Software Recommendations

home *** CD-ROM | disk | FTP | other *** search

/ Software Recommendations - 1998 Season 1 / DNBCD4.iso / develop / tool / zip / HACKSTOP.RAR / HS.DOC < prev next >

Wrap

Text File | 1997-06-08 | 34.6 KB | 858 lines

USER MANUAL HACKSTOP ─══[ 1 HACKSTOP (HS) ]═════════════════════════════════════════─ Synopsis: HackStop (HS) protects DOS COM and EXE files against hacking, analysis, reverse engineering and unpacking. HackStop additionally encrypts COM files! HackStop uses a variety of dif- ferent anti-debugging tricks to prevent hacking of HackStopped programs. HackStop is distributed as Shareware. A few questions: ■ Have you ever written a program, then found out the next day that your program had been cracked or hacked and uploaded to all the warez BBB's and ftp's across the world? ■ Have you ever invested a lot of time and money developing a program which you released as Shareware with a registration option? Just to find out that someone made a generic "key" registration program to register your current and future versions of that software? ■ Have you ever invest money in purchasing a copy-protection product like a key-disk or a dongle plug protection to pro- tect your software from being copied by everyone? Then disco- vering the next day a cracked copy of your program on a BBS - even though it was "protected"? IF YOU ANSWERED YES TO ANY OF THE ABOVE, THEN THIS IS WHAT YOU SHOULD TEST: HACKSTOP We are all sick of those hackers and crackers who steal our soft- ware investments, it's time to do something about it. This program was not written to make money (you can not do this with a share- ware like HackStop), it was written to help the hard working com- puter programmers like yourselves. The registration costs are very low, for the amount of time it took me to develop HackStop. HS.DOC Documentation for HackStop Page 1 1.1 Table Of Contents 1 HackStop (HS)...........................................1 1.1 Table Of Contents...................................2 1.2 Why Should I Choose HackStop?.......................3 1.3 How To Use HackStop?................................3 1.4 Files That Can't Be HackStopped.....................4 1.5 Commandline-Parameters..............................4 1.6 Why Should I Use HackStop?..........................5 2 Technical Notes.........................................6 2.1 How Does An Unpacker Work?..........................6 2.2 How Does HackStop Work?.............................6 2.3 Requirements........................................6 2.4 About HackStop......................................6 2.5 On-Line Compressors.................................7 2.6 More Protection?....................................7 2.7 Protection Against Viruses?.........................8 3 Legal Terms And Disclaimer..............................8 3.1 Disclaimer..........................................8 3.2 Documentation.......................................8 3.3 License - Shareware.................................9 3.4 Distribution Restrictions...........................9 4 Closing................................................10 4.1 Registration.......................................10 4.2 Personalised Versions Of HS........................11 4.3 Updates............................................11 4.4 How to get the newest version of HackStop..........11 4.5 My Address.........................................11 4.6 Enhancements In Future Versions....................11 4.7 Some technical stuff...............................12 4.8 Credits............................................12 HS.DOC Documentation for HackStop Page 2 1.2 Why Should I Choose HackStop? HackStop is designed to encrypt and secure your executable program files by placing a special security envelope around them. To protect a specific file, simply run HackStop on it, and you and your users will never know that it's there unless somebody tries to hack or analyse it. Do not expect to be able to easily trace through HackStop's security envelope with a debugger - advanced debug traps help destroy this option. Furthermore HackStop has different levels of encryption to stop tracing or analysing at- tempts on protected programs. HackStop is the most advanced exe- cutable protection program of its type that you can buy to keep your programs from being altered or reverse engineered! HackStop was written because all the other programs I know have security holes (see below). HackStop is very popular in the under- ground and very often used. To disable any tool that will use a simple 'XOR' technique Hack- Stop has included a simple "mini mutation engine" to ensure that the encryption keys are unique! HackStop uses "memory encryption" - only the current running procedure is unencrypted! After finish- ing that procedure it will be encrypted again with a different key! In the current version HackStop has five (5) layers of en- cryption. HackStop has included code against all popular hacking tools like: » Generic Unpackers (TRON -p, CUP, UNP, XO, CUP386, X-Tract) » AutoHack, SnapShot, Intruder, CUNP, TEU & UPC Please refer to the file HISTORY.DOC to see all "supported" un- packers. 