POINT Software Programming/PPROG1.ISO/misc/prexcm20/protect.doc

Text File | 1993-05-30 | 19.3 KB | 402 lines

                       Protect! EXE/COM version 2.0
                (C) 1993 Jeremy Lilley, All Rights Reserved
                               May 31, 1993



NOTE: PLEASE READ THIS DOCUMENTATION WELL BEFORE ATTEMPTING TO USE THIS
PROGRAM -- YOU MAY ACCIDENTALLY BUT IRREVERSIBLY DAMAGE FILES!!!



Contents:
        Introduction
        Requirements
        How to use Protect! EXE/COM
        Which Files can't be Protected
        Legal Terms / Disclaimer
        License
        How Does Protect! EXE/COM Stand up to Other Utilities
        Notes About COM Protecting
        Notes about EXE protecting
        Finally, Protect! EXE/COM's Cost




Introduction:



     Finally, you can truly protect your EXE and COM files from
modification and still leave them executable! If you are a programmer, this
program can be one of your most important tools -- you can save time and
energy by simply using this program to scramble your EXE or COM programs
instead of working on complicated copy-protection schemes of your own.
Shareware authors in particular can provide a peace of mind to their
potential registrants by protecting their programs from possible hacking
that may occur before the potential customers obtain the product. Others
can use this program for additional security in a virus-prone environment
or to protect their software investment. Protect! EXE/COM is extremely
effective in the level of security that it provides -- a CRC (Cyclic
Redundancy Check, complex check for file integrity) is calculated whenever
the protected program is loaded, and no program with a bad CRC will be
allowed to run at all. Compare that to the fact that NO OTHER PROGRAM ON
THE MARKET SUPPORTS CRC CALCULATIONS EVERY TIME a protected program is
loaded -- not even PKLite (R) commercial (which still happens to cost
almost $150). You will find that Protect! EXE/COM is the best product for
the security of your EXE and COM files as well as the best value for your
file security dollar.

     If you have tried previous versions of Protect! EXE/COM before,
this version is unlike any of the other versions because it has many,




many times more security than previous versions did (see WHATSNEW.DOC).

     Let's go down memory lane briefly and explore some of the more
primitive methods used to secure EXE and COM files. In the beginning of
computing, programmers simply hoped that nobody was smart enough to modify
their files. This method worked until the advent of malicious, clever
hackers with sophisticated hex editors. Programmers then started resorting
to some security methods like copy protection and "tying" a file to the
disk; however, they were extremely obtrusive and slow -- they did not work.
LZEXE and then PKLite came out and programmers thought that by simply
compressing the files with utilities like these, they were home-free. When
UnLZEXE came out and along with PKLite and its decompress option,
programmers were again starting to have problems with protecting their EXE
and COM files. To trick these decompressors, programmers would simply use
their favorite hex editors to change the signature that UnLZEXE or PKLite
would look for on a file and hoped that nobody would change the signature
back to the original and decompress the file. PKWare added a -E option on
the $150 commercial version of PKLite to prevent decompression, but that
has not really worked because hackers have created programs to expand the
"unexpandable" PKLite -E files and made them widely available -- one BBS
local to me has a couple of such programs. Now what for programmers who
wish to preserve the integrity of their programs ? I created Protect!
EXE/COM to solve this problem.




Requirements:



     The requirements are basically nil: DOS 2.0, IBM PC, 256k, etc... I
can run this program on my 4.77 mhz XT and have it run quickly. The one
major software requirement for protecting EXE files is that you are
REQUIRED TO OWN AN EXECUTABLE COMPRESSION PROGRAM such as LZEXE (FREE!),
PKLite, or Compack. The reasons are simple -- scrambled data seems more
scrambled if it is compressed first. If you have huge sequences of the same
character (particularly ASCII #0), the encoding sequence can be revealed
much more easily than if you simply have the tokens and marker characters
that a compression program would leave instead. Relocatable items are also
resolved by the compression program, allowing Protect! EXE/COM to calculate
a CRC reliably. Of course, the file also takes up less space when
compressed with an executable compressor, and it will give a hacker more
problems than those that Protect! EXE/COM gives alone. Protect! EXE/COM
also can insure that the programs that it protects will run consistently if
they originate in the more consistent form that LZEXE or PKLite provides
them in. Besides, LZEXE is a free program thanks to the generosity of
Fabrice Bellard, and if you need a good yet free EXE compression utility,
you should obtain that program (because it only takes a few minutes to get
by modem or a few dollars for it on a disk, and it has been translated into
English, you really should have no excuse for not having it). Most
importantly, Protect! EXE/COM will almost surely protect any file that has
been compressed with LZEXE or PKLite because the requirements are very
similar: overlays, Windows files, and OS/2 files that cannot be compressed
with LZEXE and PKLite cannot be protected by Protect! EXE/COM either, so if
a file can be compressed, it can probably be protected.


