1

Supposing we have a software that checks on a remote server online if the input entered by a user (a license key) is valid.

The server sends in a socket to the client True or False if the license is correct or not.

In the binary, a jump (jz...) is made depending of the result.

I think that this implementation is common to software (please correct me if I'm wrong on that point).

The problem is that nothing can prevent a malicious user to patch the binary in order to change the "jump" above and bypass the check validation of the license key.

So how does software developer prevent that situation ?

Improve this question
1
  • the hardest apps for most of us to crack are not ones with the tightest security, they are ones that have many versions w/ different kinds of security per version that make it hard to find a working keygen/patch.
    – dandavis
    Commented Jul 25, 2016 at 15:29

2 Answers 2

Reset to default
5

You can't prevent people toying around with your exe, if you check if it wasn't tempered then they'll patch the code that checks that to. One thing you can do is not distribute the whole program but a version missing core functionality in the exe, then when they enter the cd key patch that in memory with data you download from an url that contains the cd key. That or send encrypted code to each client that requires the matching key to decrypt.

Improve this answer
8
  • How can you hide key if attacker has access to binary?
    – Neil Smithline
    Commented Jul 24, 2016 at 17:29
  • You don't "hide" the key, you just don't store it, the question was how to prevent people from using your software without having the cd key so this already assumes there is a way to distribute the key to a legitimate end user. Have him enter the key, use it to decrypt the encoded part of the binary or to download the missing part depending on the scheme you picked and voila. No key no software regardless of how many jumps you patch as the software isn't distributed in a working condition to begin with
    – Ronan Thibaudau
    Commented Jul 24, 2016 at 18:47
  • Do you know if these two techniques are comonly used ? It seems to be a perfect prevention in "normal" conditions (good key size, random, etc.) against malicious binary patching right?
    – Duke Nukem
    Commented Jul 25, 2016 at 7:05
  • @DukeNukem No idea about the sending code past the key, but i'm pretty sure steam uses the send a crypto version for it's pre downloadable games so they just have to decrypt it on release day
    – Ronan Thibaudau
    Commented Jul 25, 2016 at 7:15
  • As i said in the comments on my answer: stopping average, technically un-skilled users takes far less effort than described here. But as soon as an application gains publicity, experienced professionals will find a way to circumvent any of these techniques and publish a ready-to-use package that does not require a license key.
    – marstato
    Commented Jul 25, 2016 at 11:23
4

In the binary, a jump (jz...) is made depending of the result.

There are more complex and multiple of such checks in place. However, it boils down to exactly what you wrote.

So how do software developers prevent that situation ?

Not at all. They cant and any attempt to do so will heavily impact usability.

What big software companies DO is: they rely on the fact that average users of their software

  • do not understand how that protection works and in turn:
  • do not know how to debug the assembler code to find the 10 - 20 conditionals in the binary and patch them
  • does not go through that hassle to save a few bucks

As a result, few people take the effort and publish their results (known as "cracks") on the internet for others to download and use. That is where large software companies can afford to step in with a shipload of lawyers and sue everyone who tries to publish patched binaries. The success of that practice is "debatable" at least.

Improve this answer
4
  • What do you think about Ronan Thibaudau prevention methods? Aren't they perfect prevention methods?
    – Duke Nukem
    Commented Jul 25, 2016 at 7:08
  • They make an attackers life harder, yes. But one could just mock the server (as happened to Assasins Creed 2) or even patch the downloaded code into the binary. No matter what you do, attacks will just get harder but never become impossible.
    – marstato
    Commented Jul 25, 2016 at 7:13
  • Yeah but the two scenarios could be : 1) The server checks if the key is valid and will send the missing part ONLY if it's valid. Mocking the server is useless as only the legitimate server has the missing part. 2) Core of the binary is encrypted with AES-256. It's will take a huge time to decrypt it. In these case (especially the first one), patching the binary is useless. So it's a perfect prevention for that kind of application right?
    – Duke Nukem
    Commented Jul 25, 2016 at 11:03
  • No, it is not. The average user will not bypass even a simple serial number check. But if your application has enough publicity, hackers/crackers will put TONS of effort into disabling your DRM. In this scenario: buy a license, MITM your server connection to sniff the plaintext code and then create a mock server or patch the binary. They'll publish the result for the average user to download and use. There is no security without physical security.
    – marstato
    Commented Jul 25, 2016 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .