2

I am new to reverse engineering and file protections. I have made a trading algorithm for Tradestation that I have put into a C++ DLL instead of having the source laying around, and I want to protect it further from reverse engineering. Is there something stronger than Themida out there?

5
  • 1
    Not sure if stronger, but you can try VMProtect. Also, do know that if it's running, it CAN and probably WILL be reverse engineered. You cannot stop it from happening if the client ever gets the code.
    – rev
    Apr 24 '15 at 4:50
  • I'm not retailing my code. This is to protect it if it ever gets into the wrong hands.
    – dalanewro
    Apr 24 '15 at 17:33
  • @dalanewro You misunderstood; if your binary is public, you always have to accept the possibility of someone reverse engineering it and doing whatever they like with it. It cannot be helped.
    – user4520
    Apr 24 '15 at 18:02
  • 1
    I think you should make a more specific threat model. What do you mean by "gets into the wrong hands"? How exactly does your imagined attacker 1. Get access to a machine with the DLL on it 2. Know that there is a DLL with trading algorithms 3. Transfer the DLL to their own system ? Is your DLL only present on machines in your own house, or is it used by a business with many employees? Are you expecting a professional attack, or just an amateur/oppurtunistic one (do you keep a low profile)? Remote attacks, or only physical attacks (is there any reason why someone would know your IP addresses)?
    – higaki
    Apr 25 '15 at 18:56
  • @higaki Lets assume a remote professional attack. I think the best solution I've heard is the programmable smart card. I just don't know where to get one or which model to get.
    – dalanewro
    Apr 26 '15 at 9:55
8

You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated hardware dongle intended for copy protection. Make sure the dongle is one that actually runs your algorithms and doesn't just encrypt some parts of the code and run it on the PC side.

Be aware though that all they do is increase the amount of motivation an adversary needs in order to find out how your stuff works. I would examine what the value of your secrets really are. The best something like CodeVirtualizer and Themida can achieve is to create the equivalent of a black box. However it will always be possible to probe your black box with different inputs and observe the outputs. So in best case your protected code will be equivalent to keeping your code running on a server, only accessible offline. If offline is a requirement you're stuck with these sorts of solutions, either something commercial off the shelf or something homegrown. Otherwise I would strong recommending centralizing as much as possible of your algorithms on a server. Why not make your DLL for Tradestation a thin wrapper around a web API?

Trading algorithms, if effective, can definitely fall under something that would be valuable enough to protect on a server.

There's also the issue of mistranslations where CodeVirtualizer or Themida does an incorrect translation of the machine instructions into their own VM instructions which could lead to bugs. Are you willing to accept an incorrect trade and possibly holding a bad position due to translation bugs in the translation engine of Themida, VMProtect or whatever you choose to use?

5
  • Can you recommend a dongle intended for copy protection?
    – dalanewro
    Apr 24 '15 at 17:16
  • @dalanewro honestly I would pick something that has withstood intense scrutiny. Something like a good programmable smart card in SIM format and a smart card reader bundled to the customer. Copy protection dongles have a so so reputation. Good smart cards protect values in the multi million USD range. It all depends on how hard your algorithms are to discover given the equivalent of a black box and the value of that algorithm. Apr 24 '15 at 17:27
  • @ Peter Andersson I have found CC EAL5+ smart cards for access control, smart card certificates for data encryption, authentication but can't seem to find a "programmable smart card in SIM format" Can you please tell me a vendor/brand of such smart card?
    – dalanewro
    Apr 28 '15 at 9:00
  • 1
    @dalanewro I have limited experience with breaking these sorts of cards so I can't recommend any. I would contact someone whos job it is to break them. For instance, IOActive bought Chris Tarnovskys company Flylogic, so either contact them or Chris directly for suggestions and audits. A lot of smart cards offer capabilities to run either small Java or .NET apps. Be aware, if you go the smart card route you're going to be doing A LOT of work just to attempt to protect your stuff. Apr 28 '15 at 9:13
  • @ Peter Andersson Thanks a ton. I really appreciate your help.
    – dalanewro
    Apr 28 '15 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.