How to use Protect! EXE/COM:






     To use Protect! EXE/COM, simply run ProtExCm.EXE with the program to
protect and the password as parameters. The password can now contain spaces,
underscores are not required. Here is an example:

     ProtExCm PROGRAM.EXE This is My Password

PROGRAM.EXE is protected with "This is My Password" as the password. The
original PROGRAM.EXE is renamed to PROGRAM.OLD. The symbol @ can be used to
say that the password is in a file:

     ProtExCm MYPROG.COM @MYPASSWD.FIL

MYPROG.COM is encrypted with the contents of MYPASSWD.FIL as the password.
Only the first 255 bytes of the file will be used for the password, and if
the file is less than 255 bytes, only that will be used as the password.
Please note that the same password will probably not yield the same
encoding sequence because of the way that the password is generated (the
time of day and the date is used along with the password to insure greater
randomness). Once again, the original MYPROG.COM is renamed MYPROG.OLD.
     Please note that no file can be expanded after being protected with
Protect! EXE/COM, so please preserve the original file until you are sure
that the protected file runs correctly (some incompatibilities may arise
with certain files). That is about all that you need to know before you can
really start protecting your programs with Protect! EXE/COM. EXE files must
be compressed with LZEXE, PKLite, or Compack and then protected but COM
files can be directly protected. A file called Protect.BAT is included, and
using it can be much easier than doing the steps separately:

     Protect.BAT :
          if %2=="COM" goto comfile
          lzexe %1.EXE                     (you can use PKLite here also)
          ren %1.OLD %1.BAK
          ProtExCm %1.EXE This_isn't_my_Password
          del %1.old
          ren %1.bak %1.old
          goto End
          :comfile
          REM you can use PKLite to compress COM files if you want
          ProtExCm %1.Com This_isn't_my_Password
          :End

     To call this batch file, simply type "Protect PROGRAM COM" to protect
PROGRAM.COM or "Protect PROGRAM EXE" to protect PROGRAM.EXE.




Which Files can't be Protected:



     MS Windows, OS/2, and overlay files cannot be protected with Protect!
EXE/COM. Basically, anything that can be compressed with LZEXE or PKLite
can be protected. Some programs, however, do not like being protected. Some
commercial programs have it in their licenses that they cannot be




protected, and other programs simply have types of copy-protection which
inhibit their protection with this program. DO NOT PROTECT COMMAND.COM,
IBMBIO.COM, IBMDOS.COM (IBMBIO.COM and IBMDOS.COM correspond to IO.SYS and
MSDOS.SYS in MS-DOS), or any other system-type file. You will most likely
have to reboot the computer from a system disk if you try that. Other
programs also have their own loaders like COMMAND.COM does -- don't protect
these either.




Legal Terms / Disclaimer:


     Protect! EXE/COM ("program") will alter executable files and may
render them useless (that is why .OLD files are created, in case of
incompatibility arises with a particular file) in certain circumstances.
Under no circumstances may Jeremy Lilley ("author") be held liable or
accountable for any damage to system files, executable files, data files,
or any other system damage. The author also may not be held accountable for
loss of profits or for any other damages incurred by the use or misuse of
the program. The author has forewarned any users that permanent damage to
files may occur with misuse of his program and in executing the program,
any user understands this risk. This also seems the place to say that
PKLite is a registered trademark of PKWare Corp., MS Windows is a
registered trademark of Microsoft Corp., and OS/2 is a registered trademark
of IBM corp.
     Don't worry -- there is little risk of damage resulting from this
program's use as long as you use it correctly. However, if you try to make
it mess up, it probably will. Just don't try protecting IBMBIOS.COM and
then wondering why your system won't boot up correctly.





