Anti-Disassembling

Developing Applications Using The SoftwareShield System > Anti-Hacker Guide > Anti-Disassembling

## Anti-Disassembling

Note that the best way - by far - to protect your software is to use IronWrapping. If you own the IronWrap edition, and will be using IronWrapping in your software, these practices are unnecessary for you. This is because, the protections that IronWrapping provides, when applied at maximum strength, are at least 1000 times more powerful than the techniques you could implement yourself from descriptions in this guide.

Disassemblers are tools crackers use to translate application code back into assembler or even a higher level language. There are several disassemblers on the market of various quality. Some even write comments on the translated code, which makes it easier for the cracker to understand.

The ClientProtector dll (SSCProt.dll) uses anti-disassembling techniques to help ensure it is not easily disassembled, but this does not prevent your actual applications from this attack.

Since the purpose of disassembling is to understand the programs code, a good way to counter disassemblers is to make it more incomprehensible internally. The simplest way to defend against disassemblers is to insert numerous small bits of code in between the legitimate program code instructions that do nothing meaningful, but appear to, and are complex to understand.

A simple way to do this is to define a number of anti-disassembling macros and inline functions. Use your imagination to write these macros and functions. Do lots of pointer arithmetic and mathematical transformations. Conditionally and unconditionally jump all around in memory. Make sure your anti-disassembling routines are macros or inline functions so the anti-disassembling code gets pre-processed and duplicated everywhere it is placed (instead of a simple function call which can be found and replaced in a single location by a cracker).

Then, sprinkle these macros and functions liberally around areas of your programs you wish to protect from disassembling. Increase the density of the routines around sensitive areas. Naturally this will increase the footprint of your binary and can potentially impact performance so use this trick very wisely. You may wish to reserve its use for areas only around your protections and licensing code.

The more you can make the crackers job tedious, the more time he will have to invest in cracking your software - which is the ultimate goal - to slow them down as much as possible.