Author Topic: Software Copy Protection Questions (Read 39964 times)

tinjaw · « **on:** September 22, 2007, 05:17 PM »

I am currently talking with a company that has a popular comic book and may be working with them on a PC game. I will have to use DRM to protect the art assets, etc. that are used in the game. I am just starting to explore this area as it is something I have yet to require. Any hints and tips from DCers experienced in this area would be appreciated.

f0dder · « **Reply #1 on:** September 23, 2007, 06:46 AM »

There's nothing you can do that can't be broken, even trying is a moot point - art assets obviously have to be shown on screen (otherwise the game would be pretty boring

), so even if you employ encryption and whatnot, it has to be decrypted at some point.

Tell the company that "protection" of that sort is futile, and that they should instead rely on copyright and the legal system to settle potential problems...

mouser · « **Reply #2 on:** September 23, 2007, 07:00 AM »

while f0dder's main points may be right, if you do this:

Tell the company that "protection" of that sort is futile, and that they should instead rely on copyright and the legal system to settle potential problems...

if you do that they are likely to fire you and hire someone who tells them they know magical tricks that will keep everything safe until the end of time.

i might suggest a more middle of the road approach. find a suitable protection that doesn't inconvenience the user, and don't expect miracles from it.

tinjaw · « **Reply #3 on:** September 23, 2007, 07:02 AM »

I'll try to clarify a bit what I am looking for, but it is a little difficult to do because part of what I am doing is researching what I need in the first place. I completely understand the whole issue of copy protection not working, blah, blah, blah, but if I am going to do licensing deals with companies that require I use copy protection to protect their IP, I need a solution.

In this particular case, I am building a game using Garage Games' Torque Game Builder, but that won't always be the case. I am looking for a single solution that I can use across the board for all the software I sell. I want to do mainly two things. 1) The standard license key required protection for installation and execution of the software and 2) protection of generic media assets like BMPs, PNGs, etc. that are used by the game and not stored in the EXE itself.

This is all new to me, so I can't be more specific because I don't know what is available for this type of thing. I am also looking for pointers to information that will educate me on this whole area.

And today I plan on searching through the Garage Game forums to see what is mentioned there. I'll probably also search through the IndieGamer and GameDev forums as well.

f0dder · « **Reply #4 on:** September 23, 2007, 07:06 AM »

I'm afraid mouser is right.

Okay, first off: use a "wad"/"pack"/"bigfile" approach, instead of individual files... (ie., like ID software have been doing since doom and earlier). This will keep regular users from messing around, but will be "no match for batman". You can add encryption on top of that to prevent hexeditor-capable users from identifying file signatures, but obviously this won't stop reverse engineers.

For some additional ideas on how to protect those WADs, check out starforce RE tools that the RELOADED group released... this also shows that even relatively sophisticated schemes are futile. (Sorry if that link isn't appropriate here, mouser).

mouser · « **Reply #5 on:** September 23, 2007, 07:09 AM »

the fact that you are using garage games torque stuff is going to change everything -- and for sure the best thing to do is look on their forums for people talking about how they might protect their assets.

the problem is that torque is really made to leave files in their original state and work with loose files arranged in directories, etc. in other words they didn't seem to give any thought to protecting media files, etc.

i wouldn't be surprised if they didn't change that in the future but that's how it is now.

of course the torque code is all available to you, so it wouldnt be too hard to write a custom encryption of the media files.

tinjaw · « **Reply #6 on:** September 23, 2007, 07:37 AM »

OK, let me ask this question to start things rolling. Forgetting about the expensive products that are only realistic for the big guys, what are the top selling solutions for the independent developer? For example, I am going to head off to RegNow and see what they sell. I assume some in-house tool.

Swinto · « **Reply #7 on:** September 25, 2007, 12:59 AM »

Hi tinjaw,

No protection solution is absolute. Most solutions are built around one hurdle so the cracker have only that hurdle to solve. Therefore a strong protection mechanism must be built with lot's of hurdles that increase the work effort for the cracker by orders of magnitude. This so that illegal copying, piracy, tampering and reverse engineering becomes such a large effort, that the incentives to steal the software disappear. There are many solutions out there but very few that actually works. Solutions that work include http://www.vilabs.com and http://www.byteshield.net. Byteshield for instance remove some pieces from the executable and put them in a separate, server based, module.

mouser · « **Reply #8 on:** September 25, 2007, 01:19 AM »

Some other popular serious protection tools:

http://Asprotect
http://Armadillo

f0dder · « **Reply #9 on:** September 25, 2007, 02:17 AM »

Swinto: just for the record, are you affiliated with either of those products, or do you have experience with them?

mouser: both asprotect and armadillo have been targetted pretty heavily by crackers, and there's unpacking tools available for various versions (perhaps not public tools for the latest versions, but cracking groups do have internal tools).

