obfuscate for c

DDD888

原帖由 darrenlee 于 3-5-2013 10:53 发表

                               
登录/注册后可看大图

如果你是在说安卓客户端的话,隐藏api可以通过强制升级实现
同时升级服务端api和客户端相应代码
但得写个程序自动生成上面的东西,要不会累死人
可以让他破解,但我没事儿就升级,他就会失去耐心,时间精力,成本高,只能 ...

Thanks for the tip.

tristone

原帖由 DDD888 于 3-5-2013 11:25 发表

                               
登录/注册后可看大图

You are right. 99% of the website grabbing for the website I wrote is done by real person sitting in front of the browser and clicking the url. I manage to stop all these behaviour.

I a ...

我现在开始有点理解为啥你的需求会变成这样。但是只要你的数据是（公开）显示给别人看的，要保密就是一个自相矛盾的要求。

不对称加密并不一定保险， http://www.schneier.com/blog/arc ... -in-the-midd_4.html

特别是通过代理的情况下，MITM好像要容易的多。

再说，即便不想办法crack你的加密或者代码，还有很多方法可以dump你的数据。比如可以把人肉工作outsource到印度，或者你听说过QTP么？有这种自动测试工具写个脚本就可以替代人手工点击按钮/菜单、敲键盘，自动收集数据。

darrenlee

他老板的需求是你可以公开看,但不可以拿回家,就像广场上的平面电视广告信息一样
所以,人工扒数据是无法避免的,只能避免非人工扒数据

DDD888

原帖由 tristone 于 3-5-2013 11:40 发表

                               
登录/注册后可看大图

再说，即便不想办法crack你的加密或者代码，还有很多方法可以dump你的数据。比如可以把人肉工作outsource到印度，或者你听说过QTP么？有这种自动测试工具写个脚本就可以替代人手工点击按钮/菜单、敲键盘，自动收集数据。

I know what you are talking about. But in real life, my code seems works.
I am monitoring server's log and since I introduced the code to anti website grabbing, the server web log size cut to half.

DDD888

原帖由 darrenlee 于 3-5-2013 11:46 发表

                               
登录/注册后可看大图

他老板的需求是你可以公开看,但不可以拿回家,就像广场上的平面电视广告信息一样

You are absolutely right.

I have dump the data into a jpeg file for the customer to view on the screen and I introduce fuzzy background to stop customer to use ocr. The customer cannot even copy & paste.

tristone

原帖由 DDD888 于 3-5-2013 11:51 发表

                               
登录/注册后可看大图

I know what you are talking about. But in real life, my code seems works.
I am monitoring server's log and since I introduced the code to anti website grabbing, the server web log size cut to hal ...

所以说我觉得你的这个加密需求跟现实脱节。QTP的解决方案从技术难度到成本、开发周期都比decompile你的binary要小得多。只能说对你的老板的数据感兴趣的人还没那么多。

DDD888

原帖由 tristone 于 3-5-2013 12:37 发表

                               
登录/注册后可看大图

所以说我觉得你的这个加密需求跟现实脱节。QTP的解决方案从技术难度到成本、开发周期都比decompile你的binary要小得多。只能说对你的老板的数据感兴趣的人还没那么多。

That is good.

Maybe I worry too much. As I said before, all I need to do now is do not put plain string in the c source code. I think this is good enough.

[ 本帖最后由 DDD888 于 3-5-2013 13:10 编辑 ]

tristone

原帖由 DDD888 于 3-5-2013 12:56 发表

                               
登录/注册后可看大图

That is good.

Maybe I worry too much. As I said before, all I need to do now is do not put plain string in the c source code. I think this is good enough.

哈哈我还看到你修改前说jpeg的那一段。不知道你生成jpeg是用什么工具，不会是某个开源的库吧？动态链接（大多数情况下应该是吧）？如果是这样做一个假的dll不就得到你的数据了？

DDD888

原帖由 tristone 于 3-5-2013 13:17 发表

                               
登录/注册后可看大图

哈哈我还看到你修改前说jpeg的那一段。不知道你生成jpeg是用什么工具，不会是某个开源的库吧？动态链接（大多数情况下应该是吧）？如果是这样做一个假的dll不就得到你的数据了？

No
The data is generated on the website to create jpeg file.
I mean server code.
It is easy to generate jpeg in C#.

