views:

809

answers:

19

I wish to create shareware software that contains a registration algorithm. I am looking for a programming language, that cannot be easily decompiled into readable code. For example, C# can be decompiled into readable code.

What are my options?

Edit: I'm looking for something that can be only decompiled into assembly. Delphi, for example, cannot be decompiled like C# or Java, but from what I've heard, Delphi is dying.

+19  A: 

If your CPU is able to see the code and run it, by definition, a sufficiently talented person can do it too.

You can, however, make it harder by running your code through an obfuscator.

Mehrdad Afshari
You encrypt your code, use TPM fore holding keys, and protected memory area for holding program during runtime.
Maciek Sawicki
Maciek: You need to control the hardware, like the iPhone, Xbox, .... and TPM is a hardware thing. You have to rely on processor features like ARM TrustZone to do that.
Mehrdad Afshari
+7  A: 

Isn't this logically impossible?

If you can run the code, you can get the instructions being executed by your CPU. At that point, your algorithm is readable, for some definitions of readable.

Dominic Rodger
It is possible, but only if you can secure the platform to prevent smart people from accessing the code and / or the keys used to decrypt it. TPM tries to do this, but it requires hardware support, OS support, chains of trust, etc. It is simply not an economic proposition for a shareware app.
Stephen C
You can't prevent smart people from deciphering the instructions, at some level "smart people" will be able to see the instruction set, if they can see the instruction set they can change it. If they can change it, they can change how it works, such as bypassing the security.
Jason D
+3  A: 

No language is capable of that AFAIK.. since it's impossible as it can always be reverse engineered.. though a good number of developers would cry if you coded it in brainfvck though.

meder
Actually, they wouldn't bother decompiling it, since raw hex machine code is much more readable than a few languages I could name. Actually, if you coded that in a language like Intercal, it would be automatically obfuscated.
David Thornley
Meh, tried to infuse some comedy :p
meder
A: 

All code can be read back in assembly. Someone can reverse engineer your application and see what the machine is doing.

Crowe T. Robot
A: 

Try finding an obfuscator. As the name suggests it obfuscates the code enough that reverse-engineering it will not be trivial.

Or use C/C++. Those can be disassembled, but that's it.

Of course, this is just enough to keep the not-sufficiently-competents from understanding and reverse-engineering the code.

terminus
A: 

This is not so much a matter of choosing the right language as it is finding a tool that will do code obfuscation for you. Nothing is bulletproof, but there are efforts to accomplish this sort of thing.

Eg. see this research project about Java code obfuscation.

Parappa
+1  A: 

As Dominic said, if you can run it, it can be decompiled.

That said, I believe there are tools that obfuscate the compiled code and make it more difficult for someone to disassemble and reverse or take apart a registration process.

For example, I believe that major companies like Adobe and Microsoft use products like this, in order to make it much more difficult for folks to disassemble and crack their programs.

It's like security or cryptography or even the locks on your car/house - someone with enough time and resources can probably break through anything.

You just need to tilt the curve enough to make it sufficiently unattractive for anyone to really try, so that they'd be more likely to move onto easier targets.

Chirael
The difference with my locks is that, if somebody wants to break in, they have to pick my locks (probably not too difficult), and they have to be there. With something like this, it takes one person to figure out what you've done and publish it on the net. Imagine how locks would work if one person, working remotely, could jam every lock in the country so they wouldn't lock.
David Thornley
True, but that starts getting very philosophical - you could ask why anyone buys MP3s from iTunes when they can just get them for free (the lock has already been broken), etc. As the old saying goes, locks don't really keep thieves out, they keep honest people honest :)
Chirael
I suspect the only reason people by MP3s from iTunes is that they've been brainwashed into thinking the media distribution war hadn't been won by the open community. "Derrr I guess the music industry owns the Internet.."
PP
A: 

You can't be 100% sure nobody will able to read your code, but you can make it very hard. You can encrypt your code and modify it during run time.

For example I have not heard of any successful attempts to reverse engineering Skype.

Maciek Sawicki
Is there some certain aspect of Skype you're talking about? A few months back I edited the Skype exe to allow me to run multiple instances of the client at once.
marco0009
Does anyone reverse engineered skype protocol?
Maciek Sawicki
http://www1.cs.columbia.edu/~salman/skype/ - Knock yourself out :)
marco0009
By the way Skype Windows client is actually written with Delphi ;)
Daniel Luyo
A: 

I am going to make the assumption that because you're writing shareware and you mention a registration algorithm you are wanting to protect your software from a keygen or patch that bypasses the restrictions on your trial versions.

Really the most you can do is deter. Like others have mentioned there are obfuscation techniques available, but they are not preventative. There are commercial software packers available which compress the file and make it initially unreadable. But the program has to be decompressed at some point so the machine can run it, so it's still reversible.

And that is pretty much the crutch against any of the anti-reversing techniques you'll see. It has to be interpreted by the machine at some point. More modern packers use anti-debugging techniques to deter the more novice reversers. But these techniques end up being documented rather quickly on popular reversing sites. Many of the techniques are bypassed with nothing more than a simple debugger plugin.

The only way I can think of to protect your executable from being arbitrarily reversed is to run the whole thing on a server you control and just pipe the output to users. But that's not always feasible.

As far as your language options go, take a loot at this. I can't really speak to how complete it is but I'm sure some others can add languages they think of.

marco0009
+13  A: 

I'd suggest the language of business and economics can protect your program.

If you are targeting consumers, and price it at say $10, almost all people would find it easier to pay you the $10 vs going into your program and reverse engineering it.

If you are targeting corporations, and say pricing it at $10,000, it just has to be easier to get the purchasing department to approve the payment than to reverse engineer your code. For real companies who would purchase your product, it's not worth the audit risk to have unlicensed code running.

Lastly, what are the costs/benefits of protecting your code? If you write your program in assembly instead of C#, you might have far higher production costs, while reducing the chance of reverse engineering. However, does this cost outweigh the potential lost sales? Could this time be better spent adding value for people who will buy the product? Generally, trying to sell your product to people who are never pay for software is not a economic strategy.

brianegge
It's enough that one person removes the protection, the decision doesn't have to be made by each single (potential) customer.
unwind
+3  A: 

"I'm looking for something that can be only decompiled into assembly."

Try writing your program in assembly. That is the best possible solution.

Noctis Skytower
if you write it in assembler, my experience is that your intentions are easier to understand. compiled code is harder to understand.
X-Ray
+7  A: 

Repeat after me: "Obscurity is not security."

You would be better off using a hard encryption algorithm (where "hard" doesn't mean "difficult", but "not bi-directional; not easily reversible".

Ether
Since all encryption algorithms would eventually have to produce code which can be executed in memory, all they do for "protection" is give the crackers more face when they crack it. **WHEN** they crack it, note, not **if**.
JUST MY correct OPINION
+30  A: 

Delphi is not dying, it is alive and well.

As is the community, at delphifeeds.
You can also see more delphi projects, Freeware, shareware and commercial at the Delphi Wikia.

Thus I'd say Delphi is a very good choice for Software Development. Freeware, Shareware or Commercial.

Schalk Versteeg
+1  A: 

If you're lookig "for something that can be only decompiled into assembly", that essentially means that you want to use a language that gets compiled (or assembled) directly into a native code executable.

The usual prime suspects then are C, C++, Delphi, VB6. Of course, also assembly meets your criteria, although I doubt you'd want to write any project of decent size in it.

PhiS
+10  A: 
  1. As the others said, Delphi is NOT dying. Not at all. For example, see here.
  2. As the others said, there is no bulletproof method.
  3. As the others said, there are tools to make the life of a cracker much harder.

But what the others didn't say is:

  1. Java, .NET (etc.) obfuscation is rather a toy compared with obfuscation toys for eg. Delphi and other native solutions. (of course YMMV)
  2. A very good technology to relatively protect your executable can be found here.
+1  A: 

Very simple:

No Programminglanguage,No Programm can Protect your Software. The Software Cracker will reversengine your App till it is just asembler and will crackt it.

streetparade
+7  A: 

You could write it in Perl.

(I kid, I kid! Put down the pitchforks!)

Ken
A: 

You could always write it in APL. You could deliver the source and still no one would be able to understand it.

Bruce
The modern approach is to use J.
JUST MY correct OPINION
+1  A: 

if you really concern about people disassemble your software, make your software as a service (SaaS) http://en.wikipedia.org/wiki/Software_as_a_service

technomage