0

I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market.

Info about the software:

  • Built using .NET C# (Framework 4.5.2)
  • WinForms
  • 32 bit

I have made a several protection layers:

  • Obfuscation, Renaming, anti-debugging
  • Encrypted communications between software and API server (RSA) public key hard-coded

  • The client will generate a temporary AES keys and encrypt it with server public key then sends it to server, The server will decrypt the data with his RSA Private key and respond with a new AES keys encrypted with the ones provided by the client at first request. Then any communication from client to server will be signed by server RSA pub key and encrypted by AES Keys provided by the server.

  • Verify libraries integrity by requesting libraries checksum from API and compare it.

And the most important part is, the application will once request "custom data" from API server and store it in memory, to be used by internal software functions. When a function in the application called it will use the "custom data" as input, so there's no way for the software to operate correctly without having the "custom data"

The API server provides the "custom data" after verifying software activation code and machine unique ID.

The question is:

  • With all of these layers, can the software cracked?
  • Can the custom data layer bypassed?
  • If a cracker bypassed the protection layers until the "custom data" part, it's possible to clone the software with the "custom data" meaning the software can operate without need to request the custom data from the API?

What i mean by custom data is making the software hybrid, always needs data from API to function

I am counting on the "custom data" protection layer.

Please let me hear your recommendations. thanks a lot

Improve this question
2
  • 2
    Regardless of the possibility of cracking, you've made some interesting choices: .Net 4.6 was released in 2015 (and now generally superseded by .NET Core), WinForms is in maintenance mode, and while 32-bit will work on Windows for the foreseeable future, generally things are moving to 64-bit. Depending on what the tool is, online requirements can be annoying or even disabling. Same with some sort of machine ID, which might cause problems with upgrades.
    – Clockwork-Muse
    Commented Dec 30, 2019 at 6:12
  • thanks a lot for this information
    – gadofa
    Commented Dec 30, 2019 at 6:19

1 Answer 1

Reset to default
2

You're wasting your time.

I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market.

Even the big names in software development can't protect their software from cracking. Despite very draconian DRM that drives legitimate users nuts, it all ends up on the pirate sites within days of release.

  • Obfuscation, Renaming, anti-debugging

Everyone else does this too. All it does is slightly slow down the attackers.

  • Encrypted communications between software and API server (RSA) public key hard-coded

I assume you're hardcoding the public key as a form of key pinning to protect against MITM attacks. However, this doesn't work in this case, since the client is also the attacker. They can just patch the binary and replace the key with their own MITM public key.

  • Verify libraries integrity by requesting libraries checksum from API and compare it.

Doesn't work. If the check is on the client, the attacker will just patch it out. If the check is on the server, then the client needs to report the file contents to the server, and the attacker will just make the client lie.

  • With all of these layers, can the software cracked?
  • Can the custom data layer bypassed?
  • If a cracker bypassed the protection layers until the "custom data" part, it's possible to clone the software with the "custom data" meaning the software can operate without need to request the custom data from the API?

Yes, yes, and yes.

If you want any of your data to be safe from the person whose computer is running your client, then the client needs to not have access to any of that data. It all needs to be handled exclusively on the server.

Improve this answer
14
  • Thanks for info provided, About Encryption key, i hard-coded only public key, edited my question. But the custom data layer ? did you thing is' good? The software requires a data from api in order to start a function
    – gadofa
    Commented Dec 30, 2019 at 5:56
  • @gadofa Answer updated to reflect that you meant the public key. And no, the custom data layer doesn't help. The attacker can just steal that data too.
    – Joseph Sible-Reinstate Monica
    Commented Dec 30, 2019 at 5:59
  • could you please explain more, how data can be taken from memory and budding a new assembly shipped with these critical data ?
    – gadofa
    Commented Dec 30, 2019 at 6:02
  • By attaching with a debugger (all anti-debugging can be bypassed with a bit of effort) and dumping the memory.
    – Joseph Sible-Reinstate Monica
    Commented Dec 30, 2019 at 6:03
  • 1
    @gadofa - game companies have spent millions or billions of dollars on this problem, and still fail (some within hours of release). You're generally doomed, so concentrate more on making a good product available without many problems when trying to use it, and most people won't bother.
    – Clockwork-Muse
    Commented Dec 30, 2019 at 6:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .