DP Tool Club 12/CD_ASCQ_12_0294.iso/maj/2196/protexcm.doc

Text File | 1994-02-12 | 19KB | 452 lines

                     Protect! EXE/COM v.5.0
                  (C) 1993,1994 Jeremy Lilley,
                       All Rights Reserved
                        February 12, 1994





The Very Brief Table of Contents:


Introduction: What's New With Protect! EXE/COM v.5.0 ? .... 1
Why Should I Choose Protect ? ............................. 1
Requirements .............................................. 2
How To Use Protect! EXE/COM ............................... 2
Which Files Can't Be Protected ............................ 3
Legal Terms / Disclaimer .................................. 3
License ................................................... 4
How Does Protect! EXE/COM Stand up to Other Utilities? .... 4
Technical Notes ........................................... 5
The Mutation Engine ....................................... 6
Closing ................................................... 7





Introduction: What's New With Protect! EXE/COM v.5.0 ?


     If you're sick of seeing updates for Protect!, this version
has not been made as a  fix for some  mass-unprotect program  as
with  some  past  versions.  Instead,  v.5.0 has been  made as a
personal challenge  to see  how effectively  I could  code debug
traps  and  my  own  mutation  engine  (see the  Mutation Engine
section).  There still were quite  a few  annoying bugs in v.4.0
that I  had to  wipe out  with  complete recoding.  However, now
Protect!'s output should  work completely reliably (without "bad
mutations"  or  anything  of  the   sort)  on   any  standard PC
compatible. In addition, you don't need to use a compressor with
Protect! (which is  about time).  I've  tightened  down security
quite a bit at the cost of a little speed (I didn't think anyone
would object to the extra tenth of a second that the longer keys
use up). Otherwise, you can basically find out anything else new
from the README and WHATSNEW files.





Why Should I Choose Protect ?


     Protect! is designed to encrypt  and secure your executable
program  files  by  unobtrusively  placing  a  special  security


                                                                Page 2



envelope around them.  Without adding significantly to  the load
time or the file size,  you can be sure that nobody will be able
to tamper with your files without getting a file integrity error
message (the file integrity error message is user-selectable for
registered  users  only,  and  that  is  the  only  really "big"
difference between  the registered  and unregistered files).  To
Protect a specific  file, simply run Protect! on it, and you and
your users will never know that it's there unless somebody tries
to change it. Since the file will  be encrypted  and garbled up,
not every Dick and Jane with a  hex editor will be able to blank
out your copyright screens.  Don't expect  to be able to  easily
trace  through  Protect's  security  envelope  with a debugger -
advanced debug traps help destroy this option.  Protect! is  the
most advanced executable protection program of its type that you
can buy  to keep your  programs from  being altered  or reverse-
engineered.





Requirements:


     The requirements are  basically nil:  DOS 2.0, IBM PC, 64k,
etc... I can run this program on  my 4.77 mhz XT and I have done
much testing of Protect! on even this lowest common denominator-
type of machine,  to make sure  that Protect!  will run on every
type of computer from 8088 to 486 to Pentium and beyond.  You do
not  need to  have a  compressor  as with  previous  versions of
Protect!,  but you are  generally recommended to use one because
it may speed up  processing a  bit. Many files  that couldn't be
compressed before, such as Clipper (R) files and several overlay
files can now be compressed.





How To Use Protect! EXE/COM:


     The command-line  syntax for  Protect! EXE/COM v.5.0 is the
following:

     ProtExCm filename[.EXT] [* CRC_Msg.Fil - Registered only*]

     The CRC  error  message  file is  available for  registered
users only and more complete directions on how to use it and the
default CRC.MSG file are  included in  the registered version of
the documentation.

     Here are some usage examples:
          ProtExCm MyProg.EXE
          (To Protect MyProg.EXE)



                                                                Page 3



          ProtExCm MyProg
          (To Protect either MyProg.EXE or MyProg.COM)


     As you can see, you don't need an MIT engineering degree to
use Protect.  Keep  in  mind  that you  can  customize  the file
integrity error message  if you register  Protect.  Also, when a
file integrity error occurs, an errorlevel of 250 is returned to
DOS.

