Recent

Author Topic: Decompile Pascal Binaries - some advice please  (Read 47901 times)

avra

  • Hero Member
  • *****
  • Posts: 2514
    • Additional info
Re: Decompile Pascal Binaries - some advice please
« Reply #15 on: May 05, 2011, 06:30:17 pm »
If you are really concerned about protecting your intelectual property then you can combine your PC based software with some external custom made micro controller (MCU like AVR, PIC, 8051...) based hardware key

Also known as a dongle (for example http://www.microcosm.com/dinkey_pro_models.php).

No. Dongles are usually not hard for cracking, since they usually provide some ID that gets linked to features bought by a customer with some internal vendor application, which then generates an unlock key you enter in application. This is bad approach since once cracker has some valid hardware key (although possible to crack with no key at all but much harder), cracker can step through code and see code branches and what gets executed. Then cracker just has to change few jumps with a HEX patch and that's it. It works with numerous dongle protected applications, but why I call it bad? Because all you need to have a full running application already exists in executable. It is much better if you have some important function executed inside the smart hardware key. Then a result of that function cracker would need to replicate on a PC without hardware key, and to do that, a cracker would need to have knowledge of electronics, specific MCU, it's architecture, disassembly, and to have proper tools to read code from it, just to analyze it and be able to replicate it in PC. How much crackers do you think are capable of that? What ever the number is, it is thousands of times less then with usual simple off the shelf commercial dongle approach.
ct2laz - Conversion between Lazarus and CodeTyphon
bithelpers - Bit manipulation for standard types
pasettimino - Siemens S7 PLC lib

Marc

  • Administrator
  • Hero Member
  • *
  • Posts: 2584
Re: Decompile Pascal Binaries - some advice please
« Reply #16 on: May 05, 2011, 08:01:37 pm »
A dongle is not just a key. The ones we use have several cryptographic functions and 4k of flash
The result of these functions + data is used for further signing of our data. A hacker cannot predict what values the dongle will generate on a given input.
//--
{$I stdsig.inc}
//-I still can't read someones mind
//-Bugs reported here will be forgotten. Use the bug tracker

eny

  • Hero Member
  • *****
  • Posts: 1634
Re: Decompile Pascal Binaries - some advice please
« Reply #17 on: May 05, 2011, 08:01:59 pm »
How much crackers do you think are capable of that?
How many software developers are capable of developing such a HW solution  :(
All posts based on: Win10 (Win64); Lazarus 2.0.10 'stable' (x64) unless specified otherwise...

avra

  • Hero Member
  • *****
  • Posts: 2514
    • Additional info
Re: Decompile Pascal Binaries - some advice please
« Reply #18 on: May 05, 2011, 10:18:13 pm »
A dongle is not just a key. The ones we use have several cryptographic functions and 4k of flash
The result of these functions + data is used for further signing of our data. A hacker cannot predict what values the dongle will generate on a given input.
If you are talking about Aladdin HASP then I must tell you that there exists a good software emulator for it.
ct2laz - Conversion between Lazarus and CodeTyphon
bithelpers - Bit manipulation for standard types
pasettimino - Siemens S7 PLC lib

avra

  • Hero Member
  • *****
  • Posts: 2514
    • Additional info
Re: Decompile Pascal Binaries - some advice please
« Reply #19 on: May 05, 2011, 10:21:55 pm »
How much crackers do you think are capable of that?
How many software developers are capable of developing such a HW solution  :(
Beside my self I personally know 3, and maybe 10-15 globally. There must be more, of course.
ct2laz - Conversion between Lazarus and CodeTyphon
bithelpers - Bit manipulation for standard types
pasettimino - Siemens S7 PLC lib

eny

  • Hero Member
  • *****
  • Posts: 1634
Re: Decompile Pascal Binaries - some advice please
« Reply #20 on: May 05, 2011, 10:55:44 pm »
Beside my self I personally know 3, and maybe 10-15 globally. There must be more, of course.
Well, I'm one of them, be it that I prefer PIC's  :D
Nevertheless this does not look like a feasible solution for TS.
All posts based on: Win10 (Win64); Lazarus 2.0.10 'stable' (x64) unless specified otherwise...

