4

Is it possible to dump the ram and get an exe and use that ram dump to distribute an app? If so, is this something that is a practical concern and if so how best should a developer protect against it?

I ask because I'm considering encyrypting my app by nesting keys within nested features/widgets. When a feature/widget is dormant (not used yet) it will be encrypted. When it is used it will be decrypted along with another key to a nested feature/widget inside it. If it's more difficult to reverse engineer that than an exe not encrypted on the hard drive than I would buy some slow down time.

This is the context of why I'm asking if gettng the exe from ram and piecing it together as a distributable exe. I'm assuming if I encrypt in a nested fashion described above it may slow down a potential reverse engineer attempt. I wanted to be clear with my question so I didn't describe why I'm asking, but I hope this bring some clearity.

Improve this question
3
  • 3
    When your users run your program, they already have a copy of it on their machine. So why would they do this and why would it be a problem for you when they succeed? – Philipp Mar 1 '15 at 5:07
  • 1
    There are cases when you may only have access to memory and not the hard drive. It's not totally clear from the original question, but perhaps this is about a risk of industrial espionage if someone has physical access via firewire (e.g., something like this breaknenter.org/projects/inception) maybe they steal your executable? I would imagine data is a more likely target than the exe. – Eric G Mar 1 '15 at 6:16
  • Thanks for the comments, I updated the question to why I'm asking. Hope that helps a bit. – Script Ninja Mar 12 '15 at 5:07
1

It's possible to design operating systems, or individual programs, so this is possible. With debugger-level access to a running application, you could probably reconstruct a close approximation to the the exe which launched it. However, that wouldn't necessarily put you in any better position to distribute the app than if you just copied the original bits.

Improve this answer
0

Technically yes, but it is not that simple. In a nutshell, an exe file is an image of the machine code to be executed + some header data. This will show you the structure of a PE file (the commonly used exe in Win32 environment) with fields that tell the linker what to load into memory: PE .exe structure. (Also check out the rest of the Wikipedia article.) So, in order for you to reconstruct the header+the code, a lot of fiddling would be necessary. There are concerns about libraries, etc.

There is this program available on the net, but I've never used it. It does not even have a proper name.

So, to answer your initial question: yes, it is possible, but it would require some fair amount of expertise.

Generally: there aren't any bulletproof ways to protect your code. You might be able to protect your data that is being processed, but not the algorithm itself. I always say: "If you can't fully protect it, make sure they will have a lot of trouble decrypting it". (Self modifying code could come in handy, but that would require assembly).

I hope I helped somewhat.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.