory, @Ams, etc...
This will only make it harder, and prevent casual piracy. If someone really wants to get your code, they will. Worst case they can attach a debugger and get the decrypted machine code.

I will add another very good one: Red-Gate's SmartAssembly.