1.3 How To Use HackStop? The command-line syntax for HackStop is the following: hs filespec [-/options] For example to protect all your COM files in the current direc- tory: hs *.com To protect all EXECUTABLE (COM & EXE) files in the current di- rectory type: hs *.* HackStop will only protect files ending with "COM" and "EXE"! Please note that a file CANNOT be expanded after being protected with HackStop (you can probably think why). So please preserve a backup file until you are sure that the protected file runs cor- rectly. Some incompatibilities may possibly arise with certain files, especially with overlaid EXE programs. For this reason, HackStop can create backup files, see section "Parameters". To make backup files invoke HS with the additionally option "-b". Example: HS.DOC Documentation for HackStop Page 3 hs *.* -b This is all that you need to know before you can really start pro- tecting your program files with HackStop. 1.4 Files That Can't Be HackStopped Files smaller than 68 bytes and COM files larger than approxi- mately 62000 bytes, Windows and OS/2 files cannot be protected by HackStop. The reason for this is that a Windows or OS/2 program is basically a small DOS program that says something like "This pro- gram requires Windows" with a pointer to the actual Windows program. HackStop will automatically detect if a file has a Windows, OS/2 or a linear executable header and does not waste your time trying to protect it. Also -due to the structure of HackStop- files larger than the 600 KB neighbourhood cannot be HackStopped because the entire file has to be able to fit in the memory once when it loads. Please note that files with overlays cannot be HackStopped because the "Load Window" of DOS could now be too small for this file. Also, files with a weird EXE header will not be protected by HackStop for your own safety. Hint: Try to compress such files before HackStop'ing them! If you can compress and run them, you should be able to protect them with HackStop afterwards! You can technically protect files like COMMAND.COM but in my opi- nion it makes no sense to protect DOS system files. 1.5 Commandline-Parameters HackStop can be invoked with the following additional commandline parameters: Parameter Meaning -? -h Display a short help, how to use HackStop. -^ Show HS internal compiler information. -b Make a backup file with the extension ".BAK". Warning, old backup files are overwritten! If you have files with the same filename, but dif- ferent extension, you should use the "-bh" op- tion instead! -bh Make a backup file with the extension ".EHS" for EXE files and ".CHS" for COM files. Warning, old backup files are overwritten! -i Shows a little intro with greetings and other nice stuff - now with Adlib sound! For the intro you need a 386 CPU! HS.DOC Documentation for HackStop Page 4 -k Kills the "HSxxMsDos" signature at the end of HackStopped files. You can use this option to fool unpacker tools. This option is only avail- able in the registered version! -p Show the release number and the personalised text of HS. Remark: Options are not case sensitive. You can use "-", "/" and "," to introduce an option! Examples: hs -? hs /^ hs *.com ,bh hs *.exe -k hs -i 1.6 Why Should I Use HackStop? HackStop's first concern is security. Do you think compressing your files with PKLITE or something similar is protection enough? A hacker can also decompress a program compressed with PKLITE or LZEXE quite easily. Even if a program is compressed with the sup- posedly "invincible" -E option of the professional version of PKLITE or the "pu" option of WWPack. There are a lot of tools which can do this. I have at least about 30 different unpackers which can unpack PKLITE or LZEXE. I have a batch file (!) which is able to remove protection from COM files added by most of the popular protection tools! This batch file works with all protection programs I have access to, except with HackStop and RCRYPT! If you are interested in such unpackers, then try to request the archive UNTINY.* at your local ROSE Dist Site (see ROSEBBS.TXT). After decompressing a compressed program, any hacker can change your program (remove copyright screens, disassemble code, etc...), compress it again, and spread it around. Fortunately, hacking is not quite that rampant, but it still is a possibility and a risk, and it is much better to pay a few "DM" up-front to be safe than to be sorry in the future. Thinking NO software protection program is 100% fool-proof, I am pretty sure this program is a good choice for protecting your programs. This is the main reason, why I first developed RCRYPT for COM files, ROSETINY for EXE files (which requires TinyProg) and then HackStop. ROSETINY is the predecessor of HS, using only one (!) debugger trap and has NO encryption at all! ROSETINY is yet -after being over three years out in the wild- unpackable by any unpacker I know. You can do this by hand, but it's a hard job! HS.DOC Documentation for HackStop Page 5 ─══[ 2 TECHNICAL NOTES ]═══════════════════════════════════════─ 2.1 How Does An Unpacker Work? When an unprotection utility (such as X-Tract, TPCX, CUP, XOPEN, UNP or TRON) unprotects a file, it creates a virtual DOS environ- ment for the file to run in until the file finishes decrypting or unpacking itself. When this is done, the unprotect utility "simply" writes what is in memory back to disk. Now you have your unprotected file. The program may use a highly sophisticated decryption every time, but all the unprotecting program has to do, is just trace through the decryptor until it gets to the entry point of the host program. Then all encryption is for naught. One of the tricks for fooling unprotection utilities and debuggers lies in the fact that the unprotector must always have control over the HackStopped program in order to stop it when it is de- crypted in memory. If you remove the unprotector's control and subvert it without harming the operating system, you are one step ahead in protecting your programs. 2.2 How Does HackStop Work? To fool unpackers or generic cracking/disinfection programs you must *ONLY* disable single step tracing and breakpoints, that's all! HackStop uses a variety of different anti-debugging tech- niques, therefore ANY unpacker I know will crash when trying to trace through HackStopped programs. This is so effective that even TRON and UNP will crash if they ONLY TRY to determine the type of packer used. For this reason any HackStopped program header looks like ordinary code to confuse all tracing programs like RVK, DE- COM, TBCLEAN, TRON or UNP and all virus scanners using heuristic search methods! The second part of the HackStop header is multiple encrypted to disable setting breakpoints or to disassemble the code. In my opinion it is allmost impossible to trace HackStopped pro- grams with a real-mode software program! Additionally HackStop uses opcode and normal encryption, so it could take days to disas- semble the code! If you have a program with is able to remove the protection added by HackStop, please send me the program and I will send you an enhanced version of HackStop back! 2.3 Requirements The requirements to run HackStop are basically zero: DOS 3.30, an IBM PC with 128 KB, etc... I can run this program on my 8 MHz XT and I have done much testing of HackStop on even this lowest com- mon denominator type of machine, to make sure that HackStop will run on every type of computer from 8088 to Pentium Pro and beyond. For the HackStop intro you need a VGA and a 386 CPU or better. 2.4 About HackStop HackStop is written entirely in assembly language (MASM 6.0 + macros + ASM libraries). I have written and tested HackStop on my Pentium 166, 486 DX 4/100, 486 DX/50, 386 DX/40, 386 SX/16 and on HS.DOC Documentation for HackStop Page 6 my 4.77/8 MHz "turbo" XT. Furthermore I have tested HackStop on more than 50 different machines with different DOS and Windows versions. HackStop's anti-debugging techniques (which uses the same anti-debugger macros like ROSETINY, CHKPC or HMS) has been around for over five years, with many people pitching in ideas to make it more secure. If you have any suggestions, questions, com- ments etc. about HackStop, you can contact me. See address below. HackStop adds something in the neighbourhood of 2700 bytes to the average, depending on the program type (COM or EXE) and released version. If you ever have programmed in assembler you will know that more than 2 kilobyte of anti-debugger code is a lot of stuff to trace through! Note that HackStopped programs require DOS 3.30 or better (is there anybody using DOS 2.x?). HackStop keeps the time and date stamp of the files the same after HackStop'ing as it was be- forehand. 