|
if i have a serialized struct object with these information:
bitmap
string
string
byte[]
can an hacker load the serialized file and see these information that is get the bitmap file, the strings...
Also:
if i've an .exe with embedded a bitmap, can he get the bitmap?
|
|
|
|
|
The answer is yes to both questions. If your software can use the object or bitmap, so can anyone else through debugging and reverse engineering.
The only effective way to prevent this would be to encrypt your sensitive content and have the decryption key entered by the user. Having the software automatically decrypt the content with a key contained inside the software or system itself is no different than the original situation because anyone can just follow along and wait for your software to decrypt the content on its own.
|
|
|
|
|
How much time do you think the hacker is able to get the key within the .exe and decrypt the file?
|
|
|
|
|
I have windows forms application, where user can select images to be loaded from FileDialog. It creates thumbnails of those and displayes them in listview...its taking longer then expected. Users generally select 30-35 200DPI .jpeg images. I am using Imagelist & Listview combination....I think problem is of windows painting(invalidate or refresh)...I do beginUpdate,endUpdate before and after adding items.
How can i boost performance of this task?
Any help will greatly be appriciated..
Regards,
MaulikCE
|
|
|
|
|
1. Make sure all your images already contain an embedded Thumbnail image
2. Only load those images in the visible area (in other words, don't load them all, only what the user can see on the screen)
3. Thread it so the loading process doesn't "tag" your window
|
|
|
|
|
You have to save your thumbnail images and just load them next time except shrinking the original images again and again.
Thumbnails can be stored in some pre-defined directory with hashed filenames. I have developed such very standard system of storing thumbnails based on MD5 hashing. It works this way:
1. Check if the image is small enough (no need to create thumbnail => return)
2. Create MD5 hash from image's FULL path (C:\My Documents\Pictures\ ...)
3. Look to your Thumbnails directory, if there is a thumbnail created
3.1 Yes, load thumbnail
3.2 No, create thumbnail and save it in Thumbnails directory
This is my method for generating MD5 from path string (it returns MD5 in hex format):
<br />
using System.Security.Cryptography;<br />
using System.Text;<br />
<br />
...<br />
<br />
protected string HashPath(string path) {<br />
<br />
ASCIIEncoding enc = new ASCIIEncoding();<br />
MD5 md5 = MD5CryptoServiceProvider.Create();<br />
<br />
byte[] buffer = md5.ComputeHash(enc.GetBytes(path));<br />
string hashPath = "";<br />
<br />
for (int i = 0; i < buffer.Length; i++)<br />
hashPath = hashPath + String.Format("{0:X2}", buffer[i]).ToLower();<br />
<br />
return parentPanel.hashDirectory + hashPath + ".jpg";<br />
}<br />
...and of course, optimize your code of thumbnail creation. Use fast GDI+ filters for resampling images and put it all on background separate thread.
Hope this helps 
|
|
|
|
|
How to check if the string can be a valid XML element name?
In other words, I'm looking for this kind of function:
<br />
bool XmlValidate(string name);<br />
<br />
XmlValidate("RightElement" );
XmlValidate("2 Wrong ,@# Element");
|
|
|
|
|
I'm not sure about a validate function, but you could do it this way:
using System.Text.RegularExpressions;
.
.
.
// reg ex to validate an XML element name
Regex reg = new Regex ( @"^(?!xml)[a-zA-Z]\w+$", RegexOptions.IgnoreCase );
if ( reg.IsMatch ( "STRING TO CHECK" ) )
{
// do something with it
}
I did not verify the regular expression string against all possible errors (malformed element names), but you should be able to correct any mistakes or add characters that you want to be valid. I don't like to use anything other than what is already there.
Hope this helps
|
|
|
|
|
System.Xml.Serialization.CodeIdentifier.MakeValid() just check if the returned value equals the input value.
xacc-ide 0.0.99-preview7 now with C#, C, C++, IL, XML, Nemerle, IronPython, Perl, Caml, SML, Ruby, Flex, Yacc, Java, Javascript, Lua, Prolog and Boo highlighting support!
|
|
|
|
|
When The RED X on the parent form is pressed, what is run? It seems like the child form_Closing runs prior to the Parent form_Closing event. I need to capture the X press before it does ANYTHING... including kill the child form. Any ideas?
