View Single Post
  #66  
Old 02-04-2009, 07:55
Joe Forster/STA's Avatar
Joe Forster/STA Joe Forster/STA is offline
Senior forum member
 
Join Date: Nov 2000
Location: Hungary
Posts: 9,836
Thanks: 20
Thanked 342 Times in 224 Posts
Joe Forster/STA is on a distinguished road
Hmmm, fingerprints are well possible in a software...

If you have a strong secondary PC and lots of space on your web server, you could create user-specific versions of all downloads. In a very simplified version, you hide a redundant "MOV EAX, user_id" in a well-defined place of the code - I mean, 1) assemble "MOV EAX, 0" into the common version, 2) patch into it the user_id for each user-specific version and 3) compress/encrypt only afterwards. If your web server is strong and you don't have that many downloads, it could be done on-the-fly by the web server instead.

Then, if you see your code being ripped off and that code contains the hidden fingerprint, you'll be able to find out which user on your site stole it (or leaked it to the thief). This assumes, of course, that A) the thief is not smart enough to find the fingerprint and/or B) the ripped off code is sophisticated enough for such a fingerprint to stay well hidden in it (it does not become obvious that that particular instruction is not needed for the functionality) and C) the thief does not have access to two (or more) user-specific versions that - after decompression and decrypting - only differ in the fingerprint.

Wanna attend a polymorphic virus coding course?

[...] Or another simple example, taken from SecuROM. Whenever using constants, use "MOV EAX, (value XOR user_id XOR random_value); XOR EAX, (user_id XOR random_value)" instead of a plain "MOV EAX, value". Because of the randomness of the actual values, the user_id won't be seen anywhere "naked" but you, the author knowing the random_value for at least one such tricky assignment, can easily find out. Yes, this can be unwinded, but, when sophisticated enough, only with lots of struggles and "visual debugging" (watch the code in a disassembler and find out in your head what it does) becomes extremely annoying, too.
__________________
Joe Forster/STA
For more information, see the FileForums forum rules and the PC Games forum FAQ!
Don't contact me via E-mail or PM to ask for help with anything other than patches (or software in general) done by me, otherwise your request may be deleted without any reply!
Homepage: http://sta.c64.org, E-mail: [email protected]; for attachments, send compressed (ZIP or RAR) files only, otherwise your E-mail will bounce back!

Last edited by Joe Forster/STA; 02-04-2009 at 09:47.