     Please  note that  a file  CANNOT be  expanded  after being
protected with Protect! EXE/COM  (you can probably see why),  so
please preserve the backup file  (.OLD) until  you are sure that
the protected file  runs correctly  (some  incompatibilities may
possibly arise with  certain files).  This is about all that you
need to know before you can really start protecting your program
files. I have taken out PROTECT.BAT from this version because it
was basically worthless,  especially  because compression is not
required under Protect! v.5.0.





Which Files Can't Be Protected:


     Windows (R)  and OS/2 (R)  files cannot  be protected  with
Protect! EXE/COM.  The reason for this is that a  Windows EXE is
basically a small  DOS program that  says "this program requires
Windows" with a  pointer  to the actual  Windows program  (which
only Windows and Windows-supporting  products detect in order to
use the Windows part). Protect! will now automatically detect if
a file is for Windows or OS/2 so  that you don't waste your time
trying to Protect them.  Also, due to the structure of Protect!,
files  larger  than  the 600k  neighborhood  can't be  Protected
(because the entire  file  has to be  able to all  fit in memory
once  when  it  loads).  This fact,  of  course, makes  Protect!
worthless for  xBase files where the basic  "Hello World" EXE is
over a meg. You can  technically Protect  files like COMMAND.COM
(though not the older PC-DOS(R) system files called IBMDOS.COM &
IBMBIO.COM),but it would be rather pointless, especially because
most resident virus-detection programs double and triple monitor
system files.





Legal Terms / Disclaimer:

     Protect! EXE/COM v.5.0  basically  has no  legal guarantee/
warranty basically because I don't want to get sued over it, and
should be used "as is." Here is the official disclaimer:

     Protect! EXE/COM v.5.0  ("program")  will  alter executable


                                                                Page 4



files and  may have or cause  compatibility  problems  with them
(that is why .OLD files are created,  in case of incompatibility
with  a  particular  file)  in certain  circumstances.  Under no
circumstances may Jeremy Lilley  ("author")  be held  liable  or
accountable for  any damage to system  files,  executable files,
data files,  or any other  system or data  damage due to  use or
misuse  of  his  program.  The  author  also  may  not  be  held
accountable  for  loss  of  profits  or  for  any  other damages
incurred by the use or misuse of his  program.  The  author  has
forewarned any users that  damage to files may occur with use or
misuse of his program,  and in executing  the program, the  user
fully understands these risks and this disclaimer.

     Don't worry --  there is  little  risk of  damage resulting
from this program's  use  as  long  as  you  use  it  correctly.
However, if you try  to make it mess up,  it probably will. Just
remember that it isn't my fault if you misuse my program.

  Also, all trademarks used, demarcated by (R), are acknowledged
to be property of their respective owners.





License:


     You may use Protect! EXE/COM for the purposes of evaluating
it (after  understanding the  disclaimer and the  documentation)
for 30 days.  No files protected by Protect! EXE/COM during this
trial  period may  be distributed  to  other  computers  at all,
commercially or non-commercially.  If you find  Protect! EXE/COM
to be of use to you, you must register Protect! EXE/COM with the
author.  Government,  educational,  and commercial  institutions
must register this program with the author prior to use  (please
contact me for quantity discounts).  Sysops,  user groups,  disk
vendors, and other similar organizations may distribute Protect!
EXE/COM   provided  that   no  files  are   excluded   from  the
distribution  and  that  no   more  that   $10  is  charged  for
distribution.

     In addition, because this is encryption software,  it *must
not* be distributed to countries or regions with U.S. encryption
export restrictions including:  Afghanistan,  Albania, Bulgaria,
Cambodia,  Cuba,  Czechoslovakia,  Hungary,  Iran,  Iraq, Libya,
North Korea,  China, Poland,  Romania, Syria,  the former  USSR,
Vietnam, or Yemen (so in other words,  next time you have to fly
to Baghdad on  business,  you  have  to  leave  Protect!  behind
<Grin>).



How Does Protect! EXE/COM Stand Up To Other Utilities?