License:



     You may use Protect! EXE/COM for the purposes of evaluating it (after
understanding the disclaimer and the documentation) for 30 days. No files
protected by Protect! EXE/COM during this trial period may be distributed
to other computers at all, commercially or non-commercially. If you find
Protect! EXE/COM to be of use to you, you must register Protect! EXE/COM
with the author. Government, educational, and commercial institutions
absolutely must register this program with the author (please contact him
for quantity discounts). Sysops, user groups, disk vendors, and other
similar organizations may distribute Protect! EXE/COM provided that no
files are excluded from the distribution and that no more that $8 is
charged for distribution.




How Does Protect! EXE/COM Stand up to Other Utilities?






     Protect! EXE/COM's first concern is security -- especially with EXE
files. While NO OTHER utility allows a CRC to be taken EACH time your
program is run, Protect! EXE/COM does so each and every time. Though
loading may be slowed a half of a second on average, Protect! EXE/COM is
still much faster than fooling around with copy protection-type schemes
because Protect! EXE/COM's loader loads completely in memory using highly-
optimized routines. Try PKLiting an EXE file and change a byte or two in
the middle of the file (find parts of text that you can still recognize
slightly). As long as the program doesn't crash, PKLite doesn't notice your
changes at all. A hacker can also decompress a program compressed with
PKLite or LZEXE quite easily -- even if a program is compressed with the
-E option (supposedly "invincible") on the commercial version of PKLite.
After decompressing, any hacker can "fix" your program (remove copyright
screens, add "trojan horse" routines, etc...), compress it up again, and
spread it around, possibly damaging your profits, your reputation, and
others' computers. (I hope you have a good disclaimer...) Fortunately,
hacking is not totally rampant like that, but it still is a possibility and
a risk, and it is much better to pay a few dollars to be safe than to be
sorry. I don't want to have "hacks" of my programs floating around or to
have to worry about that, and neither should you. Though no software-only
protection program like this is 100% fool-proof, I am pretty sure this
program is the best for protecting your EXE and COM files. Most "trojan
horses" and "hacks" can't be detected by ordinary virus scanners, and it is
up to you to defend the security and well-being of your programs.





Notes About COM Protecting:


     One of the main disadvantages with this program is its decrease in
loading speed. However, since a COM file is always less than 64k (65536
bytes), any decrease in loading speed is not much of a factor. The COM file
protector is much less sophisticated than the EXE file protector. The COM
protector calculates a simple CRC and does a little encrypting, but not to
the extent that the EXE protector does. You can use Protect! EXE/COM on any
COM file that you want to add a moderate level of protection to. The COM
protector will discourage most people from touching the file and give
anyone who wants to get through it a great deal of grief. The COM protector
adds fewer than 200 bytes to a file yet adds a great deal of protection. It
is not the most sophisticated protector possible, but it calculates a CRC
and works quickly. There is little slowing in loading, but to calculate it
exactly, I created the largest possible COM file (just less than 64k) and
loaded it on my 4.77 mhz XT (its first instruction was to terminate and the
other 63k or so was garbage). Unprotected, it took 1.9 seconds, and
protected, it took 2.5 seconds. The difference in the speed is negligible
on an XT, and it is even more negligible on a 386 or 486. Besides, if you
care enough about that 0.6 of a second on a 4.77mhz XT, you will probably
have a 486 fast enough that you will not be able to blink faster than the
program's loading. Please note that neither the COM protector nor the EXE
protector can really guard too much against viruses; if the virus is tacked
on a file after it is protected and it does not modify the program's actual
image, there will be no warning. If you want to test Protect! EXE/COM's
protection against hacking, simply protect a file, use your favorite hex
editor (you probably won't recognize anything in the file with it) to
change any byte (or more), and then run the file. If the change is in the




loader, the program will simply crash; however, if the change is in the
program's image, the program will terminate and you will get a CRC error
message. Remember that error message, because whenever a change is
detected, the program will halt with that message. If you are a programmer,
you should make a note in your documentation to contact you if your user
encounters that message along with where the user obtained the file.




