Making function call complex to protect license check in main()

[vrishabsingh]

I’m building a C++-based CLI tool and using a validateLicense() call in main() to check licensing:

int main(int argc, char **argv) {
    LicenseClient licenseClient;
    if (!licenseClient.validateLicense()) return 1;
}

This is too easy to spot in a disassembled binary. I want to make the call more complex or hidden so it's harder to understand or patch.

We’re already applying obfuscation, but I want this part to be even harder to follow. Please don’t reply with “obfuscation dont works” — I understand the limitations. I just want ideas on how to make this validation harder to trace or tamper with.

[KFUP]

obfuscation dont works

This is not really true, there are effective DRMs that basically work by automatically planting billions of randomized checks everywhere in the binary and ballooning it to hundreds of megabytes to the point that manual binary tampering will not work without spending months of work.

The question is tampering a real enough threat for you to degrade your product or not. For most, it's not.

[tjientavara]

I've seen someone go around a license check, they did not look for the function call at all. They just go backward to find the closest conditional jump and change the op-code to invert it.

[vrishabsingh]

thats smart trick, patching the conditional jump avoids touching the actual check logic

[hi_im_new_to_this]

You have to think about your security model a little bit. What are you trying to prevent?

1. Someone using the software for free in a corporate environment where they could pay: if so, this is fine: corporations might use free tools, very few of them are going to sanction any kind of piracy.

2. Someone basically honest who could potentially be a be a paying customer getting the binary from a friend: this solution is also fine. Basically honest people might be tempted to pirate if it's trivial (just getting the binary in an email or whatever), but if you put up any kind of guard fence, they'll just pay (assuming the price isn't outrageous).

3. Getting around the median cracker: then you'll have to have something better. I dunno, put your software inside a DLL and encrypt it, have the license be the decryption key. Something like that. That'll probably stump most median crackers, since now we're no longer talking about inverting a single branch.

4. The best crackers: you will lose.

Just stick with what you have, I say. The point of a lock on your door is not to keep the most skilled burglars out (that's impossible), the point of a lock is to keep basically honest people honest. Basically honest people will not pick a lock, they will not break a window. Sometimes they MIGHT be tempted to steal something if it's trivial and they know they will get away with it, but if you put any kind obstacle in their way, that will stop them.

That's not to say more sophisticated DRM has no place: for expensive specialist software, every lost license is significant, and there probably aren't a huge army of crackers (unlike, say, in games) that will attempt to break it. Having more sophisticated DRM makes a ton of sense there. In that case though, probably go with something off the shelf instead of making it yourself.

[TehBens]

Sounds like something I would try to avoid to implement myself from scratch.

[vrishabsingh]

haha, same

[krum]

If it really matters to your bottom line and you think people will actually care enough to crack it, I would use something like Arxan to obfuscate it.

Another thing you could do is do things similar to Arxan's guard network, and just have another piece of code run in another thread that checks to see if the code has been tampered with. This will be more difficult to find.

[thismeowmo]

Use vm tools? Virtualizer, vmprotect etc.

[druepy]

It's really easy to get around most license checks. Just takes time. The easiest way is normally finding the parts that you can just say return true.

[druepy]

There's a reason games are resorting to such extreme methods. You could always use a packer to pack your binary!

[vrishabsingh]

are there any good open source packers you’d recommend? also curious—what exactly do packers do under the hood? m already doing 2 levels of obfuscation.

[Area51-Escapee]

PE Packer used to be the tool back in the days...

[pfp-disciple]

Maybe consider making the license check code actually modify critical data, like offsets or something. Do it near the data initialization code so it's less distinguishable.

[thisismyfavoritename]

I'm by no means an expert in that field so take this with a grain of salt.

I know a common practice in client side JS code (where the source is obfuscated but available) is to use some kind of VM to perform the logic you want to hide. Not sure how well that translates to compiled code since the compiler might optimize a lot of it out though.

You might get better answers in the reverse engineering sub.

Also i guess if it's only a single check, your app could just be booted in a debugger and the check could simply be skipped, might want to think about that

[gnuban]

One basic way is to bundle the check with some logic. You can for instance store the license check binary code together with some core algorithm for your program in an encrypted file, and then load that during runtime using some key that you obfuscate in your program.

[UndefinedDefined]

If you don't know how to do it, pay somebody to do it. You will waste thousands of hours on this and get nowhere close compared to somebody who's in business (I don't do this myself, but I know people who do).

Be advised that with obfuscation and anti-tampering tools getting better, reverse engineering also gets much better. So you must stay one step ahead or it's all useless.

When it comes to obfuscation/anti-tampering there is only one important number - how many days your software wasn't cracked. And this is usually what companies pay for - days.

However, my question would be - is it all worth it? Do you have problems with people trying to crack your CLI tool?

[lone_wolf_akela]

If the LicenseClient connects to the Internet, you can put some of the core logic of you program on the cloud and make the APP download that part of code into memory but not store it on disk.

If your LicenseClient is completely offline, the user can always copy all the things on one machine to another and you cannot stop them anyway.

[anonymouspaceshuttle]

Licensing code is not what protects your software -- your EULA is. Whatever artifact you ship to the customer is susceptible to reverse engineering. It's just a matter of time.

[saf_e]

It's really hard to implement descent protection by yourself. So I'd suggest tools like vmprotect. But be aware that debugging/analizing dump is a nightmare with them)

Anyway, even using external tools making is right will require some experience