It’s much more sophisticated than that, and that’s why it takes the best crackers months or years to compromise plug-ins that use it correctly and to its full potential.
1 Like
I don’t think so. I think for some users (especially professionals) there is some psychological difference between using a binary officially released by its manufacturer, versus using one that has been tampered with by a cracker.
Clearly, basing all revenues just upon donations seems the worst choice because the end user obtains the officially released binary with the opportunity of paying nothing for it.
But if the officially released binary has some protection scheme in place (even something simple), then users that wants to use it for free must still pay a “cost” in terms of:
- time to search and find the (right) crack.
- risk for their workstations, involved by visiting the sites that host the cracks and running the stuff that they download from there.
- risk for their projects, if the crack is defective and cause a render problem at a later time, e.g. because of an anti-tamper trap put in place by the original developer and not discovered by the cracker.
All that cost, real or perceived, may be much more than the amount of money asked by the original developer for the official copy.
7 Likes
I’ve had the same thought process for years now:
- I don’t want my plug-in cracked.
- Deep research.
- Find out that it’s not worth the hassle, keep my simple protection.
- My plug-in gets cracked.
- Go to #1.
And let’s face it, if someone gets a very good protection scheme and achieves some months (or years) without any cracks, they won’t be posting their findings in this forum.
6 Likes
This topic comes up every now and then on the forum. There’s some similar information in this thread:
I object to posts that are not written by a forum member, but completely copy/pasted from external resources.
6 Likes
Flag it for the mods, it may be appropriate for us to have an official policy.
While it wasn’t put in a prominent place, it was raised before:
And I agree, we don’t need a ChatGPT echo here.
Although I appreciate that it was labelled as ChatGPT answer.
5 Likes
I understand your concerns about software piracy and the need to protect your intellectual property. While it’s true that determined hackers can often find ways to crack software, there are steps you can take to make it more challenging and discourage casual piracy. For example: License Key, Online activation, Regular updates etc.
How much impact on sales has piracy anyway? Are there any numbers? My assumption was that the big names can afford 80% loss to piracy (if that’s a reasonable number) because 20% of a million customers is still enough to keep the business running. With a much smaller target audience however you are in peril.
It’s hard to tell.
Say you sold 1,000 units, but 5,000 people downloaded illegal copies.
Are you certain that these 5,000 users will buy your software if the illegal copy wouldn’t exist?
My guess (which is nothing more than a guess based on people I know, and isn’t based on any real data) is that some small (<10%) percentage of them will be forced to buy it, and the rest will just switch to using some other kind of “free” software they’re able to get.
2 Likes
In my experience, we suffer a 40/50% drop on sales when one of our products get cracked. We also noticed a drop when a competing product is cracked (i.e., a Binson Echorec simulation).
8 Likes
I have worked as a reverse engineer reversing mostly nation state malware, that sometimes uses the same tricks as commercial copy protection schemes, and sometimes cracked versions of e.g. themida, vmprotect and so on. First of all. If I wanted to stay uncracked for the first month or hopefully a little bit longer, the smartest you can do is invest in the state of the art protection. The forementioned protections I have built tools to automatic decompile them. They are old, the schemes are known, and they are not to difficult to reverse engineer with enough experience. By all means, do not make your own copy protection. Then you will be cracked within the hour(s).
1 Like
Unfortunately C++ is not that hard to reverse engineer. Rust, Go and Delphi are way worse, but still not that hard if you have experience. A perfect copy protection would be one with a randomized polymorphic(ish) template based scripting language that regenerates it’s core functions and logic as it runs, and bases part of the randomization on hardware ioc’s, and also can send a snap of it’s current core state to the server, which again could take over for the running script, and stream script-code for a period while it rebuilds a new core, and dumps the core file and the core’s state file back to the local machine. When the script flow then continues, it would be something entirely else. the logic would look “greek” to the previous randomized script engine core. Logic “code pathways” could also be generated serverside. If the core and the state is stored locally and on the server, it would evolve over time and never look the same. It is late, and this was a little bit fuzzy explained, but that is my take, The downside would be the speed. It should run sparsly.
With all due respect you are overthinking it. In practice, if you avoid silly mistakes and you are not very popular (not enough money to justify the reverse engineering work) your plugins won’t be cracked in years. PS. For those wondering, what I learned in 2023 worked and I’m still using it today but should be extended with the advice given in Hunting for readable strings in the binary (anti-piracy saga).
2 Likes
Are ilok and fusion considered “safe” nowadays?
I know they offer different levels of protection, but are there reliable public data on their efficiency?
Don’t know about Fusion, but wrapper-only plugins I’ve seen cracked on both Windows and macOS. I guess at this point, at least for wrapper-only, crackers probably just have a script that removes it in seconds from any wrapped plugin. For a homegrown protection, at least they’d have to figure it out first.
You can probably augment the wrapper with some additional tamper protection though to detect whether it’s still intact.
The value of iLok without Fusion is more on the license management side than on the copy protection side imo.
1 Like
I see, so a simple ilok wrapper is maybe worse than the simplest antipiracy solution as it is so identified.