应用程序逆向工程保护/强化
我想保护我的应用程序免受逆向工程的影响。
我想做的是保护可执行文件免受任何篡改，例如十六进制编辑器、资源编辑器和反汇编篡改。
我的想法是让应用程序根据从服务服务器的版本文件（可能是 xml 文件或平面文件）中导入的值检查自身的哈希值，然后关闭应用程序或以某种方式完全禁用它的功能（如果值不存在）匹配。
我在这里处于陌生的水域，所以如果有人有任何评论、建议、想法或代码示例，我将不胜感激。
开发语言是 C++，但我很乐意采用任何语言的示例。
预先感谢您的任何帮助。
I want to protect my applications from reverse engineering.
What I would like to do is protect the executable from any tampering, such as with hex editors, resource editors, and dis-assembly tampering.
My idea is to have the application check the hash value of itself against an imported value in a version file from the service server (probably an xml file or flatfile), then shut down the application or somehow disable it's functionality completely if the values do not match.
I am in strange waters here, so if anyone has any comments, suggestions, ideas, or code examples, I would appreciate it.
The Development Language is C++ but I would happily take examples from any language.
Thanks in advance for any assistance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
恐怕没那么容易。
如果某人有能力修改可执行文件，那么他们就有能力删除应用程序针对已知哈希进行的任何检查。
您可以做更复杂的事情，例如使用已知可执行文件的哈希值作为密钥来加密应用程序的数据，但这只会使规避变得更加困难。
几十年来，各种非常昂贵的软件的制造商一直在努力寻找解决方案，而他们的努力总是由资源少得多的人来解决。
I'm afraid it's not that easy.
If someone has the ability to modify the executable, then they have the ability to remove any check the application does against a known hash.
You can do more complicated things, such as encrypt the application's data using the hash of the known executable as the key, but that only makes it slightly more difficult to circumvent.
The makers of all kinds of very expensive software have been trying to come up with a solution to this for decades - and their efforts have always been worked around by people with far fewer resources.
简短的回答是你不能。您可以使其变得更加困难，但最终您的代码必须在处理器上运行，因此可以即时读取、修改或忽略指令。
如果你可以控制硬件，那么你可以让它变得更难，但最终如果人们有足够的决心，他们可以突破你所做的任何事情。
呼吁人们诚实，这对你来说更容易，而且可能同样有效！
The short answer is you can't. You can make it more difficult, but ultimately your code has to run on the processor, so the instructions can be read, modified or ignored on the fly.
If you can control the hardware, then you can make it harder, but ultimately if people are determined enough, they can break through whatever you do.
Appeal to people's honesty, it's easier for you and probably just as effective!
最常见的简单方法是使用加壳器。许多恶意软件和一些商业软件都会这样做。有像
upx这样的标准加壳器可以执行此后编译操作，但任何逆向工程师都可以轻松解决此问题。商业软件使用加壳器进行尽力混淆，并通过其压缩功能来减小二进制文件的大小。它们也被（大多数）原始恶意软件使用。这里要小心，因为许多 AV 会将您的二进制文件标记为恶意软件，只是为了识别加壳程序和自修改/混淆代码的存在。
了解恶意软件/病毒反调试和加壳器/加密器的历史和最新技术，有一些有关此的 Phrack 杂志文章以及病毒/恶意软件研究网站和论坛上的资源。请记住它们只是减速带。
唯一正确/不可战胜（非减速带）的方法是使用 AES 等强大的算法加密代码，然后解密它在运行时使用密钥 - 但随后用户需要密钥来运行它。如前所述，预共享密钥/密码或商业流行的加密狗解决方案是最常见的）
编辑：大多数编译后加壳器和加密器在很大程度上与语言无关
The most common way to do this simply is to use a packer. This is done in a lot of malware as well as some commercial software. There are standard packers like
upxto do this post-compilation but any reverse engineer will get around this very easily.Packers are used by commercial software as best effort obfuscation and to reduce the size of the binary via its compression capabilities. They are/were also used by (mostly) primitive malware. Careful here as many AV will flag your binary as malware just for recognizing the presence of packers and self modifying/obfuscated code.
Read up on the history and state of the art in malware/virus anti-debugging and packers/cryptors, there are a few Phrack magazine articles on this and resources on virus/malware research sites and forums. Just remember they are only speed bumps.
The only correct/undefeatable (non-speedbump) way to do this is by encrypting the code with a strong algorithm like AES and then decrypting it with a key at runtime- but then the user needs a key to run it. A pre-shared key/passphrase or the commercially popular dongle solution are the most common as mentioned earlier)
EDIT: most post-compilation packers and cryptors are language agnostic for the most part
真正防止软件被篡改的唯一解决方案是加密可执行文件并仅解密当前执行的部分 - 并且只有在“受信任的设备”（例如 USB 加密狗）中完成解密时。
有一些产品非常好，例如我雇主的产品。
所有纯软件保护方案都或多或少容易被欺骗。
The only solution that really prevents your software from being tampered is encrypting the executable and decrypting only that parts of it which are currently executed - and only if the decryption is done in a "trusted device", e.g. a USB dongle.
There are some products available which are pretty good, e.g. a product of my employer.
All software-only protection schemes can more or less easily be cheated.
尝试混淆代码，这样它会挫败任何试图对其进行逆向工程的人，或者如果有人试图篡改它，它会自我毁灭！
Try obfuscating the code so that it would frustrate anyone trying to reverse-engineer it or have it self-destroy itself if anyone tried to tamper with it!