Protecting UACD ! -Some Insight

[Martin Zugec]

I was forced to change my "license" by my girlfriend

BTW News about ProtectUA - it will be delayed a little... Right now I am thinking a LOT about future, so any ideas are appreciated ASAP! I want to create the base build, so I wont need to change whole code next time when...

[rikgale]

What was your old license?

I would say that go with V.1 (I'll refer to the code used for the guide as V.1) as a base but, you are wanting to add a GUI and lots more features so I guess this is out.

Go with the ideas that MOON and I have already suggested, but one thing I have just thought of is removing the Protection From the UACD. I.e. I have just spent ages creating a zip file, moving all my .cmds to it and altering my RunOnceEx to reflect that the .cmds are now elsewhere, and also adding to my cleanup cmd to remove all the .cmds. I am guessing that V.2 will be alot more user friendly in that I wont have to create the zip and change my RunOnceEx.cmd etc.

So basically, to cut to the chase and I looking for a way to go back on what has been done without hand changing loads of my own code to remove the secuirty.

Have I made my self in any way clear or I have I just incomprehensibly babbled for 2 paragraphs?

Also I read back a while ago about using max processor speed as a value to check, a flaw that I can see in this (and maybe I am wrong) is what happens if the user tries a bit of OC'ing, this will surely change the value of the max processor speed.

HTH Rik

P.S. BTW don't rush, I know your busy, but I'm not going to be in a position to test any code that you may produce until after the weekend, as I am out and about and my Laptop is not up to the task of running VMWare and allowing me to do other work. (1.1Ghz ULV Centrieno)

Edited July 28, 2005 by rikgale

[Martin Zugec]

I didnt have any license before, I am just going to try if it works

In fact you dont need to change any paths in your cmds. Because first you will run protectua and protectua will unpack all files to the locations where they were before...

OC wont affect max processor speed, because it is different value (CurrentSpeed vs. MaximumSpeed)...