AutoHotkey Community

MYYM · Joined: 05 Apr 2005 Posts: 132

Hi,
I'm not sure where should I post that ...
Scripts? no it's an exe file.. (maybe I'll post the script later..!)
Utilities & Resources? no it couldn't be any of these!

General Chat? well .. it says "Talk about anything."
So, I'll post it here anyway..

It's a link to an EXE file for a pictures matching game I wrote using AHK.

I hope you'd like to try it

http://www.geocities.com/myym_p/

And I hope you'll enjoy it.! .. let me know! .. Thanks!
MYYM

Titan · Joined: 11 Aug 2004 Posts: 5390 Location: /b/

I'm confronted with an authentication system when trying to run it (so I can't use it) Confused

_________________

CarlosTheTackle · Joined: 19 Oct 2004 Posts: 102

Don't you think requiring a registration is going a bit far? Confused

MYYM · Joined: 05 Apr 2005 Posts: 132

Hi ..

CarlosTheTackle · Joined: 19 Oct 2004 Posts: 102

Cool. My number is:

MYYM · Joined: 05 Apr 2005 Posts: 132

MYYM · Joined: 05 Apr 2005 Posts: 132

Hi ..
I must say that I was expecting most of the members here would like to try that Game especially that I'm sure you all are here because you 're interested in AHK and you'd like to try whatever could be done using it.!

Anyway. it's clear now that I was wrong about that.! Confused

I thought it'd be very useful for me to get some feedback from you with all your opinions about how do you like it OR why you didn't like it.. !
Especially the part that generates a unique Serial Number and Registration Number for every installation. and which could be added to any program written by any programming language as a security tool.

In fact I believe that's what a forum like this one could be created for.
maybe I made the post in a wrong forum or the wrong way.

Thanks to CarlosTheTackle for trying it !
and sorry to anyone else if you thought that I'm wasting your time.!

MYYM

CarlosTheTackle · Joined: 19 Oct 2004 Posts: 102

Pretty impressive for an AHK development.

I'm interested in how you got all the pictures embedded into one .exe.

C

Titan · Joined: 11 Aug 2004 Posts: 5390 Location: /b/

MYYM · Joined: 05 Apr 2005 Posts: 132

BoBo · Guest

MYYM · Joined: 05 Apr 2005 Posts: 132

hi

toralf · Joined: 31 Jan 2005 Posts: 3841 Location: Bremen, Germany

Like myself some people are allergic against registration, when they/I do not know what is submited. No ffence against your tool, but how should we know what info is behind the SN? And why do you want to keep track of who is testing your exe?

You are free to post your AHK code. And I'm sure more people will try it and give comments.
_________________
Ciao
toralf

toralf · Joined: 31 Jan 2005 Posts: 3841 Location: Bremen, Germany

Laszlo · Joined: 14 Feb 2005 Posts: 4078 Location: Pittsburgh

As I understand, when someone installs the program it generates a random serial number and waits for a registration number before it runs. The two are obviously related. One method is to hash some system information, a key and a random number to create the expected registration number first, and encrypting it gives the serial number (or the other way around).

This is a possible scheme for SW copy protection. I don't know if you addressed the problem: After the program is installed it has to remain protected, otherwise the installed program could be copied and distributed.

There are many ways to protect against this.

- Hide some information on the host disk, in the hope that the attacker cannot find it and distribute it with the installed program. This can be
+ in the registry (registry-change loggers catch it)
+ hidden files (directory listings with the right flags find it)
+ files in common directories (like Windows) with not suspicious names and earlier date (directory change monitoring tools find it)
+ attached to existing files (reinstalling the file removes, virus protection could prevent adding it)
+ file slack (unused part of a disk block belonging to an unmovable system file. OS update, boot time de-fragmentation tools remove it)
+ bad sectors (disk repair utilities may remove it)
+ flags in disks system area, like partition table, boot sector, etc. (disk partitioning tools, boot managers may remove it)

- Relate system information and the serial number
+ Computer name
+ Workgroup/Domain name
+ Login name
+ User password
All these can change time-to-time, requiring re-registration.

- Relate the host HW and the serial number, like at XP activation.
+ BIOS ID, version number
+ NIC
+ Processors serial number
+ Hard disk S/N, ID
+ Video card, Sound card type, ID, S/N, etc.
At a major HW change the serial number won't match, re-registration is needed. (How do you know if someone ported an installed copy to another PC or the original PC has been upgraded? E.g. Microsoft does not even bother to check, you can activate XP with the same S/N many times.)

- For on-line games: Detect multiple copies of the same serial number, put it on a revocation list and reject it.
- Issue frequent, incompatible updates, so the attacker has to work hard to distribute always up-to-date versions.

- Of course, there is the danger of reverse engineering
+ De-activate the authentication check
+ Find the algorithm relating SN and RN: key generators
It is another subject, how to write tamper resistant SW. It is hard, but on modern motherboards with TPM chips - or with other extra HW, it is possible.

You have to address the privacy concern toralf raised. In a long serial number some of your secrets can be hidden, like your sniffed login password. Accordingly, the serial number has to be short. 60 bits provide negligibly small chance of a collision. Encoding it into 10 base 64 characters might mitigate concerns.

This is not a complete list. Please add your ideas, concerns, notes, so we could provide a comprehensive toolbox for this kind of copy protection techniques in AHK.