If I were designing a crack protection system, I would include the folowing statements to my requirements:

- Does not modify exe code - this will cause virus scanners to crack a mental.

- Does not cause any damage to user''s system - including memory corruption. Once game is exited, the system shall remain useable.

- Does not cause false alarms with legitimate users.

- Does not give users of cracked software reason to think that the software (and not the crack) is at fault.

- Does not give imediate notice to the cracker that the software knows what is going on.

Do not meddle in the affairs of moderators, for they are subtle and quick to anger. ANDREW RUSSELL STUDIOS
Cool Links :: [ GD | TG | MS | NeHe | PA | SA | M&S | TA | LiT | H*R ]
Got Clue? :: [ Start Here! | Google | MSDN | GameDev.net Reference | OGL v D3D | File Formats | Asking Questions | Go FAQ yourself ]

quote: Original post by Andrew Russell
- Does not cause false alarms with legitimate users.

That''s probably the most important point in your list, IMO, and it''s something that''s been under-discussed.

But then again, the point of this thread is what to do when we''re sure it''s a cracked version (i.e. we''re assuming the crack detection code is perfect).

Is there really no way exe code can be modified? If virus checkers will complain about it, then surely the crackers themselves couldn''t be running virus checkers... making the problem solve itself.

Superpig
- saving pigs from untimely fates, and when he''s not doing that, runs The Binary Refinery.

quote: Original post by superpig
Is there really no way exe code can be modified? If virus checkers will complain about it, then surely the crackers themselves couldn''t be running virus checkers... making the problem solve itself.

Well, not exactly... when the EXE modifies itself, the virus system of a hacker would not go off, but of a legitimate user would have it go off.

Unless you modified the file only if a crack was detected. This may be a good thing to set off a virus scanner on a crack user''s to think that the cracked version was infected with a virus. If executed properly, this could be quite a nifty effect, actualy...

Of course, with hurcustics (sp?), the virus scanner may find the code even when it is not run or in use. Which means that any virus scanner could go off on a legitmate user. The risk is low if the software were properly tested.

Do not meddle in the affairs of moderators, for they are subtle and quick to anger. ANDREW RUSSELL STUDIOS
Cool Links :: [ GD | TG | MS | NeHe | PA | SA | M&S | TA | LiT | H*R ]
Got Clue? :: [ Start Here! | Google | MSDN | GameDev.net Reference | OGL v D3D | File Formats | Asking Questions | Go FAQ yourself ]

Instead of shuffling code on new versions, make the same version in several different code orders.

People have been writing self-modifying code for years, when did virus checker become a problem?

I don''t have a virus scanner on my "development" computer (i use an old one to filter stuff) so i''ve been writing code which copies eg an SSE replacement function if that feature is detected. Are you saying other people may find the program a virus? Surely a sensible virus checker would only be alerted when the program started modifying other programs?

********


A Problem Worthy of Attack
Proves It''s Worth by Fighting Back

Perhaps, but I have had virus scanners detect and attempt to repair programs that did that (A Bad Thing).

Although, perhaps your right. It was quite a while ago - perhaps it dosn''t happen in newer scanners.

Do not meddle in the affairs of moderators, for they are subtle and quick to anger. ANDREW RUSSELL STUDIOS
Cool Links :: [ GD | TG | MS | NeHe | PA | SA | M&S | TA | LiT | H*R ]
Got Clue? :: [ Start Here! | Google | MSDN | GameDev.net Reference | OGL v D3D | File Formats | Asking Questions | Go FAQ yourself ]

A cracker will be searching for instructions which contain offsets to certain parts of the code. Let''s say there is an assembly macro for calling some non-speed-critical functions which simulates pushing arguments and calling.

If that macro generated a random integer in a register and added it to the mutated offset at call time, it would make searching for these statements much slower as there is no definite pattern.

example

push argNpush argM;;...mov EAX,RandomInteger;;...push argBpush argAcall [Function-RandomInteger+EAX] 

since it is a trivial further step to do extra arithmatic on one or more scratch registers, the resultant code can be highly randomised.

If you are writing any part entirely in assembly, you can manually scatter and obfusticate the address-generating code.

********


A Problem Worthy of Attack
Proves It''s Worth by Fighting Back

quote: Original post by walkingcarcass
Sorry GBGames and Merle, but your minority will suffer inconvenience in order to put a stop to the hundreds or thousands of illegitimate users. is say the gains from anti-crack protection outweigh the troubles of a few legitimate players.

Although I see your point, there is a problem. If the legitimate users suffer inconvinience from a bought game. What keeps them at buying them in the long run if the developers keep making protections that are inconvinient like this? That adds to even more illegitimate users that might like the cracked game better since it runs better...without any troubleing CD-checks that stall the game sometimes.

Of course I buy a game I like to show the developers I think they do their stuff right, and should keep doing it. But if I therefor get a less good experience from playing because of a lame protection, isn''t that helping the crackers more then stopping them?

quote: Original post by neurokaotix
Why are you telling me to shut up? Everything I posted was true, those are the correct definitions of what they are. Perhaps nowadays they''re scewing the meanings to fit whatever buzzwords the media has picked up on lately, but thats what they mean. An AP randomly just saying "No" to my post was ignorant.

You obviously are either and idiot or a damn troll. A hacker is someone that is pationate about something, most of the time the term is used to refer somebody who''s really into computers but it can be used for other things, some hackers will sometimes circumvent security in order to access the data they want or to point out a flaw in the security scheme of the company but they don`t do any damage to the computers... As for people breaking into computers for fun, they are called "Crackers" damn fool. Get that in your head and stop listening to the media. Next time, before posting anything, how about you get your facts straight first...


[Cyberdrek | the last true sorcerer | Spirit Mage - mutedfaith.com][ Administrator TheLinuxForum.tk]

The language used is entirely beside the point.

********


A Problem Worthy of Attack
Proves It''s Worth by Fighting Back