Sorry your browser is not supported!

You are using an outdated browser that does not support modern web technologies, in order to use this site please update to a new browser.

Browsers supported include Chrome, FireFox, Safari, Opera, Internet Explorer 10+ or Microsoft Edge.

DarkBASIC Professional Discussion / How hackers can crack my secure coded program?

Author
Message
Leonid
User Banned
Posted: 19th Mar 2012 20:15
Link
Somebody was writting that DBClassic code is easy to be read by Notepad. I have DBPro. How hacker can see my code which makes my program to be registered and does not allows unregistered user continue to play? First man who can easily read my code is Lee Bamber. Second - is Bill Gates. But can hacker make a wrapper or emulator of Windows where my exe will be as inerpreted, not executed program? Hackers usually steals a code generator from server? Is not it?
Back to top
Profile
Sergey K
21
Years of Service
User Offline
Joined: 4th Jan 2004
Location:
Posted: 19th Mar 2012 21:02 Edited at: 19th Mar 2012 21:03
Link
im not sure i know what you talking about.
but if you asking how you can allow registred users to play the game is easy:
make server that allows you only 1 login of same user at the same time.
hackers cant do anything about that, unless they hack the command that stops the client from playing if the server returns FALSE at this point.

but noone else can disassamble your source code from EXE. its impossible.

more 3d models .x/.obj and more foramts here:
[href]https://www.turbosquid.com/Search/Index.cfm?keyword=gogetax1&x=0&y=0[href]
Back to top
Profile PM Website
Neuro Fuzzy
17
Years of Service
User Offline
Joined: 11th Jun 2007
Location:
Posted: 19th Mar 2012 22:14
Link
I don't know about DBC, but DBPro is compiled and is therefore very hard to decompile, to the point where it's easier to rewrite the program than to decompile it.

Back to top
Profile PM Email
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 19th Mar 2012 22:40
Link
You could have a look at Smart Packer Pro there is a non paid trial available which has a disclaimer on exit...

Another as mentioned above is the executables can be encrypted on compilation time... see the project options...

Be careful when you have external dependencies such as .dat or .ini files... you will have to develop your own encryption methods for these files...

Back to top
Profile PM
TheComet
17
Years of Service
User Offline
Joined: 18th Oct 2007
Location: I`m under ur bridge eating ur goatz.
Posted: 19th Mar 2012 23:16
Link
Quote: "but noone else can disassamble your source code from EXE. its impossible."


Err.. Sure it's possible. I've disassembled many EXEs. After all, if you get right down to it, it is just a bunch of x86 instructions.

On that note, how does SmartPacker stop me from disassembling, looking for the conditional jump that stops the program, replacing it with a NOP, and re-assembling?

TheComet


TimePlan : https://docs.google.com/spreadsheet/ccc?key=0AmuAKJolqASndEVYOWMxb3l2OWV0UkV1anRSczZScHc
Back to top
Profile PM Email Website
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 19th Mar 2012 23:24
Link
As far as I understand it encrypts the data and hosts itself in virtual space... so maybe the executed data is encrypted and run inside encrypted virtual space? This is more a question for Michael

Back to top
Profile PM
TheComet
17
Years of Service
User Offline
Joined: 18th Oct 2007
Location: I`m under ur bridge eating ur goatz.
Posted: 19th Mar 2012 23:35
Link
Hmm, well if so, then wouldn't I be able to disassemble the encrypted virtual space and work from there?

Actually, has anyone got SmartPacker? Could you write a program that requests a password? If correct, print "yaaay", if wrong, exit program or something. Compile it with SmartPacker and upload it here so I can see for myself (if possible of course).

