Copy protection for a .NET application

[Massimo]

I'm planning to develop a .NET application using C#, in order to sell it as
a shareware and/or as a full package, so I'll need a good way to protect it
against piracy. I know some ways to protect it (activation, serial keys,
etc.), but my concern is: how can any copy protection mechanism work when
you can always disassemble it and read the source code? Even if I use a
native C++ DLL for my copy protection, the point where it's called from the
C# code can always be found.
Any good tips about this?

Thanks
Massimo

[Naveen K Kohli]

Use a good obfuscator. It will atleast make it tough to disassenble.
I have benn using one from wiseowl and it seems to work pretty good.

Naveen Kohli
http://www.netomatix.com
"Massimo" <ba****@mclink. it> wrote in message
news:%2******** ********@TK2MSF TNGP10.phx.gbl. ..

I'm planning to develop a .NET application using C#, in order to sell it
as a shareware and/or as a full package, so I'll need a good way to
protect it against piracy. I know some ways to protect it (activation,
serial keys, etc.), but my concern is: how can any copy protection
mechanism work when you can always disassemble it and read the source
code? Even if I use a native C++ DLL for my copy protection, the point
where it's called from the C# code can always be found.
Any good tips about this?

Thanks
Massimo

[Jon Skeet [C# MVP]]

Massimo <ba****@mclink. it> wrote:

I'm planning to develop a .NET application using C#, in order to sell it as
a shareware and/or as a full package, so I'll need a good way to protect it
against piracy. I know some ways to protect it (activation, serial keys,
etc.), but my concern is: how can any copy protection mechanism work when
you can always disassemble it and read the source code? Even if I use a
native C++ DLL for my copy protection, the point where it's called from the
C# code can always be found.
Any good tips about this?

Yes - don't worry. Obfuscate your code if you particularly want to, but
I wouldn't bother going any further than that unless you're *really*
sure that:

a) There'll be lots of demand for pirate copies
b) There'll be technically competent people who are willing to spend
time decompiling your obfuscated code

--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too

[Michael Giagnocavo [MVP]]

You can check into obfuscating. But depending on the obfuscator, that might
not buy you much. Getting thru obfuscated code can be simple:
http://www.atrevido.net/blog/PermaLi...b-fcc15eb297c3

The real way is to use a tool that does a lot more than just simple naming
obfuscation (say, type obfuscation as well, call obfuscation), encrypts your
assembly, and then, write really messed up code for the critical part. For
instance, you might try some tricks to fake your stack trace, use multiple
threads, etc. in the "serial checking" part.

Also remember, if there's demand, people will get through and crack your
app. Even MS Window's activation has been cracked (and the Windows
programmers are extremely intelligent).

--
Michael Giagnocavo
MVP
www.atrevido.net

"Massimo" <ba****@mclink. it> wrote in message
news:%2******** ********@TK2MSF TNGP10.phx.gbl. ..

I'm planning to develop a .NET application using C#, in order to sell it
as a shareware and/or as a full package, so I'll need a good way to
protect it against piracy. I know some ways to protect it (activation,
serial keys, etc.), but my concern is: how can any copy protection
mechanism work when you can always disassemble it and read the source
code? Even if I use a native C++ DLL for my copy protection, the point
where it's called from the C# code can always be found.
Any good tips about this?

Thanks
Massimo

[William Stacey [MVP]]

Very true. Just some random thoughts. I got to the point where all the fancy
stuff is a waste of time if your protecting against code modification or
round-tripping. You can use threads, jumps, or Egyptian carrier pigeons to
confuse, but it normally all comes down to one single "if" statement to
continue. This is one way to even get around RSA...just walk around it.
You can obfuscate to help keep logic and secrets hidden so they ~can't
generate external key gens or repro your license stuff, but if they will mod
the code, then none of that really matters. So your really protecting again
those that don't/can't mod the code - the others you can't really stop (not
even with smartcards, strong names, etc.). Most of your protections will be
in a single constructor, so not too hard to drill in on that. In this case
obfuscation still helps a bit as it makes it harder to figure out where/what
to mod the code(hopefully) . Some obfuscators also help prevent ildasm to
raise the bar even farther.

--
William Stacey, MVP
http://mvp.support.microsoft.com

"Michael Giagnocavo [MVP]" <mg*******@atre vido.net> wrote in message
news:er******** ******@tk2msftn gp13.phx.gbl...

You can check into obfuscating. But depending on the obfuscator, that might not buy you much. Getting thru obfuscated code can be simple:
http://www.atrevido.net/blog/PermaLi...b-fcc15eb297c3
The real way is to use a tool that does a lot more than just simple naming
obfuscation (say, type obfuscation as well, call obfuscation), encrypts your assembly, and then, write really messed up code for the critical part. For
instance, you might try some tricks to fake your stack trace, use multiple
threads, etc. in the "serial checking" part.

