To protect my code

Dear Sirs,

I built an executable file without GUI because I can not find Italian documentation and now I would like to protect my software. I used pcode and deploytool with this order but I would like:

1.to write the password into windows command prompt too (In this time I use logindlg but I don’t like it very much)

http://www.mathworks.com/matlabcentral/fileexchange/8499

2.to create an executable file that work on one computer only too (I would like to use a code that to read IP of my pc)

Are they possible?

Thanks M. Peruzzo

Answer 1

[Jan]

While it is easy to create a password input dialog in a few lines, restricting the usage to a single computer is actually impossible, when you want a serious protection level. On one hand the TCP/IP can change, on the other hand it is not trivial to obtain it in a trustworthy way. Usually the MAC-address of the network card is used, but this can be modified by a user also. Finally a user can install your program in a virtual machine, such that running it on several real computers is trivial also.

I suggest to read http://undocumentedmatlab.com/blog/unique-computer-id/. Finally it is more helpful to let a customer sign a non-disclosure agreement and ship the program as source code. All big software manufacturers have been victims of pirated software, therefore I do not think that a reliable copy-protection is possible except for the cruel online activation.

[EDITED] Password dialogs from the FileExchange:

• http://www.mathworks.com/matlabcentral/fileexchange/37292-login
• http://www.mathworks.com/matlabcentral/fileexchange/29616-passwordui
• http://www.mathworks.com/matlabcentral/fileexchange/26624-password-gui
• http://www.mathworks.com/matlabcentral/fileexchange/24861-41-complete-gui-examples/content/GUI_37.m
• http://www.mathworks.com/matlabcentral/fileexchange/23045-getauthentication
• http://www.mathworks.com/matlabcentral/fileexchange/19729-passwordentrydialog
• http://www.mathworks.com/matlabcentral/fileexchange/6590-passcode

I expect that these programs contain enough example code. When you want to solve a standard problem, searching in the FileExchange is a good idea.

[Mario]

I am sorry for my mistake. Your help is super but I don't like second part because I do not want a GUI solution. I would want to write the password into command prompt of windows.

http://www.2shared.com/photo/qz_ZCLPw/secondoproblema.html

[Jan]

What is the "command prompt of Windows"? Do you really mean cmd.com? If so, you cannot influence the appearence of the characters as simple as in a GUI. And if you could do it, this would be a big security hole again, because the transport of the password from the external console to the function which compares the password cannot be secured.

Btw. Do not store the password in clear text in the function, because it is trivial to extract. Store a "salted hash" instead. WikiPedia knows the details.

[Mario]

Yes it is: command prompt of Windows = cmd.exe :)

I don't understand your last sentence:

"Store a "salted hash" instead. WikiPedia knows the details."

Could you use an other English please?

Thanks very much

[Jan]

Yes, Mario, I can try to formulate it in a different way: Storing the correct password in clear text inside the function allows to reveal the seceret easily. Therefore a hash value of the password is stored and compared with the hash of the password typed in by the user. But passwords have usually 6 characters, to be exact, they contain the characters '1' to '6' in sorted order. Therefore it is very cheap to use a lookup table to search in your program for the hash-values of the most frequently used 1e6 passwords. Tools, which perform this automatically, can be downloaded freely from the net. To avoid such attacks, the hash value is not calculated directly, but a so called "salt" is added by the function, which checks the password, e.g. 'a98D8szd*=)+&R'. Now the user types in the dull '123456', but the hash is created for 'a98D8szd*=)+&R123456'. Although the hash must be store in clear text, this increases the costs of a brute force attack or the create of a lookuptable dramatically. As mentioned already, this method is explained exhaustively in WikiPedia - simply ask Google: https://www.google.de/search?q=Wiki+salted+hash. This was meant by "WikiPedia knows the details."

But the corresponding WikiPedia articles contain a meta-message: Creating secure login procedures is an extremly complicated task. Even international credit card companies repeatedly fail to implement this reliably.

[Mario]

I understand you, thanks for your help. Perhaps I find a solution but I still have a problem: I would like to delete the figure, is it possible?

.m

 function pw=prova  
  callstr = 'set(gcbf,''Userdata'',double(get(gcbf,''Currentcharacter''))) ; uiresume ' ;
  h = figure(...
      'keypressfcn',callstr, ...
      'windowstyle','modal',...
      'position',[-10000000000 -100000000000 1 1],...
      'userdata','timeout') ;
  k=1;
  while get(h,'Userdata')~=13
      uiwait;
      fprintf('*');
      pw(k) = char(get(h,'userdata')) ;  
      k=k+1;
  end
  fprintf('\n');
  pw=pw(1:end-1);
  delete(h) ;

programma.m

disp('Digitare la password di autenticazione:');
p=prova;
if strcmp(p , '100') == 0
    return
end
A=input('A? ');
B=input('B? ');
C=A+B;
disp('Somma: ');
C

Answer 2

[Mario]

I am agree about your consideration but I would like to protect however my software from inexperienced average user, can you help me about that? I'll settle for a bland protection! I have two problems that I reported in previous message.

[Jan]

Did Yair's blog help you to obtain a kind of machine-IP? What is the problem for the password input dialog?

[Mario]

I would want to write the password into command prompt of windows.

http://www.2shared.com/photo/qz_ZCLPw/secondoproblema.html

Answer 3

[Mario]

I read your page about “Unique computer ID” and I found it very interesting. Thanks very much! :) My second problem is to write the password into command prompt of Windows. Watch here:

http://www.2shared.com/photo/JWkD54Zn/secondoproblema.html

[Jan]

Please post comments as comments and not in the section for answers.

See [EDITED] in my answer above.

[Mario]

Ok, I am sorry. I hope to undersand you, I am not so expert with English...