TheComet


TimePlan : https://docs.google.com/spreadsheet/ccc?key=0AmuAKJolqASndEVYOWMxb3l2OWV0UkV1anRSczZScHc
Back to top
Profile PM Email Website
Sergey K
21
Years of Service
User Offline
Joined: 4th Jan 2004
Location:
Posted: 19th Mar 2012 23:39
Link
@ TheComet: yeah its actually very easy to do with password.
i can write you a simple dbpro function that allows you to use password to encrypt the data and decrypt
if you use the wrong password, the encrypted data could not be encrypted properly..

more 3d models .x/.obj and more foramts here:
[href]https://www.turbosquid.com/Search/Index.cfm?keyword=gogetax1&x=0&y=0[href]
Back to top
Profile PM Website
TheComet
17
Years of Service
User Offline
Joined: 18th Oct 2007
Location: I`m under ur bridge eating ur goatz.
Posted: 19th Mar 2012 23:43
Link
@ Sergey K

Sure, go ahead. I win if I can get your program to display the secret message which is only shown when you enter the correct password, right?

TheComet


TimePlan : https://docs.google.com/spreadsheet/ccc?key=0AmuAKJolqASndEVYOWMxb3l2OWV0UkV1anRSczZScHc
Back to top
Profile PM Email Website
Sergey K
21
Years of Service
User Offline
Joined: 4th Jan 2004
Location:
Posted: 19th Mar 2012 23:45
Link
here found at my code archive:


more 3d models .x/.obj and more foramts here:
[href]https://www.turbosquid.com/Search/Index.cfm?keyword=gogetax1&x=0&y=0[href]
Back to top
Profile PM Website
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 20th Mar 2012 00:05
Link
I have SPP... so write the app or compile it and ill pack it in SPP for you or better yet why do you not download the demo XD

Back to top
Profile PM
Kevin Picone
22
Years of Service
User Offline
Joined: 27th Aug 2002
Location: Australia
Posted: 20th Mar 2012 02:26
Link
Quote: "Somebody was writting that DBClassic code is easy to be read by Notepad."


A common misconception, DB classic compiles source code into its own binary (byte code) format. The only way to extract anything even resembling source code from a DBC exe, would be to write a disassembler for DBC.


Mobile Platforms Are Coming
Back to top
Profile PM Website
Millenium7
20
Years of Service
User Offline
Joined: 13th Dec 2004
Location:
Posted: 20th Mar 2012 05:23
Link
Quote: "A common misconception, DB classic compiles source code into its own binary (byte code) format. The only way to extract anything even resembling source code from a DBC exe, would be to write a disassembler for DBC."


I don't know if they've changed it in a more recent update but if you take a DBC compiled .exe you can open it in any text editor (wordpad/word) you can scroll down and find your source code right there in plain text for the world to see
Back to top
Profile PM Email
WLGfx
17
Years of Service
User Offline
Joined: 1st Nov 2007
Location: NW United Kingdom
Posted: 20th Mar 2012 05:29
Link
Quote: "I don't know if they've changed it in a more recent update but if you take a DBC compiled .exe you can open it in any text editor (wordpad/word) you can scroll down and find your source code right there in plain text for the world to see"

Can you? I've never thought of looking to see. Hmmm.

I do remember in another thread just recently though, someone had mentioned about DBP's compiler options which strips out some un-necessary debug code. If that's true then that would be some sort of 'release' version of the final exe which will not have any debug code. Usually a 'debug' version is so that the IDE can capture run-time errors so your exe will have actual text data within it.

Mental arithmetic? Me? (That's for computers) I can't subtract a fart from a plate of beans!
Warning! May contain Nuts!
Back to top
Profile PM Email Website
mr Handy
17
Years of Service
User Offline
Joined: 7th Sep 2007
Location: out of TGC
Posted: 20th Mar 2012 07:57
Link
If you ignored encryption feauture of DBP, all of your attached media can be seen in notepad at the end of exe.
Back to top
Profile PM
TheComet
17
Years of Service
User Offline
Joined: 18th Oct 2007
Location: I`m under ur bridge eating ur goatz.
Posted: 20th Mar 2012 14:20 Edited at: 20th Mar 2012 14:21
Link
Compiled your code Sergey K.

