Encryption DLLs

[Barguast]

I have written an encryptor in VC++ and made a DLL out of it. I want to use this in a VB Program I'm writing.
The problem is that functions used in the DLL are accessable outside of the VB program which means anyone could access the cryption routines. Is there any way I can put C++ code directly into a VB program, or a way I can ensure that only my VB program can use the DLL?

[Yonatan]

Well, you could port it to VB... Bad idea though
Could also call GetModuleFileName and compare it to the expected name of the exe.
Can't think of any simple way that can't be easily hacked by anyone who's a little bit experienced though.

[Sastraxi]

It's very very primitive, but it works. Try making the functions not work without an Init function. This function has a hardcoded value that the parameter passed must match. You can use a CRC only of the correct parameter there. If the CRC of the passed function is equal to the CRC inside the sub, bingo you've got a match and the functions become usable.

[Yonatan]

Originally posted by Yonatan
Can't think of any simple way that can't be easily hacked by anyone who's a little bit experienced though.

[Sastraxi]

There's no way to get the original value from the CRC, so the only way to get past that would be bruteforce.

[Yonatan]

Yeah... Just load the DLL and edit its memory (specifically, the value that specifies the Init status) so it thinks the Init function was successfully called.

[twanvl]

Or just temporaraly replace the DLL with your own, and record what value the VB program passes to it.

[Sastraxi]

*sigh*. If only encryption wasn't needed

[CornedBee]

Can VB embed binary resources? If so then you could maybe embed the DLL, extract it on startup into a temporary file, load it and on closedown delete the file.

But I don't think VB can use LoadLibrary and GetProcAddress properly, especially GetProcAddress...

And you could still force crash the VB app to hinder it from deleting the DLL, or even simpler extract the resource.

[Sastraxi]

Web-based authing.

[CornedBee]

People will love you when your app requires an internet connection for no apparent reason.

[Yonatan]

Originally posted by Sastraxi
Web-based authing.

...and it still can be bypassed.

Web based authorizing is only useful when the actual service is Internet-based. If the authorizing is Internet-based, and the service itself is independent of the Internet (so that the whole code is compiled for you), people will crack the authorization.

On that note, you can make a server that requires authorization, and does the encryption. However, you should note two things:
[list=1][*]You have to think of a good authorization method, or it won't be secure enough.[*]Depending on the type of encryption and the geographical location of the server, it might be subject to encryption export laws in the country it's in. (For example, in the USA, you cannot export encryption that uses keys larger than 40 bits.)[/list=1]

[parksie]

Do it from Canada or the UK then

[Lord_Rat]

VB can use resources.

You have to add the VB resource editor to the project. -- Plenty on this in the VB section.

Once you insert it, you can extract it at run time when you need it using a save as routine.

When you do, randomly create a folder name and put it there, run it, delete the file and the folder.

Other things to do:

Have the DLL check the calling app for an initialization value (discussed above). Change this value using the time as a seed.

Send back encrypted results. Just less encrypted than usual and easy (relatively) to decrypt just in case someone tries to intercept the sent back data, which can be done easily. At least they wont recognize it right off

Place a dummy DLL file that looks like it does the same thing, but strip the code from the routines. Leave any String data, however, so that they appear in the compiled DLL.

[CornedBee]

Originally posted by Lord_Rat
Send back encrypted results. Just less encrypted than usual and easy (relatively) to decrypt just in case someone tries to intercept the sent back data, which can be done easily. At least they wont recognize it right off

He wants to hinder people from using the DLL, not intercepting the data decrypted by it (they get that presented by the VB app anyway).

[parksie]

Why do you want to stop people using the DLL?

[CornedBee]

To hinder other apps from decrypting the data. He doesn't want that the user notices the encryption, so he can't use a password.

At least I think that's the reason, if I remember correctly Barguast asked about such things a while ago.

[parksie]

Security through obscurity is no security.

[Barguast]

Lord_Rat's solution sounds doable. Although I'd have thought they're be a way to embed a C++ function in a Visual Basic project...

[parksie]

There is. It involves messing around with VB's linking procedure to insert your own code to a matching VB function, hence replacing it.

[Barguast]

I don't suppose you could tell me how?

[parksie]

Nope, I don't remember it any more, and don't have copies of either VB, Visual C++, or Windows any more, so you'll just have to use Google

[Barguast]

I'm no expert at this, so what exactly should I be searching for? "function embedding"?

[parksie]

Search for VB, C++, and Linking.

And pick random words from what you think you're doing

[Barguast]

ak, I'm finding sod all. Is there a proper name for this technique? Is it anything to do with OBJ files?

[parksie]

http://www.google.com/search?q=visua...&start=30&sa=N

Start with the second one down

[Barguast]

I take it you meant the third one down.
It mentions a Compile Controller Add-in which I don't have, and all the example code is gone.