保护 Flash EXE
我的客户有一个 Flash 投影仪 EXE，他想要建立一个在线序列号控制系统，以便他可以在线销售它。
据我所知，这个项目的关键问题是exe只需要在一台计算机上运行。
我目前的计划如下：
- 在安装前向用户索取序列号并检查是否可以。
- 如果可以的话，从许多唯一的硬件常量生成一个哈希值。将其与服务器匹配，查看该应用程序之前是否安装在该机器上。
- 如果不是，或者它与以前是同一台计算机，请允许安装程序继续。
- 安装后，将硬件哈希值放入注册表中。
- 创建一个loader EXE，将Flash EXE作为资源放入其中。
- 在加载器 EXE 中，检查注册表是否具有硬件哈希值以及它是否是我们正在运行的正确硬件。
- 如果硬件哈希正确，则将资源 (Flash Exe) 提取到隐藏路径并使用 CreateProcess 执行它。
现在，我意识到此工作流程中存在严重的安全缺陷。当我提取资源exe并执行它时。任何查看任务管理器的用户都可以看到它。这样他/她就可以伸手抓住它！
我该如何改进我的方法？至少达到一个可以接受的程度？
谢谢。
PS 此应用程序具有类似的功能： http://www.increditools.com/flash_exe_builder/index.php 在保护和序列号方面。
My client has a Flash projector EXE and he wants to set-up an on-line serial number control system so he can sell it on-line.
The key problem in this project, as far as i see, that the exe is required to run on only one computer.
My current plan is below:
- Request the serial number from user before the installment and check whether it is okay.
- If it is okay, generate a hash from a number of unique hardware constants. Match it with server and see if the application was installed on this machine before.
- If not, or it is the same machine as before, allow the installer to continue.
- After installment, put the hardware hash into the registry.
- Create a loader EXE, place the Flash EXE into it as a resource.
- In loader EXE, check if the registry has the hardware hash and it is the correct hardware we're running on.
- If the hardware hash is correct, extract he resource (Flash Exe) to a hidden path and execute it with CreateProcess.
Now, i'm aware of that there is a serious security flaw in this workflow. When i extract the resource exe and execute it. It would be visible to any user looking to the Task Manager. So he/she could reach his hand and grab it!
How can i improve my approach? At least to an acceptable point?
Thanks.
P.S. This application has similar functionality: http://www.increditools.com/flash_exe_builder/index.php in terms of protection and serial-number.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
取决于你所说的“可接受”是什么意思。这个问题无法解决 - 有些商业公司的存在只是为了向价值数百万美元的软件提供 DRM 保护，而这种“保护”通常会在几天内被破坏。
您想要的确切保护量很大程度上取决于您所分发的内容 - 如果不了解这一点，实际上不可能就您想要做什么提供良好的建议。
您建议的系统可能就足够了。哎呀，您信任客户的荣誉系统可能足以满足您客户的目的。
Depends on what you mean by "acceptable". This problem is unsolvable - there are commercial companies which exist solely to provide DRM protection to multi-million-dollar software, and that "protection" is routinely broken within days.
The exact amount of protection you want to bother with depends largely on what you're distributing - without having an idea of that, it's really not possible to give a good recommendation as to what you want to do.
Your proposed system might be sufficient. Heck, the honor system of you trusting your customers might be good enough for your client's purposes.
如果他的应用程序不受欢迎（也不会流行），打电话回家就太过分了。
如果他的应用程序很受欢迎（或将会流行），请放弃。即使是工业级（无论这意味着什么）软件安全保护本身也存在缺陷，包括备受争议的索尼 SecuROM 和 Valve 的“终止所有 DRM 的 DRM”CEG 都已被破解。
If his app isn't popular (and won't be), phoning home is overkill.
If his app is popular (or will be), give up. Even industry grade (whatever that means) software security protections are inherently flawed, including the controversial Sony's SecuROM and Valve's 'DRM to end all DRMs' CEG have already been broken.
您无法阻止每个人破解您的安全性，但在这种情况下，您可以要求阻止 90%（左右）的用户这样做。只要让非法复制品的使用变得困难就可以完成任务。
看看 Adobe 以及有多少 Photoshop 和 Flash CS3 的破解许可证密钥。关键是，做一些事情来阻止普通用户是值得的——但这就是保护措施所能达到的程度。如果有人想要窃取软件并愿意投入时间和精力，他们就能够得到它——无论它有多好。
You cannot stop everyone from cracking your security but in this case stopping 90% (or so) of the users from doing it is all you can ask for. And just making it difficult to use an illegal copy will accomplish the task.
Look at Adobe and how many cracked license keys for Photoshop and Flash CS3 exist. The point is that doing something is worthwhile to stop the average user - but thats as far as protective measures will go. If someone wants to steal software and willing to put in the time and effort to do so they will be able to get it - no matter how good it is.