avra

  • Hero Member
  • *****
  • Posts: 2514
    • Additional info
Re: Decompile Pascal Binaries - some advice please
« Reply #21 on: May 05, 2011, 11:18:53 pm »
Nevertheless this does not look like a feasible solution for TS.
I am sorry, I could not figure out what TS is...
http://www.acronymfinder.com/TS.html
ct2laz - Conversion between Lazarus and CodeTyphon
bithelpers - Bit manipulation for standard types
pasettimino - Siemens S7 PLC lib

DirkS

  • Sr. Member
  • ****
  • Posts: 251
Re: Decompile Pascal Binaries - some advice please
« Reply #22 on: May 05, 2011, 11:23:12 pm »
Nevertheless this does not look like a feasible solution for TS.
I am sorry, I could not figure out what TS is...
http://www.acronymfinder.com/TS.html
Topic Starter?

marcov

  • Administrator
  • Hero Member
  • *
  • Posts: 11459
  • FPC developer.
Re: Decompile Pascal Binaries - some advice please
« Reply #23 on: May 06, 2011, 02:16:26 pm »
If you are really concerned about protecting your intelectual property then you can combine your PC based software with some external custom made micro controller (MCU like AVR, PIC, 8051...) based hardware key

Also known as a dongle (for example http://www.microcosm.com/dinkey_pro_models.php).

No. Dongles are usually not hard for cracking, since they usually provide some ID that gets linked to features bought by a customer with some internal vendor application, which then generates an unlock key you enter in application. This is bad approach since once cracker has some valid hardware key (although possible to crack with no key at all but much harder), cracker can step through code and see code branches and what gets executed. Then cracker just has  

The usb dinkey dongle is based on a Microchip PIC. So it is actually exactly what you propose. It also features a customer configurable algorithm, several key values, and multiple ways of protection (base encyption of the algorithm, and checks from within the code). There is also flash available (though not as much, iirc 64-128bytes), which is usually used as a settings for what features to unlock. Applications are also tied to specific applications, so that multiple programs from the same vendor don't necessarily work with the same dongle

« Last Edit: May 06, 2011, 02:19:40 pm by marcov »

avra

  • Hero Member
  • *****
  • Posts: 2514
    • Additional info
Re: Decompile Pascal Binaries - some advice please
« Reply #24 on: May 09, 2011, 01:42:58 am »
The usb dinkey dongle is based on a Microchip PIC. So it is actually exactly what you propose.
I don't think so. While I propose executing important part of custom code in the dongle it self, dinkey dongles seam to depend on just executing encrypt/decrypt public/private key vendor fixed algorithms in the dongle. If cracker has single original dongle, then he will attack memory after decryption and then try to recreate executable. This is possible since executable holds 100% of application functionality, with just some parts encrypted. It is much better to have critical function(s) executed inside of dongle it self. That will make cracker's job much harder.
« Last Edit: May 09, 2011, 01:46:44 am by avra »
ct2laz - Conversion between Lazarus and CodeTyphon
bithelpers - Bit manipulation for standard types
pasettimino - Siemens S7 PLC lib

Thaddy

  • Hero Member
  • *****
  • Posts: 14393
  • Sensorship about opinions does not belong here.
Re: Decompile Pascal Binaries - some advice please
« Reply #25 on: February 23, 2017, 11:54:04 am »
Forensics mostly involve highly automated cracking.
Foremost are 1) the dictionary attacks (closely related to social science and human behavior) 2) second only are brute force attacks. If you must know, 1) has over 90% success rate in the case of a single password. 2) is only done when it is warranted. It's not all mathematics....in practice...
In the case of program flow it is usually fully automated.
Object Pascal programmers should get rid of their "component fetish" especially with the non-visuals.

 

TinyPortal © 2005-2018