Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It is really strange to see, that almost every famous and good software is cracked and patched. Adobe software, windows, IDM and many others...

Is it really that easy? What are the techniques that they use? How can we protect our software from being patched or cracked?

Edit:

Well i am clear for the current answers that there are very less ways to protect your software ".... the only method I've ever seen work is putting important logic on an external server somewhere... by @Phoshi", but how is this done. softwares have encrypted files, .exe, etc, then what is the benefit of encrypting them.. shouldn't just leave them open... if people are going to crack them anyway?

share|improve this question
    
?? How will your customers run the program if you don't give the executibles ? @Phoshi & @Harrymc have pretty much nailed it. If a program is well known, it will be cracked - whether to test the cracker's expertise(!) or some other factor - it will be cracked. Putting in stupid stuff like network authentication will stall it by few days / weeks. Recent example being Ubisoft's DRM - for all their tom-tom-ing - AC2 was cracked. Do yourself and your customers a favour - don't bother with shitty validation logic. –  Sathya Oct 23 '10 at 15:25
    
Those who pirate software will not buy it regardless, so you don't lose any legitimate customers. Just consider pirated software as "Try it before you will never buy it anyway" Stopping piracy of software is like trying to win the war on drugs, futile. Put your time, money and effort into the product quality instead. –  Moab Oct 24 '10 at 2:40
    
Oh, re: encryption, the file has to be decrypted for the application to read it, and if the application knows how to decrypt it, then so do you. It does add another layer of security, though - just like locking the doors of your house might not stop somebody who wants ro rob you, if you don't do it, your insurance ain't paying out. –  Phoshi Oct 24 '10 at 12:16
2  
Well. Thanks guys for all your answers and support.. One thing that i am clear about is .. there is almost 100% guaranty that all softwares can be cracked... so it is not worthy to put extra efforts in security, we should rather focus on the quality. Thanks everyone –  Unknown Oct 24 '10 at 14:06

10 Answers 10

up vote 18 down vote accepted

You can't. Anybody running anything locally has total control over what it does - if you phone home, that can be disabled, or intercepted. If you do key checks, they can be altered to accept any key. Hardware checks, and again, you can change that to always return true. No protection that runs entirely on an open, local computer will ever be 100% effective - the only method I've ever seen work is putting important logic on an external server somewhere, and verifying when that's asked for - but that adds latency, complexity, and annoyance.

Simply put, I wouldn't try too hard, it'll be cracked, and then the only thing it'll do is irritate legitimate customers. If your software is good, the people who matter will buy it, especially if it has any business applications.

share|improve this answer
2  
"... I wouldn't try too hard, it'll be cracked....... If your software is good, the people who matter will buy it, especially if it has any business applications.", well said Phoshi.. Thanks for reply –  Unknown Oct 23 '10 at 14:56

There are just a few software protection products in the world, which are in use by all software makers. As such, they are well-known to hackers.

These protection products are faced with groups of young geniuses, groups that are being continuously renewed by newcomers. In addition, they are in competition with each other, racing forward to crack any new product or security schema. They keep count of their exploits using dedicated websites.

For these groups, cracking a new product is just a matter of finding out which protection it uses, then nullifying it. It is more interesting for them when a new version of the protection product comes out, cracking them usually within days (!).

Many legitimate owners of games/video/music prefer downloading cracked versions, since the protection products can be worse than viruses, causing big problems themselves after being installed.

In conclusion, using your own protection scheme is the best idea, rather than buying one, but knowing that if your product becomes well-known then it will be cracked.

share|improve this answer

You can't. Anyone can alter any blob of data on its own computer (that's a statement about possibility, not ability, legality or license).

share|improve this answer

Cracked software is a part of the proprietary ecosystem. Cracking free software makes no sense. Patching free software is a fundamental user right.

share|improve this answer
  1. It isn't really easy, you need to have hell-bent curiosity to want to take things apart to see how they work. Also, there is the buzz from beating the people who wrote the software in the first place.
  2. There are various apps available to decompile software but they're not perfect or comprehensive. Obtaining all or part of the original code off an insecure server or from a "friend" is preferable. You can run the program on top of a software layer that monitors it's functions. There's also good old fashioned trial and error.
  3. You can't prevent it, as long as hackers/crackers want to take a look, they'll find a way (eventually).
share|improve this answer

Here's an answer for the edit.

Reason the copy protection still exists are time and inertia.

