A Call to Piracy Arms

I think it's time we masterminded a solution to safeguarding our software. Armadillo being cracked makes spending $300 on it totally ludicrous. We need something that you can set a time limit on and after xxx time the game is disabled. Something internal that can't be cracked easily and users can't alter the time left.

Something that comes to mind is storing the time left online in a mysql table. But if a specially encrypted keyfile is present in the main game folder then the time limit is disabled. Hmmm...anyone have some ideas?

The trouble with that is the keyfile would get distributed.

So you'd need to lock it to hardware or IP, which A) rules out people with dynamic IPs, and B) inconveniences legit customers.

The bottom line is, you can't ever completely stop it. Don't get me wrong, Armadillo is a reasonable solution. I did a lot of sniffing about when I was looking for ways to secure my own game, and I found a crack for every game I set out for within minutes (purely for research purposes before anybody sticks the boot in).

On that basis I don't consider it to be a solution thats worth $300. If it was $50, then, maybe.

You also need to consider that, if you're using an online protection method such as checking keys in an SQL database, there could potentially be a vast amount of traffic, and you'd need to cover the cost and maintenance of that.

How about just store the time left in a file using some super encryption based on a key. Is there a form of encryption that is just insanely hard to crack?

What if they delete the file?

Multi Billion dollar companies can't prevent it so why bother.

The best thing to do is to secure your software to an extent that will stop casual Piracy. Anything else is just a waste of time.

Define 'casual piracy'.

You don't have to be Einstein to download cracks. One person can make it easy for everybody else.

The trouble is, if your code knows how unencrypt the time left, so does the canny pirate who disassembles it. Either that or they rip the check out of the code altogether.

Well, an example would be someone buying the game and letting other use the license key. Or to prevent someone making copies of the CD.

A little far-stretched, but what about uniquely generated .exe's? Admittedly, it's quite a bit o' work, and the user can't have his immediate download. The idea is that the programmer receives a buy order, then puts the name, cc number and email address into the source. Compile, and there's a unique exe the programmer sends to the buyer. Technically this doesn't prevent spreading, but the buyer could realize he'd be spreading his cc number and address info as well then. :P

I'm with Amon. Armadillo stops casual piracy (i.e home uses just blantantly copying an unprotected version) but not determined hackers. And people who visit warez sites wouldn't pay for your game anyway.

I'm not that bothered.

What about storing the time left in an online database that's created when the demo is first started up?

Well what I'm saying is that we can come up with a method to stop casual piracy and save even spending the $300 for Armadillo.

EDIT: Actually, an online key injecting system where the customer never sees the key would work. After it's unlocked online, it would then transfer over to reading a registry key. But ONLY after it's unlocked online.

So the steps would be:

1. Player downloads game and decideds to purchase
2. Player clicks Buy and is taken to an online ecommerce
3. After the player pays, there's a registry key added to the computer (the game doesn't look for the registry key until after the purchase is made...otherwise it looks online at the database for time left in demo mode)

Your best bet is to create your own solution, rather than getting the community involved. My reasoning is that the more games that use the protection, the more worthwhile it becomes for someone to crack it.

That actually makes perfect sense.

Well getting the community involved means just posting ideas. Not actually making the solution.

It never hurts to brainstorm. You then pick and choose what pieces to implement...now THAT makes perfect sense. :)

BlitzLockIT was wrote by myself, it offers anti crack protection.

it does not require any external .dll and is included at compile time for blitz. however it does not enable time trial but it would help to protect your own coded time trials.

email me if you would like more infomation.

kev

The developers of Aramdillo have been doing this for years, and they have a very solid product there. I don't know where all the talk of Armadillo cracks come in, because I've had an Armadillo protected game out for 2 years and never seen a crack.

It's pure fantasy to think a bunch of people from here are going to create something better than Armadillo without it costing a hell of a lot more than $300.

Dev cost isn't an issue because we don't have a dev team or a budget and there's no time schedule or ship date. It's all casual development...just like your development Gabriel.

It being better than Armadillo was never mentioned either. An alternative would be the proper term.

I think you're overcomplicating it. A simple, hard-to-crack system where regular gamers wouldn't even bother trying to crack it. That is the whole goal.

My development is not casual, nor is it without a budget.


You're entitled to your opinion. I'd be willing to bet dollars to donuts that I have a lot more knowledge on copy protection systems than you do, particularly when you use phrases like "A simple, hard-to-crack system" but if you'd prefer to ignore my advice and make it anyway, that's entirely your choice.

I would suggest a forum search for the dozens of other people who thought they could it in the past though.

a simple solution could be created by us, for free, that will stop casual pirates but not 'crack users'

I had an idea where the EXE file has embedded in it a text file.

The first time the EXE file is run it writes down a lot of details about the persons computer.(stuff you can get with blitz3d's system info commands such as gfxcaps)

If it doesnt match up the next time it refuses to run.

The only problem is that blitz cant modify its own EXE file when it is running.(with bbcruncher anyway)

but a text file (or .DAT file )could be placed in an obscure directory such as gfx\pics\fonts

and the casual pirate wouldnt have the patience or skill to see what file is being changed, he would probably just assume its the registry and give up.

Its a bit of pain in the arse to implement if you are not careful, you have to extract the file from your game when you are finished testing it before release.

I assumed it was casual because I've never seen you release anything. My bad.


If your bet includes Googling encryption methods then yes you're probably a bit faster at Google than me. An anti-piracy system doesn't have to be overly complex to be effective (hence simple but hard-to-crack). If you're as versed in copy protection as you imply then you should be able to read between the lines and see what I'm getting at. But you're too busy trying to play Mr. Bigshot.

Have some respect and don't turn my thread into your ego toilet.

Well, Chroma.

I tend to think of piracy as a non-issue. A store has extra cost built into the price to account for shoplifters they can't catch easily. Because they can't very-well search every person that comes into the store.

Electronic Piracy is even less of an issue. We don't have inventory, we don't really have a true cost-per-item. So if a million units go 'missing' we haven't lost any money.

People who pirate games aren't going to suddenly buy the game if they can't find it for free. They will just find some other game to play, and they will just not play your game. In that sense, they aren't costing you anything, because they aren't potential customers.

It would be like if Borders tried to kick me out of the store because I just read the book there and not buy it. All it would accomplish is to make me never come back to borders and they would lose all hope of over-coming me.

When it comes to piracy, I'm all for letting the quality of the games be the attempt to win over pirates. If someone develops a loveing relationship with your games, they will be more likely to buy the games later. Like how some people will download tons of albums, find something they really love, and go buy the albums and see the band live to support them.

That doesn't mean you shouldn't protect the game... Having it there, reminds the users to keep their nose clean... Borders may not kick me out for reading the book there... but they don't just let people walk out of the store with a stack of books either. It is more protection to keep the honest, and mostly-honest people honest.

That's how I think about it...

Bottomline. Preventing piracy should have 0 effect on your sales. Infact.. annoying piracy prevention can have a negative one (see, Starforce)

I wrote this some time ago...

http://www.blitzbasic.com/codearcs/codearcs.php?code=992

It's easy enough to modify so you'll be able to scramble your keys unique to your software... but as you can see plenty of nay sayers in the thread.

A game being sold for profit generally requires some form of anti-piracy (exception is freely distributed MMO type stuff where you pay a monthly fee). If it's not there it will be shared endlessly.

The issue is developing a simple form of anti-piracy. That's what this thread is about. Not about whether security should exist in the first place.

Thanks for the link. I'll check it out.

It seems to me that, as long as the executables and media required to play the game exist on someone's computers, there's no way you're going to keep a determined hacker from completely unlocking it.

You can, of course, move activation to a server on the internet, but couldn't a hacker just modify you're exe to think that you have a valid copy (bypassing the server activation)? Basically, the only way you can really prevent a single-player game from being pirated is to move the entire thing onto a server, only sending images to the user to be displayed (which would, of course, be impossible). Even then, someone would probably hack into the main server, and download the game anyway. Or they would find a way to fool the server into thinking they are a valid client.

Like some people here already said, don't spend too much effort on reducing anything but "casual piracy" (for example, someone "sharing" their game with a friend), since you can't.