2.5 On-Line Compressors You do not need to have an on-line compressor, but you are STRONGLY recommended to use one because it garbles the program and makes it harder to modify or to patch. Please note that Hack- Stopped COM files normally are no longer compressible due to the strong encryption! I strongly recommend to compress COM files be- fore they are HackStopped. This makes it harder to attack them af- terwards. COM files are generally easy to hack, because DOS is an unsecure OS and does not clear the used memory, so the unpacked program can the found in memory. COM files fit into one segment and have no relocations. If you have the choice between COM and EXE file type, choose EXE files, they are safer! For this reason an additional program (COM2EXE) is included in this package to convert COM files to EXE. You can protect COM files with HackStop - convert them with COM2EXE and protect them again with HackStop. This adds a two- level security envelope around your file which makes the hacking a little bit harder. 2.6 More Protection? I suggest first to compress your program with your favourite com- pressor and then protect it with HackStop (see above). All utili- ties to check files for compression will fail on COM files because they are encrypted! I have not encounter a program with is able to recognise compression on HackStopped EXE files... BTW, some popular online compressors like WWPack, Pklite, LZEXE or Diet put a signature into the exe-header. If HackStop finds this signature it will replace it with "HS". I think COM files do not need ANY further protection, because COM files are encrypted too! EXE files can be compressed and scrambled using ROSETINY or REC. ROSETINY is yet unpackable/unhackable! After HackStop'ing them you can be sure NOBODY is able to debug or hack your programs! HS.DOC Documentation for HackStop Page 7 2.7 Protection Against Viruses? HackStopped programs are immunised against the standard Jerusalem (1808) virus family (for this reason all hackstopped programs end with the sign "MsDos"). Additionally tracing viruses like Happy_Shiny or DAME:Trigger will hang the system if they are try- ing to infect programs protected with HackStop. If you need addi- tional protection use a file shield like VSS, F-Xlock or FileShield. The basic idea behind this philosophy is that you are able to protect, scramble or compress HackStopped programs fur- thermore after adding HackStop to them. It may be possible for a protected program to set off some anti- viral programs that have heuristic abilities. This has not hap- pened to my knowledge (they cannot seem to trace through the de- cryption algorithm) but some are (AVP, RHBVS, Suspicious and Toolkit) set to alert the user if they detect a decryption algo- rithm at the beginning of a file's execution. So far, however, none of the heuristic programs I have tested seem to be able to identify the decryption algorithm as being such. TBSCAN did not indicate any heuristic flag! ─══[ 3 LEGAL TERMS AND DISCLAIMER ]════════════════════════════─ 3.1 Disclaimer HackStop basically has no legal guarantee and warranty because I do not want to get sued over it, and should be used "as is." Here is the official disclaimer: HackStop ("program") does alter executable files and may have or cause compatibility problems with them (that is why YOU should keep a backup file, in case of incompatibility with a particular file) in certain cir- cumstances. Under no circumstances may ROSE, Ralph Roth ("author") be held liable or accountable for any damage to system files, executable files, data files, or any other system or data damage due to use or misuse of his program. The author also may not be held accountable for loss of profits or for any other damages incurred by the use or misuse of his program. The author has forewarned any users that damage to files may occur with use or misuse of his program, and in executing the program, the user fully understands these risks and this disclaimer. 3.2 Documentation Information in the documentation is subject to change without no- tice and does not represent a commitment on the part of ROSE. 3.3 License - Shareware The supplied software contains NO public domain program(s). The program and all accompanying documentation are Copyright (c) 1994- 97 by ROSE. All rights reserved. HS.DOC Documentation for HackStop Page 8 This software and accompanying documentation is protected by the Copyright laws of Germany. Any use of this software in violation of Copyright law or the terms of this limited licence will be prosecuted to the best of our ability. The conditions under which you may copy this software and documentation are clearly outlined below under 'Distribution Restrictions'. HackStop is distributed as SHAREWARE. You may use HackStop for the purposes of evaluating it (after understanding the disclaimer and the documentation) for 60 days. No files protected by HackStop during this trial period may be distributed to OTHER computers at all, commercially or non-commercially. If you find HackStop to be of use to you, you must register HackStop with the author. ROSE hereby guarantees you a limited licence to