I'd advise anybody looking into ready-made solutions to check which information the reversing scene has published on the net. Google for things like "armadillo unpack", "asprotect tutorial", and check the www.woodmann.com forums.

Another protector is SVKP, from http://www.defendion.com/ . I don't know how effective it is (I frankly haven't looked into these matters for quite a while), but I saw the MazeGen obfuscation engine it uses demonstrated at the FASM 2007 conference... at least that part means I wouldn't want to trace through the protection code

tinjaw · « **Reply #10 on:** September 25, 2007, 01:08 PM »

Thanks for the input folks. I spent half a day researching this area and learned quite a lot. I have decided to go with Armadillo/Software Protect for the following reasons:

Widely used so it is easy to get help from fellow developers.
The major online registration services like RegNow and Plimus have "native" support for it. (For example, Digital River owns both Armadillo and RegNow.)
People have used it with games built using Garage Games' Torque Game Builder.
The cost of purchase for Armadillo includes a custom build to make it less susceptible to generic cracks/keygens.
Reasonable cost ($300)

f0dder · « **Reply #11 on:** September 25, 2007, 03:55 PM »

Armadillo?

Oh well, your choice.

Deozaan · « **Reply #12 on:** September 27, 2007, 12:26 AM »

I highly recommend fSekrit!

Armadillo?

Oh well, your choice.
-f0dder (September 25, 2007, 03:55 PM)

Swinto · « **Reply #13 on:** September 27, 2007, 08:30 PM »

f0dder: I have evaluated both and found that Vilabs solution is great for protecting against tampering and reverse engineering while Byteshield protects both the application and the license manager against illegal copying and tampering. The first one is software you buy and install locally while the second is an ASP solution model.

Swinto: just for the record, are you affiliated with either of those products, or do you have experience with them?
-f0dder (September 25, 2007, 02:17 AM)

Swinto · « **Reply #14 on:** September 27, 2007, 08:41 PM »

tinjaw: Armadillo is one of the most cracked copy protection solutions available on the market. Why spend the money? Just Google "Armadillo crack" and you get 446,000 hits. Check also Woodman http://www.woodmann.com/.

The key is that no protection solution is 100% proof. Thus the solutions that take the longest to defeat have the best chance of not being cracked. Any solution that is based on a single hurdle such as Armadillo are easily cracked. Look for solutions that take on a multiple hurdle approach.

Thanks for the input folks. I spent half a day researching this area and learned quite a lot. I have decided to go with Armadillo/Software Protect for the following reasons:
Widely used so it is easy to get help from fellow developers.
The major online registration services like RegNow and Plimus have "native" support for it. (For example, Digital River owns both Armadillo and RegNow.)
People have used it with games built using Garage Games' Torque Game Builder.
The cost of purchase for Armadillo includes a custom build to make it less susceptible to generic cracks/keygens.
Reasonable cost ($300)
-tinjaw (September 25, 2007, 01:08 PM)

tinjaw · « **Reply #15 on:** September 28, 2007, 08:47 AM »

Well, I haven't looked at what they have to offer other than a brief glance at their websites, but I doubt I can afford any of them as none of them put prices on their websites. Sure, $10,000 is a small price to pay when your software sells for $100,000 per unit, but when I sell 100 copies total at $10, I can't afford anything that is too expensive to have prices posted on a website. The three are http://www.defendion.com, http://www.vilabs.com and http://www.byteshield.net.

tinjaw · « **Reply #16 on:** September 28, 2007, 08:52 AM »

Maybe I am wrong, but I think all the Armadillo cracks are because the developers just used the product out of the box and just used the plain wrapper.

I plan on getting a custom build of the software, not using the defaults, and using more than a simple wrapper - for example protected sections of code, random key checks, etc.

If I am completely naive and setting myself up for failure, please tell me now instead of telling me, "I told you so." later.

tinjaw · « **Reply #17 on:** September 28, 2007, 08:55 AM »

Let me follow on by asking what books, articles, etc. should I read to educate myself on this area? And I'm not asking for websites that cover the topic so that I can follow the latest news and trends, but something I can read in its entirety and learn the subject matter.

f0dder · « **Reply #18 on:** September 28, 2007, 09:29 AM »

There aren't any complete books on the subject (that are worth reading, anyway) - you really do need to dig into the websites, sorry.

mouser · « **Reply #19 on:** September 28, 2007, 06:34 PM »

i think it may be overstating the case to say that armadillo is one of the most cracked protections.
you could probably just as easily say it's one of the hardest to crack protections -- it certainly belongs to the very small handful of serious professional software-only protection wrappers which are actively developed and can only be touched by the highest-level of crackers.

