Problem - Kevin Tafuro

tecture-specific checks to determine whether the environment is safe for execution.
These checks can be benign (such as ensuring that the minimum amount of
memory or CPU speed is met) or aggressive (such as searching for the presence
of a debugger). Environment validation can be bypassed by running the software
in an emulator, removing the dependency on the environment check, or
modifying the signatures and behavior of software and hardware components on
the local system.
Integrity validation
The software examines itself and its components in memory or on disk to determine
whether it has been modified since compilation. This often takes the form
of producing a digital signature for the software and comparing it with a valid
signature, although the comparison may be eliminated by using the signature, or
a transformation thereof, as critical code or data during the execution of the software.
Each of these approaches has its advantages, and each has its flaws. Input validation
is trivial to implement and sells well because of the illusion that strong encryption
provides strong protection. However, it is trivial to detect, and the input can always
be intercepted during a valid execution of the software in order to crack the protection.
Hardware validation is difficult to bypass and is effective against debugging and
disassembly of the software. On the downside, it is expensive, difficult to implement
effectively, and requires that the hardware itself be trusted, which is virtually never
the case. Network validation is also proof against debugging and disassembly
because all validation is performed remotely and required code or data is supplied by
the server upon validation. However, it requires that the network itself be trusted
(which is not necessarily the case on a local network with no Internet access) and can
be broken once a valid execution of the software has been monitored. Environment
validation is effective at demanding more skill from a potential attacker. It is trivial to
detect, relatively easy to bypass, and very costly in terms of development and debugging
time. Integrity validation is simple to implement and addresses the issue at the
core of software protection. It is also easy to spot and can quickly be bypassed when
the signatures used to verify integrity are stored locally.
There is no single, correct technique. The best results are obtained by combining a
number of different techniques: for example, using the correct signature from an
integrity validation as the key to decrypt portions of the software during an input validation.
It is difficult to name any specific technique, or even a combination of techniques,
that can be considered a reliable protection mechanism.
Discussion
The key to writing a good software protection mechanism is in knowing and not
underestimating the typical software protection cracker, and assessing the goals and
costs of protecting against attack.
Understanding the Problem of Software Protection | 649
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.