Re: Clever ways to hide a compare

I have yet to see a technique tha causes as much grief as the "maze of
garbage" approach in terms of the amount of work that needs to be done
to get around it. The weaknes with any concentrated evaluation is that
once it is found, its easy to break. Do a compare somewhere that
branches after the compare and you are dead meat. Change the opcode for
JE to JNE and you have usually defeated that protection scheme and
fortunately most of these have disappeared.

Use global scope variables and they are nor sequentially tracable so
you can write something to it in one location ad use it somewhere else
with no obvious connection. Enabling bits of code on the basis of
correct keys can be done well and be very hard to find, distributing
string data through an app is no joy to find and if you want to give
them nightmares, try using basic dynamic string for constructing
various bits of string data.

Shove the result through an decent EXE compressor that does not have
automatic expansion like UPX and you defeat simple patches and people
tweaking bits with a hex editor.

Looking for the single simple big hit is a surefire way to get you
software broken easily but distribute it all over te place and you
increase the workload to defeat it by some powers if you do it
properly. With enough time, any system will be broken, particularly if
its a sought after app but the more work it is, the longer it will take
to be broken and idiosyncracy works well for you here.

Regards,

hutch at movsd dot com

.

Relevant Pages

  • Re: Making an App wait 3 minutes without using sleep() function...
    ... As far as the human engineering aspect, having it send a UDP message to a known host/port ... Which means as soon as someone figures out how to defeat your app, ... MVP Tips: http://www.flounder.com/mvp_tips.htm ...
    (microsoft.public.vc.mfc)
  • Re: Hardware delaying the OS
    ... > There is no limit on blocking in a dispatch routine; ... This will defeat any app which will like to work with your device in async way. ...
    (microsoft.public.development.device.drivers)
  • multiline textbox line feed
    ... i've got a multiline textbox into which I have put string data from my ... nvarchar to see if there was any difference - there doesn't appear to ... when I try to compare the datasset value with the value in ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Not to display "OK" button
    ... I once tried to create a template that would create a dialog-based app the way I wanted ... I spent a couple days on the problem, ... So we have to defeat it. ...
    (microsoft.public.vc.mfc)
  • Re: Slovenia - Scotland tomorrow (or so Im told)
    ... That is compare the thrashing Holland gave us to the close defeat by Italy. ... There is no doubt that the team's overall performance under Smith has been an improvement despite the first half the other day. ...
    (soc.culture.scottish)