Re: Reverse Engineering - C# Discussion Boards

Colin Angus Mackay31-Jan-06 22:12

31-Jan-06 22:12

emran834 wrote:
C# application actually is an Assembly which can be easily DisAssemble with some software and people will be able to see the source code

All .NET applications (whether they are written in C#, VB.NET or whatever) compile to MSIL. The .NET Framework SDK comes with an application called ILDASM that disassembles this IL code.

There are some tools, such as Reflector for .NET[^] that will generate C# code that looks somewhat similar to the original.

emran834 wrote:
If it is true, then, is C# is kind of a HTML language which is open for all ?

No, it is nothing like HTML. For a start you cannot edit it in a text editor. However, it is open and it can be read with a suitable application. It needs to be for things like reflection to work.

emran834 wrote:
There is really some way I can wish not to disclose my Source Code

You can use things like obfuscators to make it more difficult. But rememeber that even native assemblies can be disassembled. The bottom line is that the application code will have to be readable at some point in order for the computer to actually run it. There is no solution that will work in its entirity - only solutions that make it more difficult.

emran834 wrote:
If I make my Application to check a Liscence Serial number to verify genuine User, The pirator can DisAssemble my Assembly and See the Serial number part of the code and fool the software, right ?

If it is a serial number then are you compiling a different version of the software for each and every user? I think you really need to think about your licence management strategy a bit better. You may want to think along the lines of producing an digitally signed encrypted file that your application can decrypt and verify came from a genuine source.

ColinMackay.net
"Man who stand on hill with mouth open will wait long time for roast duck to drop in." -- Confucius
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell

-- modified at 4:12 Wednesday 1st February, 2006

emran83431-Jan-06 22:59

31-Jan-06 22:59

Hi Colin Angus Mackay,
Thank you for clearing my concepts. Ok, I have a confusion. Is it really possible for anyone to modify my distributed program in his own way and start reselling it ? I mean, he can do reverse Engineering and get the code and change the CopyRight Infor into his name and modify anything he wants ?

About Liscence matter, I am planning to distribute my software and user will have to be registered in my website. And then, everytime he use the software, software will connect to internet and send the User's Id number, and my Online PHP program will check if the ID is a Valid User, if So, then PHP will send back Position Permission to run the software. And Software will wait for the response from Website. Once Website confirms then it will run. So, Is this way safe way to protect my software or someone can modify the software so that the software will not need to wait for Website Response to Run.

Thanks and regards
Emran

-- modified at 4:59 Wednesday 1st February, 2006

Colin Angus Mackay31-Jan-06 23:26

31-Jan-06 23:26

emran834 wrote:
Is it really possible for anyone to modify my distributed program in his own way and start reselling it ? I mean, he can do reverse Engineering and get the code and change the CopyRight Infor into his name and modify anything he wants ?

Yes, and that applies equally for any application regardless of how it was developed or the operating system it runs on (or even if it is the operating system). Obfuscators just slow down an attempt to do this.

emran834 wrote:
And then, everytime he use the software, software will connect to internet and send the User's Id number, and my Online PHP program will check if the ID is a Valid User, if So, then PHP will send back Position Permission to run the software.

And if the user doesn't have an internet connection at the time they run the application? There are also privacy issues to deal with. Will users agree to have the application call home each time it is run? They could consider it a breach of privacy.

emran834 wrote:
So, Is this way safe way to protect my software or someone can modify the software so that the software will not need to wait for Website Response to Run.

Yes, it would be possible (although improbable) that someone might modify the software to bypass this. So far, there hasn't been any licence manager that hasn't been cracked by someone.

The way I see it is that a licence manager is just a device that slows down potential software pirates and irritates genuine customers by you treating them like criminals.

As I mentioned there could be a licence file that contains details of the licence, how long it is valid and so one. This would be digitally signed (so the application would know it comes from you) and would be encrypted. This would be a one time action (or once per licence period). The file would be encrypted with a public/private key. You hold the private key, everyone has the public key (so everyone can decrypt the licence file - this is just to prove the authenticity of the file). The file would also contain a hash value (the digital signature) which shows that the file has not been modified or tampered with. If a cracker wants to create their own licence file then they would have to find the private key (which you never give out). It doesn't matter that anyone can read the file as to modify it they would need the private key.

This is what I would see as a reasonable compromise. The bottom line is that all the security measures you put in place to keep your application out of pirates' hands cost you money. How likely is it to be pirated? Who are your user base? How much are you charging for the software?

ColinMackay.net
"Man who stand on hill with mouth open will wait long time for roast duck to drop in." -- Confucius
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell

emran8341-Feb-06 2:03

1-Feb-06 2:03

Hi Colin Angus Mackay,
Thanks for your reply with valuable information. So, it tooks like, only digitally signed liscence file is an efficient way to give the pirator Hard Time. Would you please show me any URL of an Article about how to perform this operation , I mean how to make Digitally Signed liscence key, Private Key, etc.

Thanks again.
Emran

Colin Angus Mackay1-Feb-06 2:26

1-Feb-06 2:26

emran834 wrote:
So, it tooks like, only digitally signed liscence file is an efficient way to give the pirator Hard Time

Not the only way, just the way that I would suggest is a balance of costs and effectiveness.

emran834 wrote:
Would you please show me any URL of an Article about how to perform this operation , I mean how to make Digitally Signed liscence key, Private Key, etc.

