1

Ok, I know that every obfuscated .Net application can be reverse engineered.

And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no copyright law to protect me where I live.

So I've come up with a plan to make it harder. Since I'm very very novice regarding the security I hope that you will help me find any loopholes in this plan.

  1. The user downloads the application
  2. The user enters his username/password and starts working
  3. He need to export the results to a specific file format
  4. The application connects to the server, and checks the username/password
  5. The data required to create the file are sent to the server
  6. The server creates the file on the server and sends it back to the user

Now if someone cracks the program by bypassing the username/password check the file won't be sent from the server and he won't be able to get the file he wants, something similar software as a service.

Now I want to know if this is the correct way to go? What suggestions to make it better?

Improve this question
4
  • What is stopping the user from sharing the username and password with other users who haven't paid for your service? Also why it is so difficult to reverse engineer the file sent back by the server?
    – void_in
    Commented May 3, 2015 at 19:05
  • Thanks void_in for your interest in the subject. I always can check the usernames that are abused on the server side. The file is not trivial to create. It is CAD/DXF file that is created based on the data that is sent to the server.
    – Vahid
    Commented May 3, 2015 at 19:08
  • All data which stores in file will send to server first? So is there one upload and one download each time? How much data is transferred?
    – Ali
    Commented May 3, 2015 at 19:09
  • @Ali Yes the data will be send to the server, it will be processed by a php script and a DXF file format is created. It will be then sent back to the client. The user himself won't notice this. He will only require an internet connection. When he wants to export a dialog will open. And the received file be displayed on it. The file size varies between 20~50 kb
    – Vahid
    Commented May 3, 2015 at 19:13

1 Answer 1

Reset to default
1

The structure of a DXF file is somthing like this:

You know it so go to the end of answer

ASCII versions of DXF can be read with a text-editor. The basic organization of a DXF file is as follows:

HEADER section – General information about the drawing. Each parameter has a variable name and an associated value.

CLASSES section – Holds the information for application-defined classes whose instances appear in the BLOCKS, ENTITIES, and OBJECTS sections of the database.Generally does not provide sufficient information to allow interoperability with other programs.

TABLES section – This section contains definitions of named items.

Application ID (APPID) table

Block Record (BLOCK_RECORD) table

Dimension Style (DIMSTYPE) table

Layer (LAYER) table

Linetype (LTYPE) table

Text style (STYLE) table

User Coordinate System (UCS) table

View (VIEW) table

Viewport configuration (VPORT) table

BLOCKS section – This section contains Block Definition entities describing the entities comprising each Block in the drawing.

ENTITIES section – This section contains the drawing entities, including any Block References.

OBJECTS section – Contains the data that apply to nongraphical objects, used by AutoLISP and ObjectARX applications.

THUMBNAILIMAGE section – Contains the preview image for the DXF file.

END OF FILE

The data format of a DXF is called a "tagged data" format which "means that each data element in the file is preceded by an integer number that is called a group code. A group code's value indicates what type of data element follows. This value also indicates the meaning of a data element for a given object (or record) type.

Reference: Wikipedia

You want to send this data from your local software to the server, an easy crack is sniffing, the cracker write a little program that can convert above structure to DXF file, the crack software will be sit on the line between local program and the server, captures each data that is transferred and stores it in a file, no need to the server.

Improve this answer
9
  • Thanks Ali, but before the server sends the above data, it will check the username/password on the server side. If the username/password doesn't match it won't send the file in the first place. And if the cracker bypasses the part where the program requests username/password he won't still get a chance because the server needs that username/password to create the file anyway! Do you see any flaw with the above logic?
    – Vahid
    Commented May 3, 2015 at 19:39
  • By the way I won't be sending the above structure to the server, it will be raw data. The above structure is the structure of the file created on the server.
    – Vahid
    Commented May 3, 2015 at 19:40
  • First of all,raw data easily can be converted to this structure. Another attack, because there is no encryption, cracker reads raw data from the RAM and writes it in the file by above structure,because now the user has designed something in the program, and data is in RAM.
    – Ali
    Commented May 3, 2015 at 19:56
  • I told raw data can be converted to this structure, because there are many source codes that converts this type of raw data to DXF format
    – Ali
    Commented May 3, 2015 at 20:01
  • 1
    After thinking, cracker can writes a local program that emulates the server, and when your program wants to talk with server,it actually talks with crack program,so your program send user/pass to the crack program, and it approves any user/pass (true or false).
    – Ali
    Commented May 3, 2015 at 20:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .