Application Reverse Engineering Protection / Hardening

Question

I want to protect my applications from reverse engineering.

What I would like to do is protect the executable from any tampering, such as with hex editors, resource editors, and dis-assembly tampering.

My idea is to have the application check the hash value of itself against an imported value in a version file from the service server (probably an xml file or flatfile), then shut down the application or somehow disable it's functionality completely if the values do not match.

I am in strange waters here, so if anyone has any comments, suggestions, ideas, or code examples, I would appreciate it.

The Development Language is C++ but I would happily take examples from any language.

Thanks in advance for any assistance.

Answer 1

I'm afraid it's not that easy.

If someone has the ability to modify the executable, then they have the ability to remove any check the application does against a known hash.

You can do more complicated things, such as encrypt the application's data using the hash of the known executable as the key, but that only makes it slightly more difficult to circumvent.

---

The makers of all kinds of very expensive software have been trying to come up with a solution to this for decades - and their efforts have always been worked around by people with far fewer resources.

Answer 2

The short answer is you can't. You can make it more difficult, but ultimately your code has to run on the processor, so the instructions can be read, modified or ignored on the fly.

If you can control the hardware, then you can make it harder, but ultimately if people are determined enough, they can break through whatever you do.

Appeal to people's honesty, it's easier for you and probably just as effective!

Answer 3

The only solution that really prevents your software from being tampered is encrypting the executable and decrypting only that parts of it which are currently executed - and only if the decryption is done in a "trusted device", e.g. a USB dongle.

There are some products available which are pretty good, e.g. a product of my employer.

All software-only protection schemes can more or less easily be cheated.

Answer 4

Try obfuscating the code so that it would frustrate anyone trying to reverse-engineer it or have it self-destroy itself if anyone tried to tamper with it!