Fighting against piracy is an up-hill-battle that you cannot win, neither today nor in the future. The only thing anti-piracy tools achieve is to annoy your paying and loyal customers.

So the only business plan can be to add value for the paying customers - the pirates will steal your software anyway, no matter how much effort you put in your defenses.

I think Infocom, back in "the good old days", had a very nice solution for this problem: The so-called "feelies" that they added to their boxes. A little item that physically represented an object from the game, but it was also required to solve the game, because it had some information on it that was not contained in the game itself. So basically only paying customers got the full value and were able to make it to the end of the game. The interesting point here is that this kind of "copy protection" actually gave the customer something instead of annoying him like the Microsoft or Citrix product activation does or all those ugly DRM mechanisms out there.

The goal must be to value the customer, not to treat him as a criminal.

Frankly I chose Armadillo because it was CHEAPER than me writing some encryption stuff (which I've done before by the way for a piece of commercial business software) and the key delivery system to the end user. Time = Money.

I wasn't making any boasts, simply indicating that I've worked with copy protection for a long time, and you clearly haven't. Frankly I felt you were rude to dismiss anyone who disagreed with you as though they clearly knew nothing. I realize in retrospect that you were a long way from reaching the extents of your rudeness.

I was merely pointing out that I've been working with copy protection for fourteen years and I was prepared to offer you the benefit of my experience, for what it might be worth. Perhaps my advice would have been worth something, and perhaps it would have been worth nothing. I figured it was worth an hour out of my day to try though, because I was concerned you might waste time going down some dead ends. But apparently it's not worth an hour out of your day to listen, so I'll save myself the hour and go back to working on one of the projects you've never seen me release.

Piracy protection is a waste of time as far as I can see it only hurts legitimate users who have to keep 'putting the cd in'. Who here doesnt use nocd's so they dont have to keep fluffing around with the cd, me personally wait till the nocd is released before buying a game unless its an amazing game that is a must have.

DampeS8N is right...

Nothing stops a pirate. Look at Blu-Ray and HD-DVD: they were supposed to be nearly uncrackable but it only took a few months to do it. Look at Starforce: that was such a terrible product that pissed off legitimate owners were cracking it just to gain performance and fix errors. Hardware dongles? Cracked. So why bother? Your match-3 clone is going to get hacked if it becomes popular enough.

I agree with what many people have said before: you don't LOSE a sale to a pirate because they would never buy the game in the first place. I'd rather release a hassle-free product and skip the protection all together.

How to ensure sales is to make a quality product and offer things like patches, upgrades and add-ons to legitimate owners. It's like movies you can download from a BitTorrent site- sure you get the film but it lacks all the extras. There will always be losers who will download those movies, but DVD collectors such as myself would rather pay to get the whole package. People who download films would generally never purchase the movie they steal.

If people like your product then they'll support it with a purchase.

Don't you think that if it was technically possible to prevent software piracy, the countless billion dollars worth of research that's gone into it over the last 30 years, someone somewhere would have done it by now? The only way to prevent piracy is to make a game that's worth buying.

Yeah, cos that works. :rolleyes:

heh :P

It all comes down to predictable actions.

A pirate, isn't going to ever buy your game, no matter what protection you apply.

An honest but un-informed user, will buy your game no matter what potection you have.

An informed honest user, will only buy your game if your protection doesn't hurt their system.

And an anti-protection drone will not buy your game if it has any protection at all.


The first and forth people aren't worth bothering with. The first isn't going to make you any money no matter what. And the fourth isn't going to be happy with anything.

The primary reason to have some protection is to prevent 'casual' or 'un-intentional' piracy.. Someone might not realize they can't distribute your game around for free. They might give it to their friends and family because it is good, not realizing they shouldn't be doing it.

It is these people who protection will keep in line.

Really.. You can't do a lot to prevent casual piracy either. If someone puts up a cracked copy of the game for download. That will fit a casual theif quite well. What basic protection does is force them to take that step. They can't simply remove some file that is making your demo say time is up.

Computers weren't designed with security in mind. They were designed to be easy to access and highly compatible/ They speak a simple language, that can be easily manipulated. The only way to truely protect your game, is if no-one can access it at all.

The trick is to find a balance between stopping the noobs without being so annoying people stop using the game.

A simple activation system over the internet when you buy the game is good enough (which is what I believe you were looking at when last we talked on the subject) it enable a demo, and prevent most people from continuing to use the game after the demo.

There will always be people that don't think it is amoral, or know it is and don't care, to abuse the system to steal things. Be they shop-lifters, or hackers, or legit pirates on the 7 seas.

I can walk into any store, with cameras, with those magnetic theft strips and what not, and walk out with free stuff..

I can walk into ANY walmart, pick up 100 games and DVDs that cost 50 bucks, and one that is on sale for 2 bucks and just swipe that one 101 times on the self-checkout to walk out with $5002 in games for $202. (mind you, I could then turn around, ditch the reciept, and 'return' them for 50% of what they are worth in some stores. And whatever they cost at the last sale in others. I forget which wally-world does...)

You can't prevent people from finding an abuse to the system.. You can only discourage the people who are on the mid-line and would feel bad about doing it.

In retail, you stand to lose money from people stealing your products. And THEY can't prevent theft.

When you talk about games, you are talking about people stealing something that doesn't cost you any money for them to steal. They weren't going to pay you for it ever anyway, and the only cost involved in an infinitly replicatable product like computer files, is bandwidth. They might be stealing 1 cent from you, but only if they downloaded it from you and not off some warez site.. then it didn't cost you anything at all.

It is a very material thought process, where an instance of something has value.

It helps to think of software sales as the customer paying you for providing the game to them. And if you are the creator, the customer saying "Here, I liked your game, have some money." Because there is no 'product' here. What you have is an infinitly replicable piece of data. They are paying you for having created it, and for allowing them to use it. People who refuse to pay you, wouldn't use it if they were forced to pay. So they are a non-issue.

Infact... there is evidence to suggest that they might be paying you in the form of free advertisement. If even one person who sees or hears about the hacked version, proceeds to buy the full version, you've made money. And if someone gets the hacked version for free, and their friends play it or hear about it, and one of them buys the game. That is again a sale you would have never made otherwise.

I personally think that warez might be a great way to BOOST sales..

0 cost theft + word of mouth off that theft = free advertisment.

for what its worth, I'm still willing to give armadillo a go, once I get those last few niggles ironed out (;-)

So if anti-piracy isn't that important...why spend $300 dollars for Armadillo? A simple security system to thwart wannabe hackers seems sufficient enough.

Once I've finished my niggles... I'll revisit Armadillo's licensing shpiel, but until I finish my product I can ill afford time with in depth analysis of armadillo, just from a first glance it seemed the product for me - albeit eventually. Time = money, yep.

But what about my suggestion: An online shop adds your sales details (including cc number) into the source, or into a .txt the source includes, then compiles the shebang again, and sends the user the uniquely created .exe. An exe which is easy to spread ofcoz, at the cost of spreading your cc + details.

Show me the cons on that one :D

I remember the Atari ST had a realtime clock and there was one register with 5 unused bits :) This could be used as a counter for 32 days, or 32 runs.

Not sure if there's such a thing in a PC. Once i used a pretty useless bit in the bios to store something. This just kicked the bios password out and reset the bios to default settings... No matter what you say - Qbasic was powerful.

One more idea: instead of storing something in a dedicated file you could use a bitmap that is already used by your game system (eg. logo). Assume it's BMP, you could store the data in the least siginficant bits of every channel. so you need 3 Pixels to store one byte (or 9 bits). You could even add a random bit every other time.

As long as your potential customer doesn't start his debugger ,disassembler and hex editor to simply skip your super secure routine by inserting a JUMP asm opcode somewhere, you won't be in troubles.

I like your way of thinking CS_TBL, you could populate the buyers details within a 'my-product' (or something to that effect) from the start menu.

Or just render the details into an image and show it at the titlescreen.. :P

ehh... I think that would be rather... bad. I'm sure it was a joke, but someone might take it seriously.

