Protection of binary code against modification
StarForce Crypto is recommended to protect Windows-based applications that can be distributed on optical media, flash cards and via the Internet, including Steam, from analysis, hacking, modification, and reverse engineering.
StarForce provides protection against several threats
 |
analysis of unique software algorithms |
|
leak of secret keys while using standard DRM for digital audio and video content |
|
analysis of DRM code running on the end user's side |
|
changing the code / adding new features in the software product installed on the customer’s site without the developer’s help |
How StarForce Crypto works
Protection of executable files
During protection, an unprotected executable file is divided into components. Protecting transformations are applied to the components of the executable file. Also auxiliary parts required for protection are added to the file. Then StarForce Cryptocompiles the file again but it is protected now.
StarForce Crypto uses more than a decade of protection technologies to provide reliable protection for your software product. The most protection parameters of these technologies can be set on the client’s side with the help of Protection Studio, a fat client designed by StarForce Technologies. For some protection technologies SDK is required. The full information about StarForce Crypto protection technologies is available in the user’s manual.
The following protection technologies are used in StarForce Crypto
| Technology |
Can be used for native files |
Can be used for .NET files |
| Protecting internal references |
Yes |
No |
| Encrypting string constants |
No |
Yes |
| Protecting from debugging |
Yes |
Yes |
| Protecting from running applications on virtual machines |
Yes |
No |
| Protecting from running applications through terminal sessions |
No |
Yes |
| Protecting from the executable file modifications on the disk |
Yes |
No |
| Protecting from modifications of the executable file image in the memory |
Yes |
No |
| Other protection techniques |
Yes |
Partially |
Protection of read-only data
Two ways to protect the data
|
Moving the files to the container |
|
Verifying file integrity |
Moving the files to the container
Read-only data are protected by placing certain files or the entire directories into a protected container. From the outside, the container looks like a single large file with encrypted contents. The application can read the files from the container in one of the two ways:
 |
Container as a virtual file system. To implement this method, special driver is automatically installed in the system along with the application. The driver makes working with the files in the container ‘transparent’ for the application – the application ‘sees’ the files inside the container rather than the container |
|
Access to the files through API. The driver is not used in this case. The files are accessed through API functions from StarForce SDK rather than through standard OS functions |
Verifying file integrity
Read-only data are stored unprotected on the disk. The check is made by calling an API function. The function compares the digital signature encrypted in the container with the digital signature of the data file. When protection is integrated, the data file should be added to the container with the ‘Use digital signature instead of file’ option enabled. This makes analyzing and modifying data files of the protected application more difficult.
External binding
To facilitate the protection of a custom DRM, StarForce Crypto provides a special feature: external binding. It is required in order to ensure the inseparability of license authentication validation from protected application, as well as to protect this functional against analysis and modification.
StarForce Crypto protects code and data that constitute the intellectual value and should be protected from a business perspective. This product provides reliable protection by eliminating the possible ways to understand the logic of application operating.
Securing the standard DRM implementations for digital audio and video
against reverse engineering
Situation
The feature of standard DRM for audio or video streams is that there are private keys for each device or software component. Leak of a private key allows the attackers that got the key to save the digital stream to a file that does not have any protection. Such a file can then be distributed freely. The quality of audio or video in the file is almost the same as in the original file (excluding minor losses for re-compression).
To reduce the risks of such scenarios, the developers of standard DRM define the procedure of revoking the compromised keys. It is undesirable for a software or hardware developer to revoke a key because once the key is revoked, the corresponding device or software component stops working. To get a new key, the developer has to pay to the DRM representative a large amount of money. Sometimes, the developer may have to pay a penalty for the leak of a private key, or her/his license may be suspended.
Taking the above-mentioned into account, preventing or reducing the likelihood of a private key leak is an important task for the developer.