     Protect! EXE/COM's first concern is security. No other


                                                                Page 5



program emphasizes  the file integrity  checking using a  CRC to
the extent that  Protect!  does.  Try  PKLITing an EXE file  and
change a byte or two in the  middle of  the file  (find parts of
text that  you can  still  recognize slightly).  As  long as the
program doesn't crash (it may if you've messed too much with the
code  portions),  PKLITE  won't  notice your  changes at all.  A
hacker can also decompress a program  compressed with  PKLITE or
LZEXE quite easily  -- even if a  program is compressed with the
supposedly "invincible" -E option on the professional version of
PKLITE. After decompressing,  any hacker can change your program
(remove copyright screens,  disassemble  code, etc...), compress
it again, and spread it around, possibly damaging  your profits,
your reputation,  and others' computers  (I hope you have a good
disclaimer...). Fortunately, hacking is not quite  that rampant,
but it still is a possibility  and a risk, and it is much better
to pay a few dollars up-front to be safe than to be sorry in the
future. Though NO software-only  (or even hardware-based,  as in
the case of Everlock (R) and others)  protection program is 100%
fool-proof,  I  am  pretty  sure  this  program is  the best for
protecting  your  EXE  and COM  files.  Most  modifications  and
"hacks" can't  be detected  and defended  against with  ordinary
tools, and it is up to you to protect your programs.





Technical Notes:


     First of all, thank you to  everyone who  contributed anti-
debug tricks and other  ideas for this version of  Protect. With
these new ideas, Protect! can be much more secure and faster.  I
have  dumped the old  mutation engine and replaced  it this time
because the old one didn't always mutate correctly (I'll explain
the mutation  engine  a little  further on).  I also was  extra-
cautious on  compatibility  for this  version of Protect!  after
having  so  many  problems with  Protect! v.4.0.  Prefetch-queue
tricks are no longer used, despite their effectiveness,  because
they  may not  work on  some  machines.  In  addition,  Protect!
doesn't look for or  touch any 386 debugging  registers on a 386
(despite  its  being  suggested  to me on  several  occasions to
thwart  Soft-ICE)   because   that    can   upset   multitasking
environments such as OS/2 (R) (which I happen to use).


     Protect! v.5.0 adds something  in the neighborhood of 1k to
the average,  depending on how long the CRC error message is and
how the file is mutated by  the mutation engine.  Protect! v.5.0
is definitely slower than v.4.0 because of its extra-complicated
decryption loop,  but it should be much more  of a pain to trace
through for a hacker  (it should  load at about  the same  speed
than version 3.x did).  Also, once again, you should  not try to
layer  multiple  copies  of Protect!  on top of a  file like you
could in  v.4.0 -  the  new headers  have been  *sensitized*  to
things  placed  on top  of them  and the  combined loading delay
would start to become noticeable.


                                                                Page 6




     Like v.4.0  and unlike  versions  before that,  Protect! is
written  entirely  in  assembly  language,  mostly with  the A86
assembler.  I write and test  Protect!  on  both my  486 DX/2-66
running  OS/2  and  my  not-yet-buried  4.77/10  mhz  switchable
"turbo" XT.  Protect!  has been  around for  a while,  with many
people pitching in ideas to make it more secure. If you have any
suggestions, questions, comments, etc.  about Protect!,  you can
easily  contact me  through  Compuserve/Internet e-mail,  or  if
nothing else, postal "snail mail" and I am usually  pretty  open
to your comments.





The Mutation Engine:


     The mutation engine that you have been hearing about (which
I also didn't explain too well in v.4.0)  is an integral part of
Protect.  Now that I  have  created  a pretty  powerful mutation
engine  for Protect! v.5.0,  I think I should  at least  clarify
what it is.