I was actually struggling with the disassembled code from DBP, even without the whole encryption stuff going on. It's interesting to see the difference between a "debug" version and a "release" version. I find the release version much more comfortable to work with, because all of the conditional jumps for debug purposes are gone.

With that aside though, I was able to track down the function that does the whole encryption/decryption, and I was able to extract the binary data for both the key and the text. It took me a total of about an hour to familiarise myself with the structure of a DBP executable, 1 minute to track down the function, and about 5 minutes to extract the data and convert it to raw text. The key I got was:

DudeDudeDudeDudeDudeDudeDudeDudeDudeDudeDudeDudeDud

I could safely assume it would be "Dude" or maybe "DudeDude" or something.

I will admit, it would have taken longer if I hadn't known what the DBP code looked like.

@ all

Could someone compile the above code from Sergey K with SmartPacker?

TheComet


TimePlan : https://docs.google.com/spreadsheet/ccc?key=0AmuAKJolqASndEVYOWMxb3l2OWV0UkV1anRSczZScHc
Back to top
Profile PM Email Website
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 20th Mar 2012 14:37
Link
Quote: "Could someone compile the above code from Sergey K with SmartPacker?"


On IT!

but can someone explain a debug build and release? I did not know there was two modes of compiling

Back to top
Profile PM
Van B
Moderator
22
Years of Service
User Offline
Joined: 8th Oct 2002
Location: Sunnyvale
Posted: 20th Mar 2012 14:56
Link
At the end of the day there is no hiding, any experience REAL hacker can decompile and crack any executable. Even if you encrypt everything, that un-encryption has to happen somewhere, it has to reside in memory somehow. Anything that ends up in memory is hackable.

The plus point is that decompiling a DBPro executable would be easy, but the instructions themselves would be quite obtuse - compared to say, a compiled C executable. DBPro actually provides a layer of security, because it might not react to the same techniques that hackers use. For instance, a hacker might look for the instructions that dealocate memory, to stop a program quitting out - but who's to say that a compiled DBPro program would actually quit out, that might just be the code assigned to a quit command, doesn't mean that code is ever executed.

When DB code is compiled, it gets converted into bytecode as far as I know - so it's kinda in the same boat, someone might be able to decompile it, but it'd be without variable names. Put this way, if you had a DB project and had to revert to decompiled code, say after a bad hard drive crash - well you wouldn't, not even the programmer could work with it, not even any programmer, not Lee Bamber, and sure as hell not Bill Gates! - it's not an experience thing, it's a conveluted mess thing .

So yes - any executable can be decompiled, but DBPro and DB both have a layer of protection - you can't decompile them into predictable and understandable code that anyone could use to steal your work or modify it to any real extent. The simple truth though is that hackers who do have the skills in this area have different priorities.


Seriously though, Bill Gates? - why do people think he's a good programmer?, the guy hasn't contributed code to anything in decades!... I hope you don't think Microsoft is like Bill Gates and some minions, churning out operating systems and business solutions like a boss... I'd guess he only ever visits the coders to kick some ass .

Health, Ammo, and bacon and eggs!
Back to top
Profile PM Email
Gunslinger
18
Years of Service
User Offline
Joined: 29th May 2007
Location:
Posted: 20th Mar 2012 15:20
Link
I don't think that the DB Pro Protection is very hard to crack.

But first of all, you have to understand that your code is after compiling byte code.
Which looks like that as assembler:



So, hackers don't see your DB code.

I tried it by my self some time ago. And i can say, experienced cracker can do it easily i think.

Theres one Startup Thread by DB, that loads all the stuff. In that thread, theres one anti-debug protection that can be patched.
If thats done, the thread can be debugged.

That main thread is executing another thread with the "real" game. (That's where i stopped)
In the game thread your own protection can be patched i think.

But thats alot theoretical stuff and shouldn't bother you.
You can additional use 3rd party protectors, like Themida, to protect your game.

