Encryption for Executable

Question

Can anyone recommend what's a good way to encrypt an executable? I was trying to use AxCrypt but I don't like the usage, i.e. you specify a passcode and the person who launches the exe needs to specify the passcode. Is there someway to encrypt it once and users just run the exe without specifying any passwords?

Answer 1

It's basically pointless. If it's a .NET or Java program, obfuscators can improve performance and decrease the executable size and make it difficult to reverse engineer. Packers can decrease executable size. Signing can provide assurance to your users that you built the program. But encryption of the executable for the purpose of hiding it's executable code is rather pointless.

Answer 2

A program which knows how to decrypt itself will contain all the information a hacker needs to compromise the program. You are handing out the lock with the key. However, lets assume you want to put up a small barrier to entry to your program. Maybe you have cheat codes in your game and you don't want someone to be able to just run 'strings' over your program and view them.

What I suggest is packing your program with an a program like UPX. This can further obfuscate your program on disk. Your basic interrogation techniques will only see the tiny decompressor. However, a determined hacker will quickly recognize the compressor program and decompress it. In either case, once a program is running in memory, one can take a core dump of the process, or attach a debugger to it. There isn't much you can do to prevent this on most hardware.

Answer 3

You guy's don't understand the question, it's normal for a programmer to think that way. But as a ethical hacker it is clear that he wants to bypass the antivirus not hide the code, anyway you may use Visual Basic.

for encryption use this code

Public Function TripleDES_Encrypt(ByVal input As String, ByVal pass As String) As String
  Dim TripleDES As New System.Security.Cryptography.TripleDESCryptoServiceProvider
  Dim Hash_TripleDES As New System.Security.Cryptography.MD5CryptoServiceProvider
  Dim encrypted As String = ""
  Try
      Dim hash(23) As Byte
      Dim temp As Byte() = Hash_TripleDES.ComputeHash(System.Text.ASCIIEncoding.ASCII.GetBytes(pass))
      Array.Copy(temp, 0, hash, 0, 16)
      Array.Copy(temp, 0, hash, 15, 8)
      TripleDES.Key = hash
      TripleDES.Mode = Security.Cryptography.CipherMode.ECB
      Dim DESEncrypter As System.Security.Cryptography.ICryptoTransform = TripleDES.CreateEncryptor
      Dim Buffer As Byte() = System.Text.ASCIIEncoding.ASCII.GetBytes(input)
      encrypted = Convert.ToBase64String(DESEncrypter.TransformFinalBlock(Buffer, 0, Buffer.Length))
      Return encrypted
  Catch ex As Exception
  End Try
End Function

for decryption

Public Function TripleDES_Decrypt(ByVal input As String, ByVal pass As String) As String
    Dim TripleDES As New System.Security.Cryptography.TripleDESCryptoServiceProvider
    Dim Hash_TripleDES As New System.Security.Cryptography.MD5CryptoServiceProvider
    Dim decrypted As String = ""
    Try
        Dim hash(23) As Byte
        Dim temp As Byte() = Hash_TripleDES.ComputeHash(System.Text.ASCIIEncoding.ASCII.GetBytes(pass))
        Array.Copy(temp, 0, hash, 0, 16)
        Array.Copy(temp, 0, hash, 15, 8)
        TripleDES.Key = hash
        TripleDES.Mode = Security.Cryptography.CipherMode.ECB
        Dim DESDecrypter As System.Security.Cryptography.ICryptoTransform = TripleDES.CreateDecryptor
        Dim Buffer As Byte() = Convert.FromBase64String(input)
        decrypted = System.Text.ASCIIEncoding.ASCII.GetString(DESDecrypter.TransformFinalBlock(Buffer, 0, Buffer.Length))
        Return decrypted
    Catch ex As Exception
    End Try
End Function

Answer 4

If you only want specific users to run the exe then, you can define policies under windows that would allow you to run it for only specific users.

but if you want to hide code then: since you have not mentioned which language you used to make the exe. If its c/c++ its already encrypted enough, it requires some work to get the code from it. If its java or csharp there are obfuscators that you can use. it would somewhat make it difficult to get the code from exe.

Answer 5

To answer the OP, I am not aware of a product that does this. It seems to me that it should be possible.

I'm guessing you are trying to protect your intellectual property by encrypting your executable and not to bypass antivirus programs as others have suggested.

First, a password probably does little to protect your IP by itself. But if that is all you want, then you should be able to save the password to a credential manager.

The problem I see offhand with just a password is that customers could easily share it.

Additional issues with any system: Did you decrypt the executable to storage media? If so, the unencrypted executable can be found and copied. Will the executable run strictly from memory, and if so, how do you keep it from being read from memory using a VM or debugger? If you have another trick, will it work correctly if parts of your program are swapped to disk in a low memory situation?

If decryption is just an algorithm, the algorithm will be on the machine and can be found and reversed engineered.

If the method uses asymmetric (public/private) keys, and the necessary key is available on the machine, the key can be found.

The decryption key will need to be somewhere. If an online broker provides it, you rely on the broker to protect the key that does the decrypting. If you act as the online broker for your customers, you will have more control over the process and you also get to do all the heavy lifting.

A scenario could be that you have a separate public/private set of keys to talk to the key broker. Collect information from the customer machine, encrypt that information into a packet with one of the keys and send that to your key broker system. The key broker has the other key to decode that packet, validates the customer machine is authorized to use the program, and sends the separate decryption key to decrypt the program.

My general answer is that it should be possible to protect your IP without needing to type a password in each time, but it won't be easy and I don't know of any implementations. As others have mentioned, obfuscation is what most people use.