The best souce I've come across is actually from a book: C# Data Security Handbook[^] - It is quite a complex area (which is why many people buy pre-built licence managers) but the book does a very good job of building up knowledge from little or no existing knowledge of cryptography.

ColinMackay.net
"Man who stand on hill with mouth open will wait long time for roast duck to drop in." -- Confucius
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell

emran8341-Feb-06 9:08

1-Feb-06 9:08

Hi Colin,
Thanks for the kind information for telling me about the right book. Otherwise i would have needed to spend and experiment hours to select the right book. Although I was Surprised why this book is out of print from Amazon.

By the way, What is the PRE BUILT LISCENCE MANAGER Solution !. If I can just get it then I dont need to reinvent the wheel by learning so complex theory, right ? So, will you please give me a link about a PreBuilt Liscence Manager, it would be great !

Thanks and regards, for your time.

Emran

Colin Angus Mackay1-Feb-06 11:25

1-Feb-06 11:25

emran834 wrote:
Although I was Surprised why this book is out of print from Amazon.

Just lucky for the Amazon Marketplace as that is where I got my copy from. And, although my experience with the Amazon Marketplace is that it normally takes two weeks for the book to actually arrive, in this case I ordered it at 15:00 one day and it was on my desk by 09:00 the following morning.

emran834 wrote:
What is the PRE BUILT LISCENCE MANAGER Solution

I mean buying in a solution from a company that specialises in that sort of thing. (I'm surprised they don't advertise here on code project because their adverts are all over printed software development magazines.) Anyway, here are a few (I cannot vouch for any as I have not used them):
* DES Key[^]
* Aladdin[^]
* Sentinel[^]

emran834 wrote:
If I can just get it then I dont need to reinvent the wheel by learning so complex theory, right ?

I'd still recommend getting the book (even if you just read the introductory chapters) as you will at least gain a broad overview of encryption and data security in .NET so you know what is available should you ever need to use it.

ColinMackay.net
"Man who stand on hill with mouth open will wait long time for roast duck to drop in." -- Confucius
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell

emran8341-Feb-06 18:21

1-Feb-06 18:21

Hi Colin,
Thanks for the really really valuable information you provided. I am really happy that Code project is really popular and people are helping each other. I am a Professional PHP programmer and you know, PHP has sooo vast community support and millions of articles available on any kind of project. I was very comfortable to use that technology. If I had any problem I could just search on Google with that keyword and used to get hundreds of article on that, but when I started Microsoft's C#, My GOD, very hard to get resources. Only Microsft is giving some knowledgebase in MSDN and thats it. I dont see any strong community resources on microsoft products. Now , I m having so many difficulties using DataGrids and Table Adapters, but when i search in Google with the keyword of my problem, hardly two or three links come up and most of the time i really dont get solution. Finally I found CODE PROJECT which is really useful.

I appreciate your co-operation again.

Thanks and regards
Emran

-- modified at 0:23 Thursday 2nd February, 2006

Colin Angus Mackay1-Feb-06 20:34

Re: Edit feature (Cut, Copy, Paste)

1-Feb-06 20:34

emran834 wrote:
If I had any problem I could just search on Google with that keyword and used to get hundreds of article on that, but when I started Microsoft's C#, My GOD, very hard to get resources. Only Microsft is giving some knowledgebase in MSDN and thats it

Ummm.... I think the .NET Community is quite vast in itself. I think that if I were to switch to PHP I'd have difficulties to begin with, but that would mostly be down to not knowing the proper keywords to stick in a search engine. When I'm looking for something I ususally get what I want on the first page of hits.

If you listen to podcasts, and if you don't they are an excellent way to learn while driving, you could get hold of DotNetRocks[^], they've also started webcasts which are also really useful dnrTV[^]. Their plan is to put the podcast out early in the week (so you get the high level overview) then have the same guest come back and drill down deeper in the webcast while showing actual code.

ColinMackay.net
"Man who stand on hill with mouth open will wait long time for roast duck to drop in." -- Confucius
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell

emran8344-Feb-06 15:00

Re: Edit feature (Cut, Copy, Paste)

4-Feb-06 15:00

Hi Colin,
Would you please help me with a clue about adding EDIT feature (CUT + COPY + PASTE + SELECT ALL + UNDO) to all editable controls in Windows form. This features should be available from Right Click Mouse Menu, CTRL+C, ...etc, and Edit Menu. I have 20 controls in my form and its reallt getting hard to write code for every control. I thought there must be some way available for this purpose as every programmer needs to implement this feature. I was thinking about a way like this,

Cut Event Handler()
{
// get the control reference who has focus.
// ficusedControl.Cut();
}

But i cant get the clue how can i determine who has focus. If i want to check one by one like
if( control1.focused )
.....
else if (control2.focused)
....
etc...

Then for 20 control, it will be a very clumsy code. moreover, if i get the control name, i am not sure if that control reference will support .CUT() method.

Can you give me any clue please..

Thanks and regards
Emran

Colin Angus Mackay4-Feb-06 15:11