Thanks
*****************
"We need to apply 21st-century information technology to the health care field. We need to have our medical records put on the I.T." —GW
-- modified at 11:12 Friday 21st October, 2005
|
|
|
|
|
Add this simple code to your main form class:
<br />
protected override void OnClosing(CancelEventArgs cea) {<br />
<br />
if (there are any MDIs)<br />
cea.Cancel = true;<br />
else<br />
base.OnClosing(cea);
}<br />
|
|
|
|
|
Great... thanks,
I think I can get the rest... will write back if not.
Cheers
*****************
"We need to apply 21st-century information technology to the health care field. We need to have our medical records put on the I.T." —GW
|
|
|
|
|
Hello all, I am brand new to the C# world and am having issues with my first program. Below is the code, and I am getting an "Unassigned local variable" on the Console.Write for the finalSalary variable. Is my problem with data type, or more likely the conditional? Thanks in advance for the help, and I appologize for the simplicity of my problem!
<code>using System;
namespace EmployeeSalary
{
/// <summary>
/// Calculates employee salary based on experience, birthday, position, and company success
/// </summary>
class EmployeeSalary
{
[STAThread]
static void Main(string[] args)
{
int executive, //employee's executive status
baseSalary = 5000; //employee's base salary
finalSalary, //employee's final salary
experience, //employee's years of experience
birthday; //employee's birthday bonus
// Employee's executive status (1 = exec, 2 = not exec)
Console.Write( "Please enter executive code (1 = yes 2 = no): " );
executive = Int32.Parse( Console.ReadLine() );
if ( executive == 1 )
Console.WriteLine( "\nSorry, you're an executive, no benefits for you!" );
//Employee's years of experience (1 = less than 3 yrs, 2 = 3 to 5 yrs, 3 = over 5 yrs)
Console.WriteLine( "\nPlease enter your experience code (1 = less than 3 yrs, 2 = 3-5 yrs, 2 = over 5 yrs)" );
experience = Int32.Parse( Console.ReadLine() );
if ( experience == 1 ) finalSalary = baseSalary - 2000;
else if ( experience == 2 ) finalSalary = baseSalary + 2500;
else if ( experience == 3 ) finalSalary = baseSalary + baseSalary;
else Console.WriteLine("That is not a valid entry");
//Write final salary
Console.WriteLine(finalSalary.ToString("c"));
}
}
}</code>
|
|
|
|
|
The ";" at the end of code baseSalary=5000 stops the int declaration.
Add "int finalSalary=0" and your code should work fine.
Its a good practice to always add type "int" before variables
hv fun
|
|
|
|
|
I knew it would be something simple. The semicolon is actually not there in my initial code, I was rearranging things after I posted it so it would be a little more clear.
I think assigning 0 to finalSalary should do the trick, thanks for the help, I'm sure I will be back for more!
|
|
|
|
|
> Its a good practice to always add type "int" before variables.
 But then it is so hard to do things like floating point math, string manipulation and all kinds of object oriented stuff. 
Matt Gerrans
|
|
|
|
|
It is entirely possible that finalSalary will not be assigned a value before it is used in execution (consider if experience is not 1, 2, or 3). This is what the compiler is complaining about.
You could assign finalSalary a value right after you declare it. You could also make the else branch assign it.
|
|
|
|
|
Your problem is that it is possible in your if statement to never assign a value to finalSalary since you declared finalSalary at the beginning and did not initialize it. So if someone enters a "4" at your prompt the code will execute the final "else" statement and write out to the console "That is not a valid entry" but will continue on to the final Console.WriteLine which will try to execute with an uninitialized variable.
Visual studio is smart enough to detect when people try to initialize variables inside of "if" statements but not smart enough to know if all paths assign a valid result to the variable so it always throws a flag when you try to do this.
