Defence against cracking [closed]

Question

Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use it are those who actually paid for it. Is it possible to achieve? If not, what are the best known techniques used to obstruct cracking?

Answer 1

Your question is very lacking as it is very very broad. To give a precise answer one would have to know details such as what programming language and toolchain you are using to write your software and what platforms you are targeting.

What you are asking is virtually impossible to achieve unless you find some means make vital parts of your program inaccessible to the user/customer; such as on a hardware token, for example. This kind of token should be hard to duplicate and would be the thing only your paying customers have. The token could also make use of modern asymmetric cryptography, but that would likely be impractical as I can only conceive of a scenario where your software needs to know the public key to the secret ones stored on each of these tokens. Additional reading ...

That said, you can already tell that I am suggesting a hardware dongle here. But there is an alternative that can work as well depending on what your software does and what the requirements of the users are.

If the software can "outsource" some aspects of its functionality to a server under your sole control, then your program need not contain the full functionality. In such a case the server would verify some token/lease (a kind of code or subscription key, if you will) that can contain strongly encrypted data as long as only the server has the secret key to decrypt that data and verify the validity of the token/lease. Once verified, the server would perform the vital function of your program and merely send back the result. Problem here is that you have to design an API that cannot be abused by others to coerce the server into sending results to parties that are not paying customers of yours.

Any offline method will require a hardware solution as outlined before. And only within the outlined constraints will this be an effective protection. And even then there is a slim chance someone figures out how to clone the hardware and the software on it.

However, I think you might want to consider a few things before pursuing your desire for protection against :

• Is your software worth the hassle?
• How widely used is your software?
• How intrusive is the protection scheme you sign up for?
  • For example I am not willing to have some piece of software phone home at will. Similarly I'd have reservations about being given a hardware token, because if I lose it or it gets stolen or destroyed I may be facing several days of idling because that's how long it takes you to ship me a replacement. So if your software is so indispensable you will want to keep in mind the needs of the (paying) customers especially.
• Are you thinking more about "software pirates" than about your customers?
  • The effort you spend in a possibly futile attempt to protect your software from "piracy" is time you don't spend improving it for paying customers.

Long story short: either you trust your customers in which case you can forget about truly secure means to protect your software. All of the means you have at your disposal in such a case are deterrents but will not ultimately stop a determined cracker (security by obscurity). If you don't trust your users/customers you must ensure that vital parts of your program are not accessible to them (e.g. stored on a hardware dongle or on some remote server).

Consider IDA, the disassembler, one of the tools indispensable to a lot of us here on this site. To the best of my knowledge they use watermarking and the installer is protected by a password. The watermark will ensure that it's possible to trace back whose copy got compromised. But even in such a case not every leak can be attributed to the customer who paid for it. Some years back a disgruntled (ex-)employee of ESET leaked the IDA copy along with the decompiler plugin, for example. Hardly anything ESET could have done about that. The only deterrent for these cases is legal action that will hopefully deter future would-be delinquents from attempting something similar.