If you can hack the server, you don't need my code. You just grab the database directly without going the trouble to hack my code.

darrenlee

图片文件肯定得在服务器端生成
至于hp qtp的ocr,因为目的是自动化截取数据,所以,只要让ocr结果不能100%准确就可以了,这样会大量增加人工核对成本,尤其是数据量大,更新频繁的情况

[ 本帖最后由 darrenlee 于 3-5-2013 13:56 编辑 ]

cais

LZ你的网站的逻辑跟android client的逻辑应该是一样的吧。别人直接通过你的网站的代码就能看出你怎么用api的啊。
既然已经需要登录了，那就好办多了。直接按用户做rate limit就行了吧。

DDD888

原帖由 cais 于 3-5-2013 22:36 发表

                               
登录/注册后可看大图

LZ你的网站的逻辑跟android client的逻辑应该是一样的吧。别人直接通过你的网站的代码就能看出你怎么用api的啊。

To solve the exact issue you mentioned, I have implemented two different api on the website.

DDD888

原帖由 cais 于 3-5-2013 22:36 发表

                               
登录/注册后可看大图

既然已经需要登录了，那就好办多了。直接按用户做rate limit就行了吧。

Yes

滚滚雷声

原帖由 DDD888 于 3-5-2013 11:55 发表

                               
登录/注册后可看大图

You are absolutely right.

I have dump the data into a jpeg file for the customer to view on the screen and I introduce fuzzy background to stop customer to use ocr. The customer cannot even cop ...

这个不是captcha么？

DDD888

原帖由 滚滚雷声 于 24-5-2013 14:14 发表

                               
登录/注册后可看大图

这个不是captcha么？

Yes

cais

这个captcha之后再在显示内容再加上类似captcha的防止ocr的东西

DDD888

I have obfuscated string in c. Without obfuscated string, the string just plain text in the binary. It looks like rubbish character in the bin dump. :-) I am using C# razor template engine to generate my c code. For java, I might use velocity template engine.

The c source code generated looks so nice. :-) I put lots of comments in the generated c code. Of course the comments won't appear in the .so library code compiled by gcc compiler.

BTW, armed with on-line arm assembler manual and I look at my arm assembly source code and it looks so compact. Each c code generated some arm assembly and it is so short. It does not like c# which just use visual studio 2012 ide debugger to debug a function call which will end up endless nested function call. Of course, that is the way all higher level programming language do.

[ 本帖最后由 DDD888 于 27-5-2013 06:29 编辑 ]

cais

isn't "a function call which will end up endless nested function call." what you want in your obfuscated c code?

DDD888

原帖由 cais 于 27-5-2013 22:35 发表

                               
登录/注册后可看大图

isn't "a function call which will end up endless nested function call." what you want in your obfuscated c code?

But c# binary executable is plain text in .net reflector and all the api and framework source code is google searchable.

cais

原帖由 DDD888 于 28-5-2013 05:34 发表

                               
登录/注册后可看大图

But c# binary executable is plain text in .net reflector and all the api and framework source code is google searchable.

yeah. so write or generate your c code in the C# way.

DDD888

原帖由 cais 于 28-5-2013 22:26 发表

                               
登录/注册后可看大图

yeah. so write or generate your c code in the C# way.

I am thinking to implement self modify code in c. What do you think?

DDD888

DDD888 发表于 3-5-2013 13:48

                               
登录/注册后可看大图

No
The data is generated on the website to create jpeg file.
I mean server code.

My boss just told me this morning, some people in Australia hot linking the image file I generated to use on his ebay website.

I am thinking use hot linking prevention and put watermark in the image to stop this kind of behaviour.

The world is full of these people.

DDD888

I found this one to add shell to java code for android. http://blog.csdn.net/jiazhijun/article/details/8678399

It is not ideal, but better than nothing.

But this one is really cool. http://blog.csdn.net/jiazhijun/article/details/8833710 It allow me to change java binary code as if I want to.

DDD888

昨天我的老板和我说自从我加了防止获取数据的逻辑在网站中后一年多了,他没有发现任何数据被盗的逻辑