But everything is crackable...
Back to top
Profile PM
TheComet
17
Years of Service
User Offline
Joined: 18th Oct 2007
Location: I`m under ur bridge eating ur goatz.
Posted: 20th Mar 2012 15:29
Link
Why are you emphasising the words "real hacker"?

Quote: "So yes - any executable can be decompiled, but DBPro and DB both have a layer of protection - you can't decompile them into predictable and understandable code that anyone could use to steal your work or modify it to any real extent. The simple truth though is that hackers who do have the skills in this area have different priorities."


Agreed. That disassembled code I ploughed through was absolutely horrible to deal with, and as I said, it would have taken a lot longer if I didn't know what I was looking for.

DBP compiles to machine code as far as I know. DBC is the one that compiles to bytecode.


I'd also like to state that it's ridiculous to really go as far as to try to hide your code and media. If someone really wanted it, they would get it, regardless of how powerful your encryption is. The time you spend on protecting your code should be use to create your code.

TheComet


TimePlan : https://docs.google.com/spreadsheet/ccc?key=0AmuAKJolqASndEVYOWMxb3l2OWV0UkV1anRSczZScHc
Back to top
Profile PM Email Website
Van B
Moderator
22
Years of Service
User Offline
Joined: 8th Oct 2002
Location: Sunnyvale
Posted: 20th Mar 2012 15:36
Link
Hehe, because real hackers, who work in assembly are becomming more and more rare... we have plenty script kiddies running around, but real hackers have more important things to disrupt than some guys DB game.

I don't think that DBPro is directly machine code, if that was the case - there's no way it would return the line number that it crashed on - I think that maybe it's still bytecode, but using libraries, so it's faster and more efficient than DB, but still not strictly compiling to machine code. If I'm wrong, then Lee should feel free to poke me in the eye.

Health, Ammo, and bacon and eggs!
Back to top
Profile PM Email
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 20th Mar 2012 15:38 Edited at: 20th Mar 2012 15:46
Link
For TheComet

there you go guys, TheComet a little surprise for you... let me know if you want a copy ^^ I will make you an SVG version if you do.

Note... if on Win7 [not sure if the same for Vista any longer lol...] download this and run it in maybe your documents or desktop folder as SPP fails to read the executable from the downloads folder... it will throw an error saying place ece in other folder if you see this message move the exe to another folder...

I hope this helps...

I used 256bit encryption and placed the virtual file in the same folder for your convenience otherwise this was hidden away in the user AppData folder somewhere...

EDIT

I just worked out that SPP will run in the Downloads folder... only if it hangs in task manager and not closes properly the next time you execute the exe it throws the put exe in other folder error...

So you need to kill it in Task Manager

Weee another happy debug day [albeit accidental but is that not the best kind of debugging?]

Back to top
Profile PM
TheComet
17
Years of Service
User Offline
Joined: 18th Oct 2007
Location: I`m under ur bridge eating ur goatz.
Posted: 20th Mar 2012 17:10
Link
Going by your definition I wouldn't consider myself a REAL hacker then. But I'm no noob either. I have a fair amount of knowledge about disassembling and debugging because I've programmed many micro controllers in assembler, and although the x86 instruction set is different, it has the same basic functions as the C8051 instruction set.

Thanks Valentine for uploading that. I'm interested to see what differences there are as soon as I get home.

TheComet


TimePlan : https://docs.google.com/spreadsheet/ccc?key=0AmuAKJolqASndEVYOWMxb3l2OWV0UkV1anRSczZScHc
Back to top
Profile PM Email Website
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 20th Mar 2012 17:32
Link
You are welcome I packaged it as I thought making it look pretty would make for a cuter challenge lol anyhoo looking forward to feedback

Back to top
Profile PM
BatVink
Moderator
22
Years of Service
User Offline
Joined: 4th Apr 2003
Location: Gods own County, UK
Posted: 20th Mar 2012 18:33
Link
I have no fantastic secure way to protect my games, but I do some simple stuff that makes cracking the game far less worthwhile given the crack/quality ratio.