use this software for evaluation purposes for a period not to exceed sixty (60) days. If you intend to continue using this software (and/or its documentation) after the sixty (60) day evaluation period, you must make a registration payment to ROSE. Using this software af- ter the sixty (60) day evaluation period without registering the software is a violation of the terms of this limited licence! You shall not use, copy, emulate, clone, rent, lease, sell, mo- dify, decompile, disassemble, otherwise reverse engineer, or transfer the program, or any subset of the program, except as pro- vided for in this agreement. Any such unauthorised use shall re- sult in immediate and automatic termination of this licence. All rights not expressly granted here are reserved by ROSE. 3.4 Distribution Restrictions As the copyright holder, ROSE authorises distribution by indi- viduals only in accordance with the following restrictions. The package is defined as the entire file either as 'self ex- tracting executable' or an 'archive' as distributed by ROSE. The authenticity of the package can be verified by contacting ROSE or using the program CrCheck. The original archive is packed by RAR, using its AV check. If the package is changed in any way, the dis- tribution is forbidden. Please contact ROSE to obtain a complete package suitable for distribution. You are hereby granted per- mission by ROSE to copy the package for your own use or for others to evaluate, ONLY when the following conditions are met: ■ The package - including all related program files and doc- umentation files - CANNOT be modified in any way and must be distributed as a complete unchanged package, without excep- tion. Small supplements to the package, such as the introduc- tory or installation batch files are acceptable. This should always be done by supplying EXTRA files, never by altering the package (file) as distributed by ROSE. ■ No price or other compensation may be charged for the pack- age. A distribution cost may be charged for the cost of the diskette, shipping and handling, as long as the total (per disk) does not exceed US$ 10. The package CANNOT be sold as part of some other inclusive package, nor can it be included in any commercial or non-commercial software packaging offer, without a written agreement from ROSE. HS.DOC Documentation for HackStop Page 9 ■ ROSE prohibits the distribution of outdated versions of the package, without written permission from ROSE. If the version you have obtained is over twelve (12) months old, please con- tact ROSE to ensure that you have the most current version. ■ The package, program(s) or documentation cannot be 'rented' or 'leased' to others. If you wish to add any of our packages to a CD-ROM or other collection, please check the release date of the version you have. If the version is over twelve (12) months old then please contact ROSE to ensure that you have the most current version. ■ If you would like to distribute the package as a 'Disk-of- the-Month', or as part of a subscription or monthly service, then you must contact ROSE in advance to ensure that you have the most current version of the software. Only current ver- sions may be shipped as 'Disk-of-the-Month' disks. ■ You may not list any of my products in advertisements, ca- talogues, or other literature that describes this product as 'FREE SOFTWARE'. This is 'Try-Before-You-Buy' software, it is not free! ─══[ 4 CLOSING ]═══════════════════════════════════════════════─ There is no doubt that HackStop can save you time, effort, energy and money. There are NO "run-time fees", "royalties" or anything of the type attached to the cost of HackStop. You can protect and distribute as many files as you want with HackStop ONCE YOU REGIS- TER. The cost is DM 30,-- per copy of HackStop. Please use the file REGISTER.DOC to order a registered version of HackStop! Please send the register form to my address, even if you have transferred the money to my bank account, because our address will often be unreadable on checks! 4.1 Registration There is almost no difference between the registered and unreg- istered version of HackStop except for the "beg remark" and the ASCII remark in HackStopped programs, saying that it is an UN- REGISTERED SHAREWARE version. The registered version of HackStop has a different 'data offset',other antidebugging macros and dif- ferent protector length, so programs protected with the Shareware version will always differ from the registered versions! Additionally the registered version of HackStop supports the switch "-k" to remove the HackStop signature. Along with register- ing HackStop you will receive the newest currently available ver- sion of HackStop! To register your copy of HackStop please print out the