It's very effective. You don't dare spread it.. :-)

har har.. you wouldn't dare BUY it... or buy anything else on the same site if it didn't tell you before hand.

It would only scare me if I had the intention to spread it. If I'd be a honest citizen I wouldn't be bothered by it, ever..

yeah.. what if someone stole it off your HD? Or if you didn't want your kids to have your CC info.. I mean.. Who would want their CC number displayed in a graphic in the game...

Ok, in the options menu then. Point is: there's always some exception you can find. It's between unique exe files with user-details OR crack-guaranteed universal exe files. I rather make sure those kids wouldn't use daddy's cc to buy stuff, or they'll receive severe tuna slapping.

But ok, what about leaving out cc and replace it with the email-address he used to buy the product (paypal?)? Then the the pirate can spread it at the risk of spreading his name and email, making it risky for spam.

Would be much better if all instances of Windows has a unique number you could lock the exe too.... hmm...

I am still waiting for someone here to come up with a silent Steam-like module.

Obviously it does not work for a lot of games, but systems such as steam, or having the gameplay intertwined with a subscription service ala, World of warcraft or closer to home..... .Naked War.

I would be very interested to hear from John P. If going the subscription route rather than upfront sale was a rewarding experience (if he wishes to share that info of course).

Winni's comment about Infocom's method seems to bring up a good point: just have a file that prevents piracy and yet is vital for the game. If that's possible...

Also, what is this "gfxCaps" command that's supposedly in the Blitz3D command set that someone mentioned?

gfxdrivercaps3d()

Well it hasn't really been tried much, but it works as well as anything else.

How many Mastertronic games did you own? I must have bought at least 100.

Anyway let me just shoot down a couple of these suggestions:

It's illegal.

What about playing offline? Do you think the appeal of downloadable games, over (say) pjio or flash games is that you don't need an Internet connection to play? Next please.

Microsoft thought so aswell. They where also wrong - besides which it wouldn't work for the 50% of your customers that have a Mac.

So if I change hardware, my game no longer works? Microsoft already tried this, didn't work. Besides it would take all of 2 minutes to crack that protection.

That is far from the "only" problem. Another problem is that Blitz might lack the privileges to write to it's own exe file and/or directory.

The casual pirate wouldn't need to have any skill or patience because he can download a free tool from sysinternals, that does this for him.

You could have looked at the site in his sig. :o>

The obvious flaw with this hypothesis is that any form of protection that is simple to create, is simple to reverse engineer. It is absurd to think that people with little or no insight into how software is cracked in the first place, would be able to come up with an solution to this problem, particularly since people with scary math degrees have been working on it for more than 20 years with no success.

A bit off the general flow of discussion... but we created a system that really screwed our game's crackers over. We even had one of the guys who had pirated the game eventually buy it. Everyone could easily get in on it, and it's almost impossible for crackers to come to grips with. Tachyon said that nothing stops a pirate. Well, this method of anti-piracy (along with one other I've seen, which is more passive, even though this method is somewhat passive in how it works) actually do work.

If anyone would like to know how it works, chuck me an email and I'll explain.

The catch is that only a fraction of the computers out there have a unique number -- even though the case of your brand spanking new Dell machine has its own windows licence number on it, the pre-installed copy of windows on its harddrive has the exact same key on it as the other three hundred thousand people that bought the same model over the past year.

The serial on the case is only used for future re-installs, out of the factory the windows install is a complete clone.

It may help to hear what the hackers would do or try to get around the current line of protection systems. hope it helps.


Please note I use Hacker as a generalized term here.

Serial Keys : When you create a system that uses a CD Key, or serial key to authenticate the game, it creates tell tale signs in your compiled code, the problem is that a hacker, using a debugging tool, softice for example, can then scan your exe with it in assembly code, find the command finger print he is looking for and then just change it, for example, a serial key may create an AMS cmp command to compare the key with a valid key, the hacker can then just use a JMP statement to avoid the CMP, or he can edit the CMP and make sure its always true.

from CMP Key,Try to CMP Key,Key - this is pseudo ams ;)

Site Auth : This is nice, and works well but, forces your uses to be online, what a hacker will do here to get around this is setup a fake connection, trap all out gonging packets and scan them, once he knows whats in them he will then send the same information from his own application, his own application will then trap and display what ever your site checker sends back, he can then use this to fake a site response. and your site is out of the loop.

CD Check : See above.
Time Limit : This is probably the easiest one to by pass, a lot of the time you can simply just change the system time, or if the checker is good enough to detect this, which most are, then just use the same techniques set out above

There are not many other options, Valve came up with some interesting systems in steam, but that didnt take long to get cracked either, a smart individual took the time to find the section of the apps code that worked out if you had the game or not, and then cracked it so that steam thought he had ALL games. he was then able to download and play anything he wanted. he spread this of course and a lot of people got a lot of free play time out of it before steam was able to detect and ban them.

I think trying to come up with anything like a standard serial key, or time limit, would be a waste of time, as far as I can see the most successfully anti piracy systems online at the moment, are steam, even tho it got hacked, it took time, and only impacted a small amount of people.

If we had a version of Steam for Indie developers, now that would be something worth working on.

Hope this helps.

I think an Indie Steam would be an interesting idea...and yet I HATED Steam when it was released. I remember it took 12 hours for me to register and play Half-Life 2 the day it was released because the Steam server was bogged down and couldn't authorize my copy. Ultimately I was mad because it was this "copy protection" that was causing this ridiculous delay and I had legally paid my $50 at the store to play the game. I had the CDs in my hand...why couldn't I just play the damn game?!?

That is why copy protection sucks. Legitimate players suffer, hackers still win in the end.

Flameduck: then what's legal? Is putting only someone's name into the game legal? (so, no cc, no email etc.). Is inserting an ordernumber legal (so in case of piracy the original author could always trace back, in case the name of the buyer is a fake/alias)?

Flameduck you're missing the whole simplicity point. The goal isn't to prevent piracy at the 100% level. That is impossible.

Most customers don't alter the executable or even know how to. The one's that do wouldn't buy the game anyhow. No profit lost. So the goal is to keep it like this with a simple anti-piracy system.

Again, the goal is NOT to eradicate piracy 100%.

If we could get past the "hey, you can't stop piracy" and "a simple anti-piracy system won't work" type attitudes then maybe we could make some progress.

.

He actually started this thread first. Your attitude towards people is highly questionable and you'll just get ignored if you don't fix it.

Gobbo, I don't mind telling people what we did if they ask. It's not your usual method, so it's not like giving up some super secret technical thing ;)

There are other interesting methods out there too... the guy from Sillysoft had a great idea where he used his own website to convert pirates into customers. It's that kind of 'out of the box' thinking which will beat the pirating issue... not working out how to make your game uncrackable.

My two cents, anyway!

.

This and this might help as the same ground as this thread has been trod before.
IMO, If you want to stop people who are just going to reset dates, change files etc then you could create a binary with garbage in it plus a few proper fields. If somebody is going to view/compare the binaries and spot what changes then they're already more committed than the person a simple approach is going to stop.

.

... I was commenting on the 'simple method' debate.

I think the only viable solution includes online capability. Offline can always be hacked. A simplified version of Steam that is set up on YOUR own website would work. The only thing is the info used to access the db would have to be stored in the .exe which could be hacked.

It's massive overkill imo.

@Chroma, that is what leadworks suggest in another topic but a bit differently descriped if im right. This is also sort of what i was thinking of but than serialkey-based, instead of login info.
Im happy -after all- that this topic is working out. cause i dunno what went wrong in the other one.

Anyways, I am now working this idea out for leadwerks so we will see it operating soon.

About:
"The only thing is the info used to access the db would have to be stored in the .exe which could be hacked."

Not nessesarly. I am going serverside. All the app does is sit and wait for instruction. But communication is ofcorse done in a matter that it cannot be decoded, or simulated.

Exactly.

They don't have to. Five minutes of googling will produce a crack for just about any game worth stealing. All they have to do is copy the binary over.

Actually some of them do.

So can online. If they can break Steam, Everquest and World of Warcraft they can break everything.