The answer is to do one of the following:
1) initialize the variable at instantiation
2) move the Console.WriteLine statement to inside each "if" clause that you want it to print the final salary (probably your best bet since you don't want it to write out if the users response is invalid)
Hope this helps
|
|
|
|
|
I have an application that I've written using C#. I want to incorporate trialware functionality so that a user can run my program for X many days. Any suggestions on this?
I don't consider simply reading/writing to the registry an acceptable solution. Nor do I like the notion of a license file, As i am not maintaining any server. Perhaps some combination of these would prove an adequate solution.
I want to prevent the following:
1. user setting back the clock to get more free trial.
2. Uninstall - reinstall to get a new free trial
3. hacking a file or registry to turn off the trial. <- I don't think this is likely, given the intended customer base.
Thanks for your help.
|
|
|
|
|
Read http://www.codeproject.com/dotnet/xmldsiglic.asp[^] but even this won't satisfy your requirements. In fact I don't know of any technology available that will satisfy your list for .Net Framework.
Simply put, the old mechanisms and behavior necessary to do licensing on C/C++ runtime binaries will not work for anything that uses the .Net runtime. I do not know of anything that functions like FlexLM for .Net simply because of this, although I admit I haven't looked recently either. If you want rigorous license enforcement you might want to consider using C/C++ under Win32 instead.
|
|
|
|
|
thanks tom,
yes that is true, every code is hackable one way or the other.
i have looked into some of the product's out there that just do licensing. but they are very costly. but the one i liked is
www.xheo.com
thanks for the help.
Samar Aarkotti
|
|
|
|
|
I've done a bit research on the subject where the primary problem is that even signed binaries and assemblies can be subverted to avoid any license check. That is just the nature of the .Net Framework since it doesn't obey the classic rules for binary handling. The reason why classic C/C++ can be strongly licensed is that the runtime rules are tied deeply into the OS behavior. In .Net the rules are enforced only by .Net itself and therefore are much easier to subvert.
I've mentioned this before in similar questions on the topic: The .Net Framwork is wonderful for many things but being hardened isn't one of them. If the requirement is have a hardened, highly unhackable app you need to chose some other technology.
|
|
|
|
|
I beleive that is true, not anything like C/C++, even if i store the license file or something in the Isolated storage with Rigdal or some kind of encryption, it is still prone to hack.
but i guess average developer or user wouldn't try hard to read the assemblies and extract the code.
i guess i have to write a hack proof license management software 
the best way to go is to have a server authentication , when requested for license, server can create an encrypted license which is digitally signed. and pass it over to the user , and every time user run's it , validate against the server.
well i can keep on writing on the issues.
thanks
Samar Aarkotti
|
|
|
|
|
I wish you luck. If you find a bulletproof solution then you should sell it. This is the level of stuff Macromedia is wrestling and I don't think they've got a solution yet.
To hack that scheme you've just described I would recommend: Disassemble the binary executable to figure out the when the call happens to check the license file. It becomes a matter of simply removing the places it is called in the IL or altering the function to always return "yes I'm licensed" depending on which has a larger impact on the IL. Copy all of the rest of the IL into a new hacked version. If you really want to be clean you'd also remove the call to request an encrypted license file from the server using the same methods.
If there is no SSL, an even simpler way to do is just hang onto the encrypted license file and continually serve it to the application.
I've worked with a licensing scheme somewhat like you've described (btw, the server bit is a bit more complex than I suspect you think ). It is "good enough" but hardly hardened and light years away from bulletproof.
I would love for someone to come up with a .Net way of doing this kind of hardened licensing but all indications it is not possible inside of the .Net Framework. Instead to do this it has to come from *outside* where the very nature of assembly loading is tied in. This means that Fusion itself must be changed to do some more strenious validation. It must be done at that step because the moment you allow any IL to run on the CLR you've opened a place where you can subvert the license mechanism.
-- modified at 16:59 Friday 21st October, 2005
|
|
|
|
|
well in that case, create the license on the serverside for every new instance of the application and have it check against it, the only difference would be is to sign a new license everytime when the client connects to server with the minor difference of have append some kind of random string along with the computer name, or CID name or something like that.
changing license on the FLY for every invocation.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