Notes about EXE protecting:



     This EXE file loader will give any hacker a great deal of trouble
trying to defeat: all data areas are encrypted, a more reliable CRC method
is used, self-modifying code (what every hacker just loves to see) is
sprinkled liberally in the file, all data areas and decryption units are
cleared after being used, and a rather long encrypting sequence is used.
Please read the COM file notes above before reading this, and also try
testing Protect! EXE/COM's protecting ability by modifying protected files.
Since EXE files can have a rather unlimited size limit (for MS-DOS running
under 640k conventional memory in real mode WITHOUT OVERLAYS, there is
somewhat of a practical size limit about 400-500k), they can tend to take
up many 64k segments, requiring them to be loaded using slower methods. It
is for chiefly this reason why loading EXE files with Protect! EXE/COM may
be a bit slower than loading COM files of the same size. Both decrypting
and CRC calculating are done in one pass with a minimum of PUSHing and
POPing to speed things up, and little noticeable slowing may occur. You
must use a compressor such as LZEXE or PKLite before protecting an EXE file
in order to insure that the relocation pointers are dealt with. PKLite
still leaves one relocation pointer in the table, so a special temporary
file must be created which makes the actual protecting of a PKLited file
much slower. The EXE protector adds around 300 bytes to a file, depending
on the actual file size, and about 50 bytes in addition to that if the file
was PKLited instead of LZEXEd. That much space is negligible, especially
with the advent of multi-gigabyte harddrives. In addition to any overhead
that LZEXE or PKLite adds to a file, Protect! EXE/COM will increase the
initial load time by approximately 50%. Remember, THAT DOES NOT NECESSARILY
MAKE IT TAKE 50% LONGER FOR THE PROGRAM TO START because a good portion of
the delay for a program's loading is the program's own initialization of
variables instead of just MS-DOS's physical loading, and that period of
time will stay constant. In and all, you really should ONLY EXPECT A 20-
30% DELAY IN TOTAL PROGRAM STARTING TIME, and that extra half-second or so
of delay will not really bother anybody. You are only allowed to run
Protect! EXE/COM on an EXE file once because the time delay for a file that
has had Protect! EXE/COM run on it several times can start to get way too
long. Again, anybody who will kill himself over a 20% increase in load time
(which will usually be about a half a second at the beginning of a program)
will have the most powerful 486 on the market on his desk. But in any case,
that 20% or so increase of load time will not be noticed AT ALL by most
users on most files.



Finally, Protect! EXE/COM's Cost:

     After seeing how Protect! EXE/COM can save you time, effort, energy,




and money, it is now time to discuss price. There are NO "run-time fees,"
"royalties," or anything of the type attached to the cost of Protect!
EXE/COM; you can protect and distribute as many files as you want with
Protect! EXE/COM once you register. The cost is $25 per copy of Protect!
EXE/COM which may be used on one machine. There is almost no difference
between the registered and unregistered versions of Protect! EXE/COM except
for the "beg screen" and the "Registered to:" message on the main screen. I
was going to have the unregistered version of Protect! EXE/COM imbed a
copyright message or something like "Made With an UNREGISTERED Copy of
Protect! EXE/COM" into the output file, but I decided against it because
most people could get out their favorite hex editor and replace it with
their own message. Because of that, you are even more on your honor to
register Protect! EXE/COM. It is not crippled at all, and I really do not
like finding programs protected with the unregistered version of my program
being distributed. Registered users get support via mail, Compuserve,
limited BBS support, the ability to distribute protected files, and more!
     There is a definite threat of hackers and viruses on the loose and it
is your responsibility to protect your programs. While some compression
utilities such as LZEXE and PKLite that are already on the market
marginally have the ability to protect your programs, only Protect! EXE/COM
has the solid ability to provide much more protection for only $25.

     Thank you for evaluating Protect! EXE/COM and actually reading this
much of the documentation -- Happy EXE/COM Protecting!

     Send any Inquiries and Registrations to:
                              Jeremy Lilley
                              27816 Radfall Court
                              Santa Clarita, CA 91350
                              Compuserve: 75060,2074