Chroma, I don't know much about databases and stuff, but I was thinking you would just retrieve info from a database using a username and password to login...so there would be no sensitive information in the exe to hack. I don't know, but I picture it like this:

Client: "Can I run this program with username _____ and password ______?"
Server: "No"
Client quits program.

The only thing hackable in the exe would be the actual code that says to quit if the program isn't allowed to run, or the routine that interprets the server's response. You can place checks in a dozen different places and use third-party tools to make the exe less prone to hacking.

Steam can be hacked, but the people who would bother to do so aren't going to buy your app anyways. What you want to prevent is the blatant downloading that occurs on bittorrent and the like.

It wasn't such an issue a few years ago, because it would take all day to download a large file, but with present bandwidth speeds, I think it has become a real problem.

@Leadwerks, well, people can intercept TCP/UDP packets and read or modify information. And there are otherways to simulate a server.
What im saying is that the way you present it is fairly insecure. But i do know how to protect sush a system, that is using anti-reverse-engineering encryption methods with some tricks i do not disclose.

I will let you know when im done with my demo.

So then what's your conclusion FD?

A possible solution (just thinking)..
1. DEMO version: the game is FULLY PLAYABLE but it misses some things like levels, more music, high res gfx and so on.
2. User likes the game. So he/she go to the web and buy it (shareit - plimus & co). BEFORE downloading the FULL game the 'protection system' should do:
a. register the user information in a database (normal...but see below)
b. create a file (or many) to add to the FULL package (maybe using steganografy like suggested, adding info in the level file, creating .dat file & so on) - it should be quite simple with a php-server to create something like this (I have no idea!!!)
c. adding to game/software the possibility to check if an internet connection is available and allow to connect to the database to check the authenticy - eventually updating key & files.

Point a.
sharing the information of the user in a database for developers - so an eventually hackers (who need to register the first time to get the full code!) - is tracked. If the user will buy other game - many games of course!!! - he/she left a 'track' and developers could/need analize if he/she behaviour is normal or not.
Cons:
1. who is a 'developer'? Who can say that a dev is a hacker too?
2. Privacy legislation: not sure that 'trackability' (even anomyzed-obfuscated) is allowed.

Just an idea.

"1. who is a 'developer'? Who can say that a dev is a hacker too?"

You never know :)
FlameDuck and i have a challange where he will try to crack my protection in a matter of time.
I will even release the source code before we test (of the part that is to be included by the developer in his project), assuming that a hijacker pretends to be a developer. So FD should have a fair go at it.

Ok...how's this sound? And this would require an active server. Your .exe and the server communicate a series of packets verifying numerous sequences using different encryption algorithms and keys. Your computer sends a packet with some info...the server responds...then it takes that info and sends it back and they ping pong about 100000 TCP packets back and forth with different information that must follow a specific sequence. It tries this 3 times to allot for weird web anomalies. If you're not a registered owner of the game it won't play period.

This sequence changes daily. Using the most secure encryption methods known or using a series of methods that change daily in a random sequence.

A series of 100,000 codes composed of 8 alpha-numeric characters. You spread the check all through the code making it a biotch to bypass. Plus put in a CRC check throughout the code saying if the CRC changes then quit.

Gobbo, Gobbo, Gobbo... One thing you should know about Flameduck... He *IS* a man of his word.

If he doesn't crack it in an Hour I will come out of retirement and have a go myself LOL

I have the perfect solution to your piracy problems that nobody will ever crack or every copy, this is simple 'dont release your software' if its not out there it cant be cracked on the day of release and plonked all over the internet.

All other ideas are just pipe dreams, its not like you are dealing with amateurs here some of these groups crack and pack games for a living.

rofl!! @ EdzUp!!! i need a hour or so to calm down...

@LuCiFeR[SD], good good :) another hijacker :) good testing. anyone else? rawr.

Oh I don't really have one, apart from "make games worth buying". As long as software piracy (and copyright infringement in general) is morally accepted by the "man on the clapham omnibus", and as long as software developers insist on violating end-users "fair-use" provisions themselves by inventing increasingly ridiculous copy protection schemes, there is no way you're going to make so much as a dent in piracy.

The best example of this is that Splinter Cell game that used that new Starforce thing that nobody was able to crack for like a year. Didn't sell any better than any of the games that used lesser protection (or none at all, like say Galactic Civilizations II).

If I had the ultimate answer / solution, I'd share it in a heartbeat.

Not in Denmark. You're not allowed to store ANY personally identifiable information in a database, without the expressly written permission of the person it identifies.

CRC is good for random error detection, but very poor at detecting intentionally manipulated data. Even if you used a hashing algorithm (like MD5 and SHA1), they could just change the hash value and/or report the correct one to the server regardless of what it actually was (Google "man in the middle attack").

Okey guys, i finished my new schematic. This is what i am working out for Leadwerks and the guys who say they can crack this system.
I call it "AntiPirate"

Link: http://www.icetec.net/AntiPirate.html

Gobbo...what app are you using to make those flow charts?

that is WizFlow Professional

ohhhhhhh k

So, what ya say about this new plan (we sort of made up all together)? i think its going to work.

only problem i see is that we expect the customer to be online once a week between each use.

@Leadwerks: was your idea to have them login once and mark it as "bought" and after that forget validation?
or was your idea to have the software validate each week?

[edit]
^^ something offtopic: i just put my new website online: www.goldstarpcgames.com (just a logo a.t.m.)

[edit] Sorry...made a post that was overly rude.

I would have it validate any time an internet connection was available, and allow it to run offline for a limited number of days. Automatic updates wouldn't be too hard to add on top of that, I imagine.

And I actually wouldn't lock it to one PC. One of the benefits of Steam is you can login to your account anywhere, and no one wants their account info stolen, so people don't usually share accounts. I guess you have that marked as an optional features.

I would also use a single account for trials and purchases. You make a purchase with your account, and that account then has its settings changed to allow the user to access the product.

Yeah, that's all pretty much what I was thinking. That would be sweet.

Well, here we go again... back to coding please.

@Leadwerks: ok that's all covered. but i see an issue with:


You have the risk of people creating multiple accounts. As soon as the trail is over they register another account like:
abc@...
qwerty
123456

That is why i wanted to include the systemID. But you could work with "e-mail' instead.
They have to enter a valid e-mail adress and confirm that.
Let me know what you suits best and i will see if i can add it.

But isn't this idea still based on sending the server info and having it accept or reject the user as a valid player? How does this provide any additional protection (what's to stop a hacker from making a simple modification to the exe, making it think any server response means "accepted"?)

Because all it looks like to me is just a lot of hassle for a legitimate customer who wants to try/buy your game (and I generally delete games that force me to "register" for a trial - and I don't think I'm the only one).

Yes, that is the core of the idea, and will be. If you want "another" wrapper, you can go with Armarillo which i heard of is good but difficult.

Registration can be anoying, but it lays more in the way you present it and the ammount of questions asked and the time it takes. All that is asked with this system is an e-mail adress. Then a confirmation is sent together with a password which they can modify later. They confirm the e-mail and can play. This process takes less than 1min. A potential buyer wouldn't mind to register a copy this way for his own security, that is what i think.

It will be hard to modify an EXE to fake the response of the server.. the response is never the same. There is not really a way to fake it unless they crack the server first.
Or they would need to rewrite a part of the EXE, and still that would be a guess. But i doubt that is possible, and i think you are then talking about the elite-crackers.

Eventualy, you can always choose to add an extra wrapper or decode the EXE or apply something else.

I agree. If I can't install it and play, then I just uninstall. I am not giving any info just to try your game. Not gonna happen.

I could, but I don't know the way.

Then, in other words, the hacker security is no better than a good server-authenticated activation key system? If this is the case, then everything else just going to be unnecessary hassle to legitimate users when a hacker can crack the system in 10 minutes?

What I'm saying is, all the extra complexity (account creation, weekly revalidation, etc.) is all based on one thing: that the server verifies the requests. If a hacker can easily change the EXE to accept all requests, it's not much better than a simple server activation key system. In this case, there's only one thing that makes this method different from a server-validated key system: All legitimate users are put through unnecessary hassle.


Yes, the quickest way would probably be to reverse engineer the EXE and make a simple change so that all the complex server authentication is skipped. Considering the amount of hacking going on, I'm sure there are plenty of tools to do this.