For example, the password/key is never stored in one place
It never uses obvious variable names (in case they are stored in the compiled code).

The algorithm is never a known one, and it is usually a number of home-brewed algorithms to get the result.

And the result never equates to "If validated = true then run" code.

Back to top
Profile PM Email
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 20th Mar 2012 19:12
Link
I noticed that the .bak file holds the source code in plain text

Back to top
Profile PM
Sergey K
21
Years of Service
User Offline
Joined: 4th Jan 2004
Location:
Posted: 20th Mar 2012 19:34
Link
Quote: "I noticed that the .bak file holds the source code in plain text"

yeah.. every good programming IDE must have a backup file..
darkbasic pro's official ide makes new backup file EVERY compile and never removes it. wich is pretty usefully..

but dont worry, the EXE runs without the .bak file anyways @ MrValentine

more 3d models .x/.obj and more foramts here:
[href]https://www.turbosquid.com/Search/Index.cfm?keyword=gogetax1&x=0&y=0[href]
Back to top
Profile PM Website
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 20th Mar 2012 19:39
Link
Oh Cheers Sergey K

So I best not include it with the end EXE right? but if I choose MEDIA compile it gets added in right?

Back to top
Profile PM
Sergey K
21
Years of Service
User Offline
Joined: 4th Jan 2004
Location:
Posted: 20th Mar 2012 20:28
Link
Normal Exe, makes simple exe,
but all the "load object" "load image" files must be at the destination path.

the Media Exe, compiles all the included files into the exe,
to load them, instead of using full path of where the files in your pc are, just use the file name of the same file you included into the exe..


thats the difference..
media exe makes the run lil bit slower, cuz then it decompiles all the media before the exe runs.

so just use the normal exe and include all the media inside the folder of your exe.
thats what every1 does..

more 3d models .x/.obj and more foramts here:
[href]https://www.turbosquid.com/Search/Index.cfm?keyword=gogetax1&x=0&y=0[href]
Back to top
Profile PM Website
MrValentine
AGK Backer
14
Years of Service
User Offline
Joined: 5th Dec 2010
Playing: FFVII
Posted: 20th Mar 2012 20:39
Link
thanks but what I meant was... the .bak file witht he backup source code...

When I made this exe for TheComet I encrypted the DBpro code and also made a media and also used 256 bit {32char] encryption in SPP

Back to top
Profile PM
mr Handy
17
Years of Service
User Offline
Joined: 7th Sep 2007
Location: out of TGC
Posted: 21st Mar 2012 08:01 Edited at: 21st Mar 2012 08:02
Link
@Sergey K

For example, I have included a texture file as media and run exe. Where this texture decompiles - directly to memory or somwhere else? Will it stay there? What will happen to it on crash while decompilation or after?
Back to top
Profile PM
Nateholio
19
Years of Service
User Offline
Joined: 30th Dec 2005
Location: I\'ve Been Everywhere
Posted: 27th Apr 2012 05:32 Edited at: 27th Apr 2012 05:40
Link
Exactly Van B. I'd rather spend time cracking a piece of circuit simulation software which I like to use and would gladly fork over a few hundred bucks to use...except for the fact that the company doesn't exist nowadays so registration is a bit...impossible.

A game isn't worth all that trouble.

If a guy like me wants to crack your software whether it's x86, Motorola, Z80, &&c, he will. But as before, he's probably not the guy you need to worry about cracking it in the first place.

Oh, and the code doesn't even need to be loaded into system memory...a CDROM, hard disk, nerdstick, and so on are just fine. Hardware guys can easily get around that or not having Windows. And if Windows doesn't want to let me into a folder or program that's *easily* solved with some custom hardware and programming (amusingly enough, built on a number if i960s)

In Development: K96 - Combat Simulation
Back to top
Profile PM Email
Back to top

Login to post a reply

Server time is: 2025-06-10 05:51:22
Your offset time is: 2025-06-10 05:51:22