Exetools - Request for a good protection scheme in Java

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - Request for a good protection scheme in Java (https://forum.exetools.com/showthread.php?t=15629)

Request for a good protection scheme in Java

Hi to all :),
this is my scenario:
- assumptions: A .jar file with all classes signed.

Ok, i've choose the key file solution.
The key file is 'hashed' with sha-256 then the calculated hash is crypted by ECDSA algo.
My app test the genuine of key file in this way: remove crypted hash, recalculate sha-256 and then decrypt sha-256 hash and compare them.

The keygen is impossible... but remains the byte patching approach.

My request is... there is an efficent solution to avoid the byte patching? :D

All suggestions are accepted...

PHP Code:


		
			
key file template example:

---------

user=testuser

email=test@test.it

hwId=111-111-111

signature=%%

------------



sha-256 + ECDSA encrypt



user=testuser

email=test@test.it

hwId=111-111-111

signature=%[(sha-256 <= ECDSA encrypt)]%



My apps remove signature and recalculate sha-256 hash



---------

user=testuser

email=test@test.it

hwId=111-111-111

signature=%%

------------



if(new sha-256 ==  ECDSA decrypted (sha-256))

   print "good"

else

   print "bad"

Thanks in adv,
DaGoN

@DaGoN:
Hi,

:D I think you're a funny guy...
Ask here IF there's a solution to avoid to byte patching ? Ha, Ha !
You can't...

Obfuscation is a good beginning.

Regards.

Hi LaDidi,
you say: "Obfuscation is a good beginning.", exactly, a beginning... but i thought a little bit of advanced :D

Nitallica says: "if it run you can crack it". I know... i know :)

Actually, my idea was to use the hash of signed classes in jar file and create an hashtable to map some methods of some important classes.

Theory:

PHP Code:


		
			


Manifest-Version: 1.0

Created-By: 1.0



Name: license.class

SHA1-Digest: GLCkANwxP5fHNvDWMsjZDnHtPJg=



name: mainprog.class

SHA1-Digest: PFAwZkhDJwjBlYWxR4OT8FTx1NU=



name: another.class

SHA1-Digest: hZ5BVt7sHyG7rWYWm4eZVBXtfgY= 



name: invoker.class

SHA1-Digest: UiJgkvDfAHhOJpg++oVYEGlCV9c=



main class methods:

calculate

save

Always in theory, if i use the license.class hash as a key to crypt the name of methods and i put it inside an hashtable of invoker.class and i call them
through it?

If you patch license.class the program flow is compromised...

What do you think about it? :)

Bye,
DaGoN

You can use VM over VM over VM etc.
You can use remote code execution and its variations.
You can use HFE (sure, if you can).

I remember I once saw an interesting protection for java implemented by using the launch4j executable wrapper. It embeds the all of the java classes into an executable and references them through pointers. They never get extracted to disk. The author further enhanced the protection by wrapping the exe with a protector. I imagine if you used a strong protector and called some of the protector's functions for crc and date checking from the java code, it would very difficult for someone to make it past the protector to access and/or patch the code.
Launch4J:

Code:

http://launch4j.sourceforge.net/

You could also write a custom wrapper for the java virtual machine. Encrypt the jar files and decrypt them on the fly (optionally only decrypting sensitive jar files with an encryption key stored in your license). I once saw this and when you combine it with obfuscation of the jar files, it will certainly take a cracker some time to decrypt everything.

Greetings

Java and Security should be antonyms. I haven't seen yet a Java proggie that you can't easily crack.

Depends. If you can leverage online website, you could port important and/or critical classes and pieces of code from your java program online. You can do more than just a serial check then :-)

Usually, what you would like, is to get 100% sure that the license is not leased, thus, if it was bought, then you should have IP of the guy that uses it, some of the hardware info (sounds familiar?) and such, I am not sure if this is a strong protection.

I encountered something similar to this in here which nobody found a solution for.

If you cannot validate with the server, you won't be able to get anything to run, that is also, you won't get a class to run on and pieces of the program, much like a demo, but worse.

You could combine this with what the others proposed, and I think you will make someone very very busy for a lot of time :-)
Usually, reproducing a server to answer to requests of program takes too much time :-(