As a few people here have already stated, all someone has to do is download a "crack" for you're game. If protection systems like StarForce and even Steam have been cracked, I would imagine cracking a system like this would be "childs play".


But people like me, TaskMaster, and literally every casual game player I know does not want to spend even 1 minute scrolling through registration pages on web-sites, reading instructions, entering usernames/passwords/e-mails, validating accounts through e-mail, etc., etc. just to play a demo.

If you want someone to play you're game, your game's going to have to be EXTREMELY appealing to get players to jump through hoops just to play a demo.

I don't even like to give my email to play a demo. To play a demo shouldn't require any information. Only a secure purchase should require information input.

:) He he - but now I've got that tune running through my head - doh !

You could also make it so the program actively requires correct informtion from the server to run, instead of just a passive yes/no response.

For example, you could make it so the server accepts a value and returns the correct translate that will keep the program from crashing. Or maybe the server returns some critical bit of data used in an encrytion routine or something. The point is that a hacker can't just hack out the server checks, because the app will crash if it doesn't get the needed info...there is some required bit of data it NEEDS from the server, and of course this data would change depending on what the client sends.

@John J. So what is your idea?

I do have to say that this client/server model is a bit more complicated than sending just Yes/No singals. But instead of me turning again into defending what i have came up with, i ask those who have theire issues, to come with a good alternative... otherwise it aint really helping. The subject of the topic is after all "A Call to Piracy Arms" and not "A Call to AntiPiracy Arms"

Lets please come up with a solution together, instead of nagging about it. Even tough it may be true, its still useless info if we have no solution and only stops me or someone else of working on somethinig that may actualy work.

Alternativly, you could use peoples IP instead of e-mail adres to link the trial info with? wouldn't that work? in this case people do not have to register. But maybe the systemID is the best idea?

Many people (although relatively few in the scheme of things) don't have static IP's. So you can rule that out.

No good either. Hacker buys the program and on a successful execution when it has downloaded the required bit has in memory a fully working exe. He/she then grabs this, rips out all the server checks and distributes the fully working cracked version.

Every method to date has been cracked. Not even the multi billion dollar companies can produce a system that works. I really would not waste time trying.

But it basically comes down to a yes/no response after all the "decoding", which is what a hacker is going to look for.


I would do one of the following:
1) Use a "light" protection that doesn't even try to stop hackers, but rather casual copying (for example, someone letting a friend install their game without having to buy it)
2) Buy a professional protection scheme if I'm really worried about stopping hackers (which isn't going to happen anyway)
3) Spend days developing my own protection scheme:

Personally, I would choose option #1, but if I was going to use option #3, I would basically make a system that involves alot of duplicated checks and duplicated code in unexpected places (to make it hard for a hacker to completely remove protection). There are many ways to do this, but I would make the protection system so scattered and duplicated in the program, that it would be a nightmare for a hacker to remove.


Exactly.

Hi john :)

1) well, it is hashed. with other words, it cannot be decoded.

2) about solution 3 "Spend days developing my own protection scheme" it is funny, because this is what i have been doing and working on. you shall see it when it comes out. it is a maze of forwarders and links that with a certan formula applied direct to another entry and so on. you need a computer to crack that as the human mind cannot contain whats going on there. i wrote these routines using sotware special made (by me) to produce such tables.

i think i still go with my plan, any tips of the community are welcome, because the more we have the better it may get.
but for now, i think this system im making is pretty secure...

i will think about the "registration" tough, for trail version. because it may indeed scare people off to actualy try a demo and get addicted :-P

i actualy do really apriciate the input of everyone. wre getting somewhere.. <- no joke :)

What is a "sush" table?

i don't have a name for it..
but here we go, (its just a little block, lets say 1 of +-80 blocks?) and these blocks are changed with a single click on the AntiPirate software. and this logic is very simple comared to the others..
actualy, it is also structured for development purpose, because this very table would also be scrambled on release.
also, for the developer it may seem understandible, but if this is compiled, a hijacker will go nuts on it as it doesn't makes sence when its compiled.

And than i don't talk about the encryption, and eventualy hashing of the results of this.
You may ask, what is all this good for? its purpose in function is very little, but it makes things complicated for debuggers and crackers etc...

the SDK is setup in sush a matter that it requires these tables, so cutting them out has no point because then the game will not work or just crash. but leaving them in meens your leaving in the protection. >:)