file REGISTER.DOC. Additionally with the registered version of HackStop you will re- ceive the newest versions of ROSE COM Crypt/286, ROSE EXE Cryptor (REC) and ROSETINY (Freeware) as well as beta versions of HackStop or other file protection tools, if available! German users will additionally receive some bonus antivirus programs in German writ- ten by ROSE Softwareentwicklung. I always try to put as many pro- grams as possible (packed with RAR) on the disc containing HackStop... HS.DOC Documentation for HackStop Page 10 4.2 Personalised Versions Of HS You can obtain a so called "personalised" version of HS. The dif- ference between the normal version and this version is that your copy of HS carries your name and address or an advertising slogan. For this reason personalised HS versions will produce hackstopped programs with a different length and a different offset that means that they are harder to attack than the registered (standard) or Shareware version. COMMERCIAL USE OF HACKSTOP REQUIRES A REGISTRATION! Please note: Some user want to have a "personalised" string like: (C) by SuperSoft etc. Please do not use "(C) by" or "Copyright by" because this is confusing who has developed HackStop. :-) If you want, you can include up to 6-10 lines of text into your person- alised version! You can send us your text logo to be included in HS.EXE. There is also a version available with no text. This makes the envelope a little bit smaller and harder to detect. 4.3 Updates I am sure that I will make enhancements to HS in further releases. You, as a registered user, can order then the newest version of HS for half price. 4.4 How to get the newest version of HackStop First take a look at the file ROSEBBS.TXT - it contains BBS addresses providing new HackStop version for downloading. 4.5 My Address ROSE Softwareentwicklung Dip.-Ing. (FH) Ralph Roth Finkenweg 24 D 78658 Zimmern Germany Fido address with EMail gateway: Ralph_Roth@p2.f2101.n246.z2.fidonet.org (Fido: Ralph Roth 2:246/2101.2) Check the file REGISTER.DOC for my FAX address! 4.6 Enhancements In Future Versions If there is enough interest (registrations!) in HackStop the fol- lowing features could be implemented: ■ Relocation and encryption of your EXE files (remember COM files are encrypted!). A prototype already exists (REC) which I use to protect HS.EXE and COM2EXE.EXE! ■ Enhanced encryption of the HackStop header using a mutation engine. I think there is no need for this HS.DOC Documentation for HackStop Page 11 - if you register you will get RCC (ROSE's COM Crypt) which makes use of a mutation engine. ■ Virus selfchecking of COM and EXE files (optional). ■ Password protection of HackStopped COM and EXE files (optional). ■ Optional 80386 checking of HackStopped programs. ■ More traps and different debugging macros. ■ Handling of Win 3.x (NE) and Windows 95/Win-NT (PE) EXE programs. A PE (Win95/NT) prototype already exists. Thank you for evaluating HackStop and actually reading the documentation! Happy HackStop'ing! All improvements and sugges- tions will be welcome! If you can hack HackStop, please send me the unpacked files back! 4.7 Some technical stuff With version 1.11, HackStop adds a signature to programs protected with HackStop. You will find at the last 9 bytes at the end of the file the following code: "HS", verhi, verlo, "MsDos" "verhi" and "verlo" are the version numbers of the used HackStop program. If you have used version 1.11 then verhi is 1 and verlo is 11. Some C code: printf("Version used: %i.%02i", verhi, verlo); Note that you can remove this signature with the "-k" switch in the registered version of HackStop! 4.8 Credits I would like to thank and send "greetings" to the following peo- ples for pitching in ideas, finding bugs and doing beta testing of HS: ■ Andreas Marx (author of CGL AV and TScan) ■ Ben Castricum (author of UNP) ■ Christian Ghisler (author of Win-Commander) ■ Grischa Brockhaus (author of SkullCheck) ■ Hanno Böck (author of ChkEXE) ■ J.H. Dinges ■ Peter Hubinsky (Sysop SAC BBS/SAC ftp) for being the first distributor of HackStop world-wide. ■ Rafal Wierzbicki & Piotr Warezak (authors of WWPack & SacView) ■ Ralph Biedermann (sysop of LionBox/Germany), all the sysops distributing HackStop! ■ Rene Rudolf ■ Stefan Kurtzhals (author of SSC) ■ VrtíkSoft - J. Války & L. Vrtík (authors of TraceLook). THX guys for pitching in so many ideas in HackStop. ■ Walter Gabor for correcting the docs. HS.DOC Documentation for HackStop Page 12 ■ Willi Marquardt for antidebugging tricks and for hacking HS. ■ Members of X-Adi, UE, UCF, TPiNC, Vandals etc. - look at the comments in the intro :) ■ All those I have forgotten to mention: Run HS.EXE with the option "-i" /* the end */ HS.DOC Documentation for HackStop Page 13