bottom line is as some have said here, which is that there is no solution that is going to be a fool-proof protection for your software. the best you can hope to do is to put in good protection against most attacks, which won't inconvenience your real users.

it's probably a fools errand to find a super amazing protection without sacrificing usability.

f0dder · « **Reply #20 on:** September 28, 2007, 09:33 PM »

mouser: dunno which protection scheme is the most cracked, I guess one could code a data-mining spider for nfoogle.com or whatever and then build a database

- but saying that Armadillo is only touchable by the highest level of crackers is wrong. It's one of the more established and well-known protection systems, so it has received a lot of attention, and a lot of essays has been written on it...

Some of those are beyond the traditional "here's how to crack program X protected with Armadillo", and actually go in-depth with the protection, even the more recent and fancy stuff like self-debugging etc.

If you want to protect something, there's really no way around digging into woodman's forum ("know your enemy" and all that).

Using one of the more well-known protectors should at least mean you have support and that the protected app probably won't crash on the client machine, but it also means you're at the risk of cracking groups internal one-click-auto-unpack tools...

Swinto · « **Reply #21 on:** September 29, 2007, 11:51 AM »

Software protection programming is not a very well known field for most
programmers. Software protection techniques are not like "visible" features
that can be seen and compared. Because of this most software protection authors
could talk about impressive techniques that are included deep inside the
protection scheme, when many times most of these techniques hardly exist or
they are much simpler than what they seem.

Most software protectors reiterate a lot about using very strong cryptographic
algorithms like RSA, Elliptic curves and AES hoping that the final user will
believe that those protectors and the cryptic algorithms are unbreakable. This
if far from the truth as software protection is very different from data
protection. Even if a software protector encrypts the protected application
with the most robust cryptographic algorithm, sooner or later the protected
application needs to be decrypted in order to be run by the CPU. It is in this
phase when most attackers will start their work by dumping the decrypted
application from memory to disk thus not having to deal with the cryptographic
algorithm and reconstructing of the original application.

imtrobin · « **Reply #22 on:** October 01, 2007, 02:01 PM »

http://www.molebox.com/

tinjaw · « **Reply #23 on:** October 01, 2007, 02:42 PM »

http://www.molebox.com/
-imtrobin (October 01, 2007, 02:01 PM)

Thanks imtrobin. I am downloading the demo right now and I will try it out. From the description, it looks like it should do what I want, and the price is reasonable.

[attachthumb=#1][/attachthumb][attachthumb=#2][/attachthumb]

Any experience with this product?

app103 · « **Reply #24 on:** October 02, 2007, 01:17 AM »

i might suggest a more middle of the road approach. find a suitable protection that doesn't inconvenience the user, and don't expect miracles from it.
-mouser (September 23, 2007, 07:00 AM)

I have to agree with mouser on this.

You have to decide what line of business you are in:
1. Are you making games to sell to honest people?
2. Are you making free puzzle games for crackers?

You will always be doing #2, no matter what protection you use.

How much time & money do you want to invest in providing free puzzle games for crackers? How much fun do you want them to have? They will solve any puzzle game you throw at them, eventually.

Go with enough protection to keep honest people honest and enough protection to keep the comic book company satisfied that you have made a reasonable effort to protect their property.

If the comic book company wants something stronger and more expensive, maybe you should suggest they buy you a license for the protection you'll be using. I don't think you would have a problem using any solution they told you to use, as long as they were paying for it. And when they see the cost, they might see things your way with the more reasonable priced solution.

I'm afraid mouser is right.

Okay, first off: use a "wad"/"pack"/"bigfile" approach, instead of individual files... (ie., like ID software have been doing since doom and earlier). This will keep regular users from messing around, but will be "no match for batman". You can add encryption on top of that to prevent hexeditor-capable users from identifying file signatures, but obviously this won't stop reverse engineers.
-f0dder (September 23, 2007, 07:06 AM)

That's a good approach. It keeps the files from being easily accessed by the common user.

Another thing you can do is what some web designers & artists do with their images on the web...chop them up in pieces and fit them together in the game to appear as a single image.

If someone manages to get the images out of whatever way you packed them, they will not be all that usable without having a ton of fun fitting them back together in photoshop, which would be time consuming work. It would be faster and easier to just scan the comic books for the images if they want them that bad.

But keep in mind that there are tools available to make screenshots of games, so they might not need to do much work to get what they want any way. And there really isn't much you can do to stop that kind of copying.

About the only thing you can do is get a list of the tools they would be using, and try to detect them and shut down the game if any are detected running. (and don't forget to detect if the game is running on an OS in something like VMware)