h.hsh=New hsh:h\a=1:h\b=60:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=60:h\d="7":
h.hsh=New hsh:h\a=2:h\b=86:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=86:h\d="'":
h.hsh=New hsh:h\a=3:h\b=64:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=64:h\d="!":
h.hsh=New hsh:h\a=4:h\b=8:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=8:h\d="H":
h.hsh=New hsh:h\a=5:h\b=57:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=57:h\d="4":
h.hsh=New hsh:h\a=6:h\b=3:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=3:h\d="C":
h.hsh=New hsh:h\a=7:h\b=78:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=78:h\d="{":
h.hsh=New hsh:h\a=8:h\b=9:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=9:h\d="i":
h.hsh=New hsh:h\a=9:h\b=21:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=21:h\d="u":
h.hsh=New hsh:h\a=10:h\b=25:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=25:h\d="Y":
h.hsh=New hsh:h\a=11:h\b=20:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=20:h\d="t":
h.hsh=New hsh:h\a=12:h\b=27:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=27:h\d="a":
h.hsh=New hsh:h\a=13:h\b=70:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=70:h\d="&":
h.hsh=New hsh:h\a=14:h\b=5:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=5:h\d="E":
h.hsh=New hsh:h\a=15:h\b=13:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=13:h\d="m":
h.hsh=New hsh:h\a=16:h\b=81:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=81:h\d="]":
h.hsh=New hsh:h\a=17:h\b=10:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=10:h\d="J":
h.hsh=New hsh:h\a=18:h\b=14:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=14:h\d="N":
h.hsh=New hsh:h\a=19:h\b=76:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=76:h\d="-":
h.hsh=New hsh:h\a=20:h\b=9:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=9:h\d="I":
h.hsh=New hsh:h\a=21:h\b=11:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=11:h\d="K":
h.hsh=New hsh:h\a=22:h\b=26:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=26:h\d="Z":
h.hsh=New hsh:h\a=23:h\b=20:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=20:h\d="T":
h.hsh=New hsh:h\a=24:h\b=26:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=26:h\d="z":
h.hsh=New hsh:h\a=25:h\b=2:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=2:h\d="b":
h.hsh=New hsh:h\a=26:h\b=22:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=22:h\d="V":
h.hsh=New hsh:h\a=27:h\b=15:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=15:h\d="O":
h.hsh=New hsh:h\a=28:h\b=18:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=18:h\d="R":
h.hsh=New hsh:h\a=29:h\b=55:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=55:h\d="2":
h.hsh=New hsh:h\a=30:h\b=92:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=92:h\d="/":
h.hsh=New hsh:h\a=31:h\b=80:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=80:h\d="[":
h.hsh=New hsh:h\a=32:h\b=21:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=21:h\d="U":
h.hsh=New hsh:h\a=33:h\b=16:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=16:h\d="p":
h.hsh=New hsh:h\a=34:h\b=74:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=74:h\d="_":
h.hsh=New hsh:h\a=35:h\b=4:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=4:h\d="d":
h.hsh=New hsh:h\a=36:h\b=19:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=19:h\d="s":
h.hsh=New hsh:h\a=37:h\b=23:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=23:h\d="w":
h.hsh=New hsh:h\a=38:h\b=65:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=65:h\d="@":
h.hsh=New hsh:h\a=39:h\b=22:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=22:h\d="v":
h.hsh=New hsh:h\a=40:h\b=13:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=13:h\d="M":
h.hsh=New hsh:h\a=41:h\b=88:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=88:h\d=">":
h.hsh=New hsh:h\a=42:h\b=27:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=27:h\d="A":
h.hsh=New hsh:h\a=43:h\b=69:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=69:h\d="^":
h.hsh=New hsh:h\a=44:h\b=72:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=72:h\d="(":
h.hsh=New hsh:h\a=45:h\b=24:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=24:h\d="X":
h.hsh=New hsh:h\a=46:h\b=54:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=54:h\d="1":
h.hsh=New hsh:h\a=47:h\b=67:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=67:h\d="$":
h.hsh=New hsh:h\a=48:h\b=94:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=94:h\d="~":
h.hsh=New hsh:h\a=49:h\b=12:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=12:h\d="l":
h.hsh=New hsh:h\a=50:h\b=3:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=3:h\d="c":
h.hsh=New hsh:h\a=51:h\b=12:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=12:h\d="L":
h.hsh=New hsh:h\a=52:h\b=90:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=90:h\d=".":
h.hsh=New hsh:h\a=53:h\b=18:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=18:h\d="r":
h.hsh=New hsh:h\a=54:h\b=62:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=62:h\d="9":
h.hsh=New hsh:h\a=55:h\b=10:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=10:h\d="j":
h.hsh=New hsh:h\a=56:h\b=6:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=6:h\d="F":
h.hsh=New hsh:h\a=57:h\b=89:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=89:h\d=",":
h.hsh=New hsh:h\a=58:h\b=91:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=91:h\d="?":
h.hsh=New hsh:h\a=59:h\b=8:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=8:h\d="h":
h.hsh=New hsh:h\a=60:h\b=83:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=83:h\d="\":
h.hsh=New hsh:h\a=61:h\b=56:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=56:h\d="3":
h.hsh=New hsh:h\a=62:h\b=84:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=84:h\d=":":
h.hsh=New hsh:h\a=63:h\b=61:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=61:h\d="8":
h.hsh=New hsh:h\a=64:h\b=7:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=7:h\d="G":
h.hsh=New hsh:h\a=65:h\b=24:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=24:h\d="x":
h.hsh=New hsh:h\a=66:h\b=11:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=11:h\d="k":
h.hsh=New hsh:h\a=67:h\b=82:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=82:h\d="|":
h.hsh=New hsh:h\a=68:h\b=58:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=58:h\d="5":
h.hsh=New hsh:h\a=69:h\b=16:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=16:h\d="P":
h.hsh=New hsh:h\a=70:h\b=19:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=19:h\d="S":
h.hsh=New hsh:h\a=71:h\b=7:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=7:h\d="g":
h.hsh=New hsh:h\a=72:h\b=15:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=15:h\d="o":
h.hsh=New hsh:h\a=73:h\b=6:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=6:h\d="f":
h.hsh=New hsh:h\a=74:h\b=53:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=53:h\d="0":
h.hsh=New hsh:h\a=75:h\b=71:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=71:h\d="*":
h.hsh=New hsh:h\a=76:h\b=87:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=87:h\d="<":
h.hsh=New hsh:h\a=77:h\b=73:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=73:h\d=")":
h.hsh=New hsh:h\a=78:h\b=17:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=17:h\d="q":
h.hsh=New hsh:h\a=79:h\b=68:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=68:h\d="%":
h.hsh=New hsh:h\a=80:h\b=66:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=66:h\d="#":
h.hsh=New hsh:h\a=81:h\b=23:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=23:h\d="W":
h.hsh=New hsh:h\a=82:h\b=14:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=14:h\d="n":
h.hsh=New hsh:h\a=83:h\b=53:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=53:h\d="0":
h.hsh=New hsh:h\a=84:h\b=5:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=5:h\d="e":
h.hsh=New hsh:h\a=85:h\b=75:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=75:h\d="+":
h.hsh=New hsh:h\a=86:h\b=2:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=2:h\d="B":
h.hsh=New hsh:h\a=87:h\b=17:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=17:h\d="Q":
h.hsh=New hsh:h\a=88:h\b=85:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=85:h\d=";":
h.hsh=New hsh:h\a=89:h\b=59:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=59:h\d="6":
h.hsh=New hsh:h\a=90:h\b=93:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=93:h\d="`":
h.hsh=New hsh:h\a=91:h\b=4:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=4:h\d="D":
h.hsh=New hsh:h\a=92:h\b=79:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=79:h\d="}":
h.hsh=New hsh:h\a=93:h\b=25:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=25:h\d="y":
h.hsh=New hsh:h\a=94:h\b=77:h\c=0:h\d=0:h.hsh=New hsh:h\a=0:h\b=0:h\c=77:h\d="=":

@Chroma

'Sush' = 'Such'

there has been a movie, i dunno what its name was, where they actualy worked with 3D encryptions xD.
that could be applied on this also. its not hard to protect things in this matter.
anyways, the below example is not 3D encryption, but it gives an idea on how im working...

i meen, "yay, blowfish can be cracked".. so what?

what if i go like:
blowfish encrypt
append extra bytes
blowfish encrypt
byte shift
blowfish decrypt
byte shift
blowfish encrypt
cypher decrypt
blowfish decrypt
cypher encrypt
byte shift
append bytes
blowfish encrypt
cypher decrypt
cypher decrypt
cypher decrypt
blowfish decrypt
cypher encrypt
byteshift
base64

done... well try to crack that.

any why not just MD5 a few bits of that, and append to that the "trial XX minutes left" request. and maybe repeat the same over that.
it will take ages before that is cracked, and if it is, i can just spend a week making these tables 100 times as long.
and maybe comeup with my own encyption.

eitherway, its not the encryption or communications that worries me, it is the fact that people can actualy cut and past the binary codes, and using assembly add pointers to skips pieces of code. but stil...

sorry for my english, i havent had time to go all about it and check it for typos.

Rhetorical...

Ah, what is your native language Gobbo?

Dutch xD (Netherlands)
But im making a lot of typos when im tired most of the times. my fingers need rest...lol

I personally wouldn't even waste my time on server side crap! Jesus, good old fashioned "spaghetti" code and embedding "some stuff(TM)" in music and picture files is good enough :P. it's all on how you read back said "embedded stuff(TM)" that makes it more or less crackable :P. That method is good enough to stop the average Joe from cracking/altering your code. And lets face it, the average Joe is the man/woman you are Trying to stop.

If somebody pirated anything I wrote I think I would be quite flattered...if it is good enough for pirates to take notice of, then it is good enough to earn you a few quid! If nothing else, it'll allow you to gauge the market response eh?

all protection can be circumvented with a simple machine code jmp instruction to bypass the offending check, the best way to make something secure is to release a crack yourselves that way at least you got there first lol

.

ahhhhhhhhh, right. So you assume my software isn't worth cracking :) damn, you are right LOL

*says sarcastically* Hmmmm… I wonder… maybe… THIS!!!

If Not file Then
Print “Sorry, can’t access date file.”
EndIf

EdzUp has already stated how to bypass your protection. Logging into a site for a datakey will not work.

.

.

Is this before or after you've written your adventure games?

You're also telling people (who like adventure games) to go to a website that doesn't even exist yet, and offering 50% discounts on products that you simply do not have.

I found it slightly peculiar that you named your website "to get more results at search engines". Never heard of metatags, then?

Not having a go - but this (and countless other reasons) is why a lot of people think you're full of hot air. You talk a lot but have shown no evidence.

@GfK: are you always like this? dont you have anything else todo than to be a pain for me with distrust and whatever complaints you come up with each time. it sounds pitty and i really wonder what type of guy you are and if there is anything else you do besides doing what you do on these forums.

also its not kind of you to publicly post my worklog in this matter, i now had to remove the coupon. it was intended for those reading my weblog because they are truly interested, and not because some guy is nagging about it with witty comments. it is removed for that reason.

about the search engines... meta tags is one way, but the domain it self is in fact another way.

about the hot air myth. you and the people you talk about can think what they want. as if i would even care about how you think about me. its not good anyway.
i go forth as i said, and you will notice by the time, that which i have spoken is anything but hot air. im looking forward to that day because all you just said will be proven false information by then.

now, im just letting you know i will ignore you from this day on.

Unlike you, I simply get on with the job and don't come here endlessly urinating into the wind.
Why are you getting out of your pram over it? Your worklog is visible to the entire world anyway.

Oh, and it wasn't really 'kind of you' to hijack Chroma's thread because your own thread wasn't getting the replies you expected.