Also remember, if there's demand, people will get through and crack your
app. Even MS Window's activation has been cracked (and the Windows
programmers are extremely intelligent).

--
Michael Giagnocavo
MVP
www.atrevido.net

"Massimo" <ba****@mclink. it> wrote in message
news:%2******** ********@TK2MSF TNGP10.phx.gbl. ..

I'm planning to develop a .NET application using C#, in order to sell it
as a shareware and/or as a full package, so I'll need a good way to
protect it against piracy. I know some ways to protect it (activation,
serial keys, etc.), but my concern is: how can any copy protection
mechanism work when you can always disassemble it and read the source
code? Even if I use a native C++ DLL for my copy protection, the point
where it's called from the C# code can always be found.
Any good tips about this?

Thanks
Massimo

[Massimo]

"William Stacey [MVP]" <st***********@ mvps.org> ha scritto nel messaggio
news:em******** ******@TK2MSFTN GP14.phx.gbl...

Very true. Just some random thoughts. I got to the point where all the
fancy
stuff is a waste of time if your protecting against code modification or
round-tripping. You can use threads, jumps, or Egyptian carrier pigeons
to
confuse, but it normally all comes down to one single "if" statement to
continue.

That's exactly my point of view on the subject.
So, in a higly disassemblable environment such a .NET (or Java, for that
matter), isn't there any way to really protect applications against piracy?

Massimo

[Jon Skeet [C# MVP]]

Massimo <ba****@mclink. it> wrote:

"William Stacey [MVP]" <st***********@ mvps.org> ha scritto nel messaggio
news:em******** ******@TK2MSFTN GP14.phx.gbl...

Very true. Just some random thoughts. I got to the point where all the
fancy
stuff is a waste of time if your protecting against code modification or
round-tripping. You can use threads, jumps, or Egyptian carrier pigeons
to
confuse, but it normally all comes down to one single "if" statement to
continue.

That's exactly my point of view on the subject.
So, in a higly disassemblable environment such a .NET (or Java, for that
matter), isn't there any way to really protect applications against piracy?

Well, there's protection and there's protection. There's no foolproof
way of protecting software whether it's Java or native code. You can
make things harder by using an obfuscator, but if the code is going to
run on a user's box, that user can (with appropriate skill) work out
what it's doing.

Usually, however, the concept behind a piece of software (which is
plainly visible anyway) is more important than the implementation, IMO.

--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too

[Robby]

You can skip MSIL and compile directly to machine code if you want. In
fact, you can obfuscate and then compile to machine code for double
protection. You don't have to release your program in MSIL. However, if
you do go straight to machine code then you will loose the cross platform
benefits of MSIL. That means you will have to complie separate assembiles
for PC, MAC and so on.

-Robby

"Jon Skeet [C# MVP]" <sk***@pobox.co m> wrote in message
news:MP******** *************** *@msnews.micros oft.com...

Massimo <ba****@mclink. it> wrote:

"William Stacey [MVP]" <st***********@ mvps.org> ha scritto nel messaggio
news:em******** ******@TK2MSFTN GP14.phx.gbl...

> Very true. Just some random thoughts. I got to the point where all the
> fancy
> stuff is a waste of time if your protecting against code modification
> or
> round-tripping. You can use threads, jumps, or Egyptian carrier
> pigeons
> to
> confuse, but it normally all comes down to one single "if" statement to
> continue.

That's exactly my point of view on the subject.
So, in a higly disassemblable environment such a .NET (or Java, for that
matter), isn't there any way to really protect applications against
piracy?

Well, there's protection and there's protection. There's no foolproof
way of protecting software whether it's Java or native code. You can
make things harder by using an obfuscator, but if the code is going to
run on a user's box, that user can (with appropriate skill) work out
what it's doing.

Usually, however, the concept behind a piece of software (which is
plainly visible anyway) is more important than the implementation, IMO.

--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too

[Massimo]

"Robby" <ed****@not.my. email.com> ha scritto nel messaggio
news:Ot******** ******@TK2MSFTN GP12.phx.gbl...

You can skip MSIL and compile directly to machine code if you want. In
fact, you can obfuscate and then compile to machine code for double
protection. You don't have to release your program in MSIL. However, if
you do go straight to machine code then you will loose the cross platform
benefits of MSIL. That means you will have to complie separate assembiles
for PC, MAC and so on.

Didn't know about this; how can I generate machine code? I was talking about
a Windows application here.

Massimo

[Massimo]

"Jon Skeet [C# MVP]" <sk***@pobox.co m> ha scritto nel messaggio
news:MP******** *************** *@msnews.micros oft.com...

Usually, however, the concept behind a piece of software (which is
plainly visible anyway) is more important than the implementation, IMO.

I agree on this, but I'm not talking about protecting intellectual rights
(i.e. algorithms), but the software itself, which can be easily copied.

Massimo