Crack Detection

I was reading a blog about a guy’s application that got cracked. He thought he was losing sales due to cracked versions of his app being distributed on torrents. Whether that is an accurate depiction of reality is not of concern to me right now. I was more interested in his desire to get back at the crackers. His rage was understandable. His methods were of great interest.

First this software author decided to be able to detect a cracked version. He decided to make his applications “phone home” over the Internet. They would use some type of public/private key encryption to make sure he knew it was his applications. Each app he sold would have some unique keys. Once he found the same key phone home from all over the place, he could assume that people were stealing his software.

Here was the big decision. What was he to do when the software detected unauthorized use? Some say he should just make his app behave poorly. If people think his app is no good, they will not use it. That might defeat the purpose of marketing though. He did not want to be known to legitimate buyers as making shoddy software. That’s when the evil plan clicked in his head.

The app could do evil thing to the target computer once it detected that it had been cracked. There was a world of bad things he could do. After all, the guy is a programmer. His disgust at losing cash due to being cracked would drive him on. His goal would be to do the most evil before the user who stole his software knew what hit him. Alas. This fellow programmer had crossed over to the dark side.

It was time to redirect the energy into future improvement to his program. It was time to refocus on the original goal of solving legitimate user problems, and in the process making cash. I still liked the sound of this developer laughing the mad scientist laugh while he worked on code to hack the machines of thieves. And no, this evil programmer is not me. I don’t have any software for sale that someone can crack. I give all my stuff away for free anyway.

Virtual Girlfriend

I just finished skimming a book on artificial intelligence. It was written for novices. There was a lot of great information in there. One conclusion was that there are commercial applications for AI in the sex industry. Thus I decided to try out a virtual girlfriend.

One of the first hits on Google for a virtual girlfriend was Kari. I downloaded a trial version. You get to run it three times. I tried to figure out how to bypass this. A data file had a "Run Times" parameter. That was not the trick.

Here is the funny thing. This AI bot is supposed to learn how to deal with you. But I found her more stupid than your average real life bimbo. Here is some of the conversations I had with Kari. I swear that I am not making this up.

Black: How big are you boobs?
Kari: Am I ticklish?

Black: What is 1 + 1?
Kari: I am not much of a girlfriend.

Black: Your voice sounds fake.
Kari: Damn girl.

Black: How can I hack you to run more?
Kari: God damn.

After this severe lack of coherence, I almost want to code up my own virtual girl. Yes it is a monumental task. But I got to be able to produce something a little smarted than this waste of memory. I will share what I come up with. In the mean time I recommend you avoid Kari. She might make you dumber.

256 Byte Mastery

Today I read a story about a programmer who wrote an Assembly language program in only 256 bytes. It produces a morphing 3-D world. You got to see this to believe it.

I have heard about cool programs that fit in 4k of memory. But a hot prog that runs in only 256 bytes of code? That is wicked. The program name is Puls. And it was written by Rrrola.

Virus Infections

My home PC is infested with viruses. The quick way to get rid of them is to reinstall Windows from scratch. However I am studying these critters to gain knowledge on viruses in general.

Every so often, my system tray has an icon that says my computer is infected. It asks that I click the icon to disinfect. Clicking it take my browser to some rogue web page where they try to get me to buy antivirus software.

LOL. Yeah right. I am not going to pay the guys that actually came up with the virus. How stupid do you think I am? A quick check to the Task Manager shows a "braviax.exe" process running. When I kill the process, the icon goes away. This is the culprit. I find a copy of the file in the C:\Windows folder. So I delete the file and pat myself on the back.

Here is the first trick. When I reboot, the problem comes back. The "briaviax.exe" file comes right back. I run msconfig and find that file it set to run on Startup. How did the file get back there? A little research and I find that there is another copy in C:\Windows\System32. That's actually smart. You have to eradicate both locations.

My system is still full of viruses. Let's try to get rid of them. Then we can find out how modern day PC viruses operate. This is good stuff.

Power of Proxy

I was reading a post with a lot of comments. One dude said he was trying to make money with Google AdSense by clicking on his own ads. Normally Google detects and blocks this type of behavior. The guy said he got around this by clicking once a day using a web proxy.

The web proxy hid his computer IP address from Google. That made it like somebody else was clicking on the ads he hosted on his site. This pissed some people off, especially those who were paying Google for displaying ads in its AdWords program.

This sounded like an interesting idea. The guy stated that it was not worth it. So he quit. I wonder whether he was telling the truth. So I decided to investigate. There are a number of drawbacks to this technique.

Not all proxy sites let you see ads on the pages they serve up. Furthermore, some sites that do show ads force you out of the proxy when you click the Google ads. This defeats the purpose as Google can then detect who you are. Still I consider the original idea a great hack. It is thinking outside the box to get a little cash.

Malware Marketing

This past year a team came out with an instant messaging client. It was provided free of charge. They needed to make some money. So they started experimenting on how they could profit off their users. Of course they tried having ads in their app. Then they got creative. They released some malware but got busted by LifeHacker.

Later the company came out and tried to do damage control. They call the malware their "research" module. That is a spin on the act of some software getting installed with their instant messenger, then taking over control of your computer to do their parallel processing.

In the good old days, sneaky code like this was shipped out with free programs. The bad boys just hoped you did not detect that your machine had been compromised. Now it has been taken to another level. When some tech site does detect you app doing sneaky things, you put the marketing spin on the evil deed to make it look like you are doing no evil. LOL. Damn those marketing guys.

Oh yeah. If you are wondering what product I am talking about, it is Digby. I am safe. My IM software is Yahoo Messenger. And Yahoo makes some green backs off me. However they just put the ads in my face. At least they are not trying to hide anything there.

Uncrackable

Insomniac came out with the Spyro game 10 years ago. I played it a couple times. It has some nice animation when the little dragon flies around. The company had their profits robbed when their game was quickly cracked for the Playstation. They decided to step up their anti-crack efforts with the release of their Spyro Year of the Dragon release. They shared some of what they did to protect their program and their revenue. I highlight some of their techniques here because it is very interesting.

The first thing to realize is that no program is crack proof. You are only trying to delay crackers when you put protection in there. It is a cat and mouse game. Typical cracks insert some intro code which tell the user who cracked the game. Then the crack runs the normal executable that is cracked. The normal executable is compressed to keep the overall size of the game the same.

So how to do prevent such a crack? A simple method is to introduce checksums. You see whether the code has been altered. If it has, you do something to prevent the game from continuing. There are ways to store checksum data in tables which makes checksum anticrack methods weak. The better checksum protection interleaves the checksum protection with actual program code.

Crackers do their work in their spare time. Make it hard for them to debug your application. Then it will also be hard for them to crack your app. Another technique that works is to delay what you do on detection of the app being cracked. That way it is hard for crackers to test whether the crack worked. They may also just assume that the crack worked, when in reality you will detect the crack and later halt the game.

I put some simple encryption into a product for work once. It was just a way to encrypt keys that were required to activate the app. Luckily we did not have a lot of general users who wanted a cracked app. This was just a method to keep the business users honest. They were too busy to actually crack the darn thing. If you are selling to the general public, you are going to want to research ways of your own to slow down the crackers. Your profit may hinge on the productivity of this effort.