.

@dabz: your making sense.
i didn't know there was so much vapourware kicking around, if i knew that, i would understand that the way i set it up would make people think im "one of those".

But "website that doesnt exist"?!?! explain that... because when i goto www.goldstarpcgames.com i get to see the logo i was talking about. Do you get 404?!

I think its better for me to suspend my worklog till next week or the week after, when i release the game.

about the screenshots, i had them posted in another topic the other day.

about hijacking Chroma's thread.. i never heard of such a thing, but it was never my intension todo that. its because some particulair people nag on me, then i go i response, then they go, etc... that is why i now choose to now ignore those, so we can get back on topic, because it will be endless. that i noticed.
proberbly if they knew where i was living, they would send in video's already... lol!

Chroma, your turn :-P *hands over the key of "A Call to Piracy Arms"*

http://www.blitzbasic.com/Community/posts.php?topic=69354#776342

.

Well you have a point, tough i never claimed it to be a website in that matter. I said it had just a logo ;)
but hey, you can sign up for the newsletter tomorrow (lol) :-P I am installing the mailing software today.

.

Wow, what a train crash this thread has become.

I still think a simple solution that hinders your average crack attempt will suffice. I see how easily a solution attempt can spin out of control though..weeee!

I think the subject "Warez" has done enough damage on this world.

Btw, how come Dabz deleted his posts? cause it where actualy some helpfull things he said. But maybe its a plot. you never know :-P

Because it has nothing to do with the topic at hand, and I was sure we we're done! ;)

Dabz

ah :-P

good idea.

Makes me wonder if digital download systems like Steam have been cracked... Valve seems like they had a nice concept, but was it really that good after a while? Well, you be the judge if digital distribution would solve any of these problems...

Yikes... I just did a Google search for "steam cracked" to see if there were any articles about steam having been cracked, and found this on item #1:


I don't know if this means people really can download all Steam games free, but obviously Steam has been cracked as one point or another.

It's already been said that there's not a game, application, or protection system that hasn't been cracked at some point. This means that the only way to reduce the risk of your game being cracked is reduce the amount of people playing it (or not sell it at all).

Obviously, Gobbo wants to make a protection system whether or not it's going to be effective, and I'm not saying he shouldn't. I'm just suggesting that legitimate users (especially demo users) should not be hassled too much, especially when some hacker is going to create a crack for your system and make all that hassle useless.

Gobbo: I may be wrong, but I think there was once a tool that took a Blitz3D EXE, and flawlessly produced a reverse-engineered BB source file (minus comments and correct variable names) that would compile again. This is definitely something you might want to consider if you're making your security system in Blitz3D.

Steam is cracked... i have seen a vid on youtube where one showed he had all the games available for download.

@John J. your last point, i am considering that, but i cannot say for sure my method works unless i find someone that can reverseengineer a B3D EXE.

But if one can do that, there is no point for anyone to do anything, because than people can also unlock fullversions if its protected or not i guess.

I just found the old thread, and it seems it was a hoax ;) Still, the you can always view the assembly of an exe, so the same principles apply - it's just a little more difficult for the hacker.


Well, basically that's true. Since even the top protection systems have been cracked, what makes you think you can do better?

On the reverse engineered B3d thing: would that also work when the exe is upx'ed, or something similar?

Probably not directly, but it doesn't make much difference, since the EXE has to be decompressed at some point.

Nope. That's only a problem if you intend to write the protection system in B3D. It certainly isn't the case for something like Armadillo.

Makes me wonder if that Steam crack was done by someone with connections with that HL2 Source Code incident... I can see what Gabe's reaction is to this right now... Anyone smell a DRM suit here?

Well that depends on how long your e-mail cue. relay time on my e-mail address is about 10 hours at the moment. I would certainly not buy a program that asks for my e-mail address (I get enough spam already, thank you very much), and even less one that takes me more than 10 hours to "register".

There is no such thing as a good alternative to a bad idea.

Contrary to popular belief, putting more locks on a door does not improve it's resistance to being opened.

That's because Armadillo refuses to start if you have a (widely known) debugger installed on your system, in much the same way many CD protection schemes refuse to launch if they detect (known) emulation software. People have found ways to circumvent both protection schemes.

FlameDuck, we have already progressed in our conv.. why dig up old replies?

@John J. true. tough i do want to try this serverside thing. i now want to know how long it takes before that is cracked. and i cannot forget my challenge with FD, now its a matter of wanting to know the facts. :)

Ok :) This will be interesting. I'd give it a try too if you want, but I don't know how to debug a straight EXE :)

Oprah!

Search for "kernel mode debugger" on Google. Or just get Syser or Rr0D.

FlameDuck you are evil. I just hacked into WOPR and started a game of global thermonuclear war. When the Army shows up I'm sending them over to your house.

Just as a curiosity, the Magix developers released a version of their flagship product (Samplitude) two years ago and nobody (as long as I know) has been able to crack it. I have no idea how they managed to do it. All I can tell is that it has a hardware dongle and it seems that the hardware dongle contains part of the compiled code needed to run the program. There are tones of programs out there protected by hardware dongles that have been cracked, but, as far as I can tell, this one hasn't. By the way, I own a registered version of this program, and work with it every day (I seld ProTools...)

Go ahead. I'm not home much these days anyway. :o>

Probably more like nobody ever heard of it, like people have said, obscurity is by far the most effective form of copy protection. Hardware dongles are evil - the one I got with my copy of 3D Studio Max was broken. What a waste.

Yes, when a dongle breaks it is a problem. You can send them the broken one and they send you another. And, well, samplitude is a very popular program, used to mix audio and music. Used at the BBC, and a lot of pro studios. The only real alternative to ProTools. Obviously if you are not a professional sound producer or something releated, it will not sound familiar to you. I'm a music producer.

So everything that is compiled can be altered with asm inserts. Is there a way to prevent that you think?

I agree.

Which is why I developed my own solution for the applications I desgin for other companies. The problem is that if a copy protection algorithm becomes common amonst many software titles, once it is cracked, it can crack all the software titles that use it.

I vary my algoriths slightly with different length keys for each application that I do. The algorithm requires the users hard drive serial number and I generate a key for my clients that when decrypted, (almost) matches that serial number. It doesn't match exactly. Doing it this way makes it difficult to build an algortihm to make a key that will work and difficult when attempting a brute force attack. The system is asymetric which means I use a different algorithm to decrypt to the one that I encrypt. There is a little more to it than that but you get the picture. It is 'crackable' though just like anything. Nothing is 100% secure. But then again, who is going to want to crack some software that was designed for a small shop on the high street?

As far as games go, I have always said that there are other ways to combat piracy and that is to simply let people copy it. Merchandising, brand names and you name it can be incorporated into games for a fee payable to the designers. So why can't ID, Valve etc. get someone like Nike or Adidas to sponsor them. The games could have their adverts in the game or even get the enemies/bots in deathmatch games to wear Nike t-shirts.

The money lost through piracy would then be made up with advertising revenue. The game designers get more money, the advertisers get their products known for longer periods of time and everyone gets to play the full (un hacked) game.

Prof.

That's only part of the problem with dongles. Other issues:

- If you have multiple programs that all require a dongle, you could run into the issue that you only have a single parallel or serial port, and cannot connect them simultaneously.
- Or even if they have a pass-through option for printers and such, that you cannot chain other dongles.
- Or even if you could, the design puts too much weight/strain on your port, possibly breaking it in the long un

Or even better: many of the old dongles are either parallel or serial.... Except more and more computers these days don't come with either connector anymore. (My new computer no longer has a serial port)
Even if you have a 'new' dongle which is USB based, what's to say that a few years from now computers won't ship with USB 3.0 and no longer have any of those pesky USB 1 or 2 ports?

dongles aritificially bind the program to a piece of hardware architecture, which may not be around as long as the program itself.

Hard drive serial number?? How do you get that?? Now THAT sounds good to me. That's also something that wouldn't change very often (if ever), unlike video cards, etc etc.

i got an DLL with functions to get the HD serial, or even your BIOS serial-number ;-)
But its under license.. i can tell you where to get it if you want. but im not sure if it works with B3D.
It was made for use with VB6 and C++ etc..