Take computer games for example. Fans of famous series get all hyped up before release of newest edition of the game. Publishers hope that people will buy original game instead of waiting for cracked version to appear on the scene. As other have said, groups race to publish their cracks. Publishers often try to place hidden checks in programs which aren't immediately obvious. For example in Settlers 3, if I remember correctly, buildings which were supposed to produce steel made meat in cracked versions. So if a group misses that, another group will make so called "proper" and hope to gain prestige by fixing issues which first group missed. This cycle can last for some time and will frustrate users of pirated versions. Publishers hope that in that time they will decide to get original version.

Another way which was pioneered by Stardock, I think, is use of downloadable content. Original game owners will have to log in to a web service and download some new extras which are available only to owners of original game. This way they hope that pirates will get original version in order to get the extras.

As for inertia part, here's an analogy. Back in times of my grandparents, few people in my country used locks on their front doors. Just having a lock was a bit strange. As level of urbanization increased, crime rate increased and locks were needed for some time. The increase of crime was fallowed by increase of activity of law enforcement and things are pretty safe now, but people still use locks because it became part of tradition. They don't think if they are going to place a lock on the front door or not. They just get one with a lock, just like everybody else. They still use lock designs which are 20-30 years old even though they know that such locks can be picked by any professional criminal with little effort.

I have a feeling that it's same situation in software industry. It just became normal to have some type of software protection. Yes, there are programmers which just display a message like "I know you're using pirated version!" and let user continue, but the default response is to get some type of protection. Sometimes for programs with small user base or very specialized programs this will work because they aren't of interest to warez d00dez. At other times it will help by delaying use of newest version of a program until crack is available.

Sometimes the decision is not in the hands of competent people. Often lawyers or various clerks decide which type of protection is needed even if they have no idea if it's going to be effective or not. Instead they decide what looks good to them or what their colleagues are using or whose brochure is shiniest or who is cheapest and so on. I remember back when Vista was new, some of the criticism about digital restrictions management mentioned that new graphics cards will have to be entirely covered by coolers from all sides so that pirates won't be able to directly connect to the exposed pins on the cards and "steal" the signal from blu-ray disks that way. Obviously whoever thought of that had no idea that people which have enough knowledge and equipment to get a signal form video card while it's being processed aren't going to be stopped by something as simple as a cooler covering entire card.

share|improve this answer

In order to understand how this works you must first understand that an executable computer program is a very, very, very long list of simple instructions which the computer just does very, very, very fast.

These instructions are the actual bytes lurking inside e.g. an EXE file, and there is nothing special about them except for them making the CPU do useful stuff when it looks at them as instructions.

Originally programmers wrote each and every instruction by hand but it has been found to be much faster to write software that takes a humanly readable instruction like "SHOW TEMPERATURE IN WINDOW" and convert them to the many instructions the CPU needs to do to actually DO this.

The idea is that a cracker looks at the instructions for the CPU, and deduces which of them that do the part they don't like - like checking the physical cd for being bad in just the right places - and replace them with OTHER instructions, or in other words replace a few bytes in the EXE file with another carefully calculated set of bytes. The CPU doesn't care - it just sees instructions.

The hard part is then ensuring that the part skipped above does not do MORE than just the check, like set important information needed later, or that the rest of the program does not do consistency checks on the EXE to see if it has been tampered with. For EXE files many megabytes big this can be quite a task.

The usual approach to deal with this these days, is to move away from the physical, broken media check, to a "you must log in to our server to use our software". The license keys are then the thing you pay for and must administer carefully.

share|improve this answer

If you have the software on your computer, then you have everything that the software has to offer, all you need to do is separate what you need from the program, or remove what you dont want, for example security checks.

To protect your software for real, you need to keep it away from the user, and only provide the service, not the program, like google docs does.

What keeps people buying the software? anyone who wants to be legal will buy it, especially firms, companies and corporations. or if it's easier to buy it than to get a hacked copy, because people often turn to pirates when the software they want is not available or is for example not available in the language they want.

share|improve this answer

As with anything else, there are people with the requisite skills who do good things with those skills, like creating programs like Adobe Acrobat, etc. and there are other people with those same skills who use them for nefarious purposes, like cracking programs like Adobe Acrobat, etc.

Two guys, mechanical engineers, one guy uses that knowledge to build bank vaults, the other guy uses that same knowledge as a safe cracker.

This problem isn't isolated to the software industry, it's prevalent in every industry.

share|improve this answer

"Almost" is really only due to finite resources.

Any security system is supposed to distinguish between a legitimate user and an unauthorized user. Given enough time and money, dedicated people can make any security system confuse the two.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.