Solution
StarForce Crypto allows reducing the likelihood of a private key leak by making the analysis of the code that works with the key more complicated. The two simplest approaches to hiding a key are as follows.
| 1 |
Storing the private key in the protected code. The approach is based on the following principles: |
| A |
The private key of the device is stored not as data, but as a code (for example, as a byte-by-byte array initialization code) |
| B |
Software modules that work with the private key are protected with StarForce Crypto. We recommend that the code that works with the private key is protected with the help of the ‘Protecting the code of internal functions’ technology that the product provides |
| C |
The code that contains the key and the code that works with the key are both obfuscated.
This is the simplest approach; however, in order to change the key, a part of code should be replaced |
| 2 |
Storing the key on the device as encrypted data. The approach is based on the following principles: |
| A |
A private key is stored encrypted on a disk |
| B |
The encryption key for the device key encryption algorithm is embedded into the algorithm code (for example, as a byte-by-byte array initialization code) and is not stored explicitly |
| C |
The device private key encryption functions are protected with the help of the ‘Protecting the code of internal functions’ technology StarForce Crypto provides |
| D |
The software modules that work with the private key are protected with StarForce Crypto. We recommend that the code that works with the private key is protected with the help of the ‘Protecting the code of internal functions’ technology that the product provides |
To provide better protection, the developers should use more complicated approaches; however, the above-mentioned approaches can be used as a basis for the development.
Securing the implementation of custom DRM against reverse engineering
Situation
The development of custom DRM requires a lot of time and resources. In this case, in addition to the basic functionality that is the key exchange, the developer needs to provide the protection of DRM code that works on the end user’s side.
Solution
StarForce Crypto allows to save time on development of the DRM protection system from analysis and modification. StarForce Crypto also has a special functionality (external binding), which minimizes the effort required to develop the custom DRM.
DRM modules that work on the end-user side usually have functionality of the following types:
| 1 |
Feature that verifies the license and binds the application being protected to the license carrier (to a physical object that is on the end-user side and is difficult to falsify, or to a server) |
| 2 |
Feature that ensures that the feature described above cannot be separated from the application being protected |
| 3 |
Feature that protects both the above-mentioned features from reverse engineering and modifications |
StarForce Crypto implements the second and the third types of functionality. The clients can implement the first type of functionality themselves.
A developer estimates the level of efficiency on the basis of the analysis of product testing results and decides to purchase StarForce Crypto or not.
Securing author’s unique algorithms against reverse engineering
Situation
Some software products contain unique algorithms. If the competitors learn how these algorithms work they will be able to reproduce them in their software, and the developer’s competitive advantage will be lost.
Solution
StarForce Crypto allows securing the application source code from reverse engineering. To secure highly important code pieces from reverse engineering, we recommend that the developer uses the ‘Protecting the code of internal functions’ technology StarForce Crypto provides.
Securing the code of B2B software against
modifications without the developer’s help
Situation
A company that has ordered and deployed an enterprise data processing system could have an idea to stop ordering high-cost services for the system customization and support. This is most likely when the required modifications are minor. A skilled developer who has experience in reverse engineering is able to learn how the system works and make minor updates herself/himself, even if the source code is unavailable. Even if such a scenario is explicitly prohibited by the agreement, it is very difficult to make sure this clause is not breached.
Solution
StarForce Crypto allows the software company to protect its products from being modified without their assistance. If the protected product is modified, it ceases to operate. This makes it impossible to modify the product without the company’s help, i.e. without recompiling the product from the source code.
Protection via StarForce Cloud
| 1 |
Download and install StarForce Protection Studio (supplied for free) |
| 2 |
Using StarForce Protection Studio, select software functions and files that will be protected |
| 3 |
Set the parameters of protection |
| 4 |
Customize the elements of the GUI |
| 5 |
Create the distributive |
| 6 |
Test the protected product |
| 7 |
Start distribution |
You can protect your software any time you like.
Protection by StarForce specialists
StarForce offers the following chargeable services:
Protection is performed by StarForce and may include:
|
Protection with functions selection |
|
Protection without functions selection |
|
Protection with functions to be selected by the customer |
Analysis of the protection performed by the customer.