It's definitely changable... but a bigger issue would likely be harddrive upgrades.

After all, being mechanical in nature they tend to wear out before the rest of the computer does, and because of that tend to be replaced relatively often...

Not to mention upgrades simply to get more storage space.

IIRC, Windows XP verifies your system by fingerprinting pretty much all hardware present, and allowing a certain number of changes over a period of time... so you can slowly replace/upgrade a whole bunch of parts without it wanted to be reactivated.

C++ DLL Source

#include <iostream.h>
#include <windows.h>
#include <stdlib.h>

#define BBDECL extern "C" _declspec(dllexport)
#define BBCALL _stdcall

//DriveInfo Definitions
#define FILESYSNAMEBUFSIZE		1024 
#define VOLUMENAMEBUFSIZE		1024
#define INFO_TYPE_VOLUME_NAME	0
#define INFO_TYPE_SYSTEM_NAME	1
#define INFO_TYPE_SERIEL		2

/*DriveInfo returns one of three 
drive properties(Example is in Blitz+):-

	DriveInfo$(root$,0) returns the volume name
	DriveInfo$(root$,1) returns the file system name (e.g. FAT32/NTFS)
	Hex$(DriveInfo$(root$,2)) returns the drive seriel number
*/
BBDECL char * BBCALL DriveInfo( const char * Buf, int infoType)
{
DWORD dwSysFlags; 
	char FileSysNameBuf[FILESYSNAMEBUFSIZE];
	char VolumeNameBuf[FILESYSNAMEBUFSIZE];
	DWORD serial;
	char strSeriel[255];

	GetVolumeInformation( Buf, VolumeNameBuf, VOLUMENAMEBUFSIZE, &serial, NULL,
                        &dwSysFlags, FileSysNameBuf, 
                        FILESYSNAMEBUFSIZE);
	if (infoType == INFO_TYPE_VOLUME_NAME)
	{
		return(VolumeNameBuf);
	}

	if (infoType == INFO_TYPE_SYSTEM_NAME)
	{
		return(FileSysNameBuf);
	}

	if (infoType == INFO_TYPE_SERIEL)
	{
		_itoa(serial,strSeriel,10);
		return(strSeriel);
	}
	return("Unknown");
}


//Creates a hidden file, which is handy for config settings etc etc
// E.g.		result = CreateHiddenFile(fileName$)
BBDECL BOOL BBCALL CreateHiddenFile( const char * fileName)
{
	HANDLE hFile; 

	//Check to see if file exists
	hFile = CreateFile(fileName,       
                GENERIC_WRITE,              
                0,           
                NULL,                     
                OPEN_EXISTING,           
                FILE_ATTRIBUTE_HIDDEN,    
                NULL);   
 
	//If not, create a new one
if (hFile == INVALID_HANDLE_VALUE) 
{ 
	hFile = CreateFile(fileName,   
             GENERIC_WRITE,   
             0,         
             NULL,      
             CREATE_ALWAYS,      
             FILE_ATTRIBUTE_HIDDEN,   
             NULL);  
	if (hFile == INVALID_HANDLE_VALUE) 
	{ 
        return(FALSE); 
	} 
}
		
		CloseHandle(hFile);
	return(TRUE);
}

/* Declaration file contents

.lib "lib.dll"
DriveInfo$(rootPath$,type%):"_DriveInfo@8"
CreateHiddenFile%(filename$):"_CreateHiddenFile@4"
*/

Something I knocked up a while back, which may interest! :)



A license to use something as simple as that? Unreal!

Dabz

EDIT: And for BIOS details, I'd use this:-

http://msdn2.microsoft.com/en-us/library/Aa394077.aspx

There's code in the code archive for retreival of hard drive serial numbers.

[edit] http://www.blitzbasic.com/codearcs/codearcs.php?code=642

You can change your BIOS and HD serial number using software. Also in the near future, most laptops won't even have either, using EFI for booting, and solid state discs for storage. Nice try tho'.

So HDs wear out often but I've only changed mine like twice in the past several years.

What's another component that has a retrievable serial number that doesn't change often that could be used in a security app?

Maybe someone should develop a simple PCI card with a ROM chip that stores a unique user ID that can be accessed via a DLL. How secure would that be?

Not secure... im not going into detail this time. but it won't work.
your better off using either the HD, BIOS or CPU serial data.

but i would prefer the use of an online system like described above. But maybe without the "re-validation" thigy.

The ID PCI card would be just like a HD, BIOS, or CPU...

It's unnecessary but it'd work.

That's just like a dongle, except a billion times more annoying and inconvenient. Dongles don't work either, I've seen plenty of pirated apps that are meant to need a dongle. They are all way more expensive than your indie game would ever be.

That said, it must be one hell of a game you've got to bother shipping a dongle with it.

I haven't seen a single idea in this thread that can't be defeated by a single jump instruction.

But it has been entertaining.

No he's just panicking because he's bought into the ELSPA/ESA drivel about piracy killing PC games, and doesn't remember back when they said the same about the Amiga.

Far be it for me to point out, that quite possibly the best selling indie game of all time (Galactic Civilizations II which sold more than 100.000 copies in the first 6 months) had no copy protection to dissuade piracy at all. Instead Stardock tried the novel approach of treating their paying customers with respect, and giving them incentives to buy. It hit the #1 spot an EBGames PC sales, and #2 spot on all platforms.

Now, until you make a game that does better than that, it seems totally pointless to even think about draconian copy protection schemes.

Well, i would almost say i agree. But still it is better to stop the casual hijacker with a decent protection, than to have your game go arround unprotected.

If you want to insist on a key, keep it simple, because the best crackers are going to break whatever you have anyway.

I can give you some ideas anyway.

Make it based on a multiple hash that you can break into parts, perhaps hash each bit on the First Name, Last Name, email, etc.

You can then check the hashed parts individually, rather than using one function to check them all at once. Never just return true or false if you can avoid it.

Avoid storing any keys or anything like that in the program. Definately don't have any key generation code in the program.

Avoid performing validation upon entering the code. That's why lots of programs insist you restart them - it makes it harder to pinpoint where the validation occurs.

Re-check the bits of key in different parts of the code at different times.

If your program has an online component, take advantage of it. Remember though that there may be privacy laws here.

You'll still get your code cracked anyway.

Sounds good Craig, if someone could create a module for BMax like this that would rock.

well, im working on it for leadwerks. and in fact mine is way better as defined by Craig. im not saying his idea is bad, just saying my solution has all that and more...
but i guess i was not able to point that out as clearly as Craig did in my previous posts. :-)
anyways, what matter is that we have such a system soon.
i hope i can finish it quickly.

I don't claim to be an expert in securing software. These are just pretty common ways of doing it. Creating a module for doing it would be a bad idea in my opinion.

At best, you can get a system that won't be inconvenient for the people that paid to enjoy it, and is just good enough to give you a few days of lead time before the cracks get out into the wild. Since we're dealing with indy stuff here, you'll probably get more than a few days before someone bothers to crack it.

No, because whatever imaginary number of sales you think you're losing to casual piracy, is not worth the very real lost sale you might get from someone (like me) who likes to play games without having to jump through hoops to do so. FOr example when I went to New Zealand I had to carry nearly 200 CDs with me to play my legally purchased games on my laptop. How on earth is that not a huge inconvenience?

Why are you even that up in arms about preventing casual piracy? Isn't it better that two people buy one game which they "share", than to have them not buy the game at all?

Seriously! Why was the PS2 the most successful console in history? Because it was the most easily pirated one, and there was ready access to cracked games for it. Piracy is your best friend in a highly competitive industry - Microsoft understood this from day 1. Do you think anyone would be using Windows today if Microsoft had Vistaesque protection on early versions of DOS and Windows?

I think it's pretty cut and dry. Eliminate the JMP command!

@FlameDuck: You got a point there :-P hmm

Finally, they have come around to my way of thinking.
It took them long enough!

http://www.theinquirer.net/default.aspx?article=40447

An experienced person explained to me a long time ago, "There must always be a crack, otherwise how would the light get in?".

Darkheart