     Many utilities that can attach  an envelope on an EXE (such
as LZEXE or other file  compression utilities) have are the same
every  time.  That  is  why  UNLZEXE or  generic  unprotect-type
utilities are pretty easy to make.  When an unprotection utility
(such as UNP)  unprotects  a  file,  it  creates  a  virtual-DOS
environment  for  the file  to run  in until  the file  finishes
decrypting  itself.  When  it  is done  decrypting  itself,  the
unprotect utility simply writes what's in memory to disk and you
have  your unprotected  file.  (not that difficult, right ?) The
program  may use a  different key  every time  and even  encrypt
itself, but all the  unprotect program  has to do is  just trace
through that  until it gets to the entry point,  and all of that
is for naught.

     One of the tricks  for foiling  unprotection  utilities and
debuggers lies is the fact that the unprotector must always have
control over the Protected  program in order to  stop it when it
is decrypted in memory.  If you remove the unprotector's control
and subvert it  without  harming the  operating system  or other
concurrently-running  applications,  you are  one  step ahead in
protecting your programs.  However, an unprotect  program author
can just instruct  his utility  to detect  the type  of file and
blank out the  bytes that would  kill it when  it gets  to them.
This would result into a high-tech cat-and-mouse game.

     The  reason  that it  isn't too  difficult  to make  normal
unprotects  stems from the  fact that  the protector's  security
envelope is the *same every time*. I coded a mutation engine for
Protect!  to make sure  that the security  envelopes wouldn't be
the same  every  single time a  new one  is encoded.  Instead of


                                                                Page 7



being able to "trace in"  a definite  number of bytes every time
and being  able to  blank  out a  certain number  of bytes every
time, these  figures will  have to vary  between each  and every
different file that is Protected.  If you get one  original file
and Protect on several different occasions, it will never be the
same  length  or have  the same  content  every time  (there are
thousands and thousands of different combinations).  My mutation
engine randomly decides which machine  code instructions  to use
every time:  it may  use a 3  or 4 byte  equivalent of a  2 byte
instruction or vice-versa in any order that works. Because there
are definite  rules for this mutation,  it will work every time.
Since the mutated portion  is relatively  small (but effective),
an extra  byte or two in a  spot will not  adversely affect  the
performance  of  your  Protected  files.  Protect!  uses  both a
mutation engine and a variety of  anti-debug tricks interspersed
throughout to help attain maximum security for your files.


Closing:


     There is no doubt that Protect! EXE/COM  can save you time,
effort,  energy,  and  money.   There  are  NO  "run-time fees,"
"royalties," or  anything of  the type  attached to  the cost of
Protect! EXE/COM;  you can protect  and distribute as many files
as you  want with  Protect! EXE/COM  once you register (using as
many different file integrity  error messages as you want).  The
cost is $25 per copy of  Protect! EXE/COM  per machine. There is
almost no  difference  between the  registered  and unregistered
versions of Protect! EXE/COM except for the "beg screen" and the
absence  of  CRC  error  message  customization  (actually,  the
registered version intercepts  slightly different interrupts, so
you're also a little safer with it because fewer people have the
copy with customized interrupts).  The unregistered version uses
a CRC error message saying that the  file was  protected with an
UNREGISTERED  copy of  Protect! EXE/COM,  but nobody  should see
that  message  in  the  first  place  because it  is illegal  to
distribute  Protected  files  prior to  registration <Grin>.  My
program is really  not crippled  except that I'm  sure you would
want to use your own  CRC error messages instead of the one I've
provided  (and  also to  get rid of  the "beg screen").  Besides
that, I really do not like finding  programs Protected  with the
unregistered version of my program being distributed.


     There is a definite  threat of  hackers and  viruses on the
loose and it is your  responsibility  to protect  your programs.
What other utilities try, Protect! does.  While some compression
utilities  such as  LZEXE and  PKLITE  that  are already  on the
market  marginally  have the  ability to  protect your programs,
only  Protect!  EXE/COM  has  the   ability  to   provide  solid
protection.

     Thank  you  for  evaluating  Protect! EXE/COM and  actually
reading the documentation -- Happy EXE/COM Protecting!


                                                                Page 8





     Please send any Inquiries to:


               Jeremy Lilley
               Protect! EXE/COM
               2711 Oakview Circle
               Medford, OR 97504
               Compuserve: 75060,2074
               Internet: [e-mail]