🚀 go-pugleaf

minso@altern.org (Eric Minso) wrote in message news:<7db38e60.0309020817.6e397ccd@posting.google.com>...
> In fact, I don't have the source code of executables I want to
> protect.
> 
> 
> The company where I do my training period is a computer manufacturer :
> they assemble computers and install standard configurations (Windows
> XP + some softwares). They also give a CD-ROM with many application
> that the user can install.
> 
> In order to lower the computer cost, the sofwares available on the
> CD-ROM are locked and the customer do not pay the licence for them. A
> serial number allows him to unlock only three or four softwares that
> he can choose.
> 
> The interest for the customer is that he installs only softwares he
> wants.
> 
> A few time ago, some software editors have claimed that the protection
> system is too easy to hack and asked to the company a better
> protection for their softwares.
> 
> So I was asked to study a way to protect these executables.
> Unfortunately, I have only access to the executables - I can't
> recompile the softwares to protect.

Are you making this up as you go along? For sure, somebody in your
company isn't thinking straight.

Let's say you'd succeeded in writing your original idea. Each user
would need to be given a "key" to allow decryption and loading of the
program by your program. So they copy your CD and the key, give it to
their friends, and you're back where you are right now. Or am I
missing something here?

What %age of purchasers come back to buy extra software? If it's not
significant, then my favoured solution for your problem is not to ship
the software on the CD in the first place. Send them the author's CD
when they order it, and save the company CD production/handling costs,
hassle from software authors etc.

Or, what system is your company currently using? How are people
hacking it? Can it reasonably be beefed up?

Or you encrypt the software on the CD using a strong key; there are
plenty of descriptions of DES encryption algorithms on the web. Give
the user another key that is "unscrambled" to the decryption key. Base
it on the date; allow, say, 5 days for the key to be valid. Then the
key is useless to anyone else outside that 5 day window.

Now you could put an I/O error on the CD as well; that makes it more
difficult to copy the CD, and the "unscrambler" program can check for
that too. Joe Average now needs a valid key, the original CD and needs
to install in 5 days. Even then, he could still install it on a 100
PCs in that period. So you could introduce a "machine key" so it only
works on his PC... and so on.

Of course, once the software's installed on a PC it could be copied
off. But that's true of every piece of software I've ever seen that
doesn't have some form of extra check, such as a dongle (and even they
can be copied). That form of protection is the responsibility of the
software author, not your company.

You'll never stop software theft, all you can do is make it more
difficult, but at a price. There's a balance between the cost of
deterrence and the loss you think you're incurring. Work that out
first, write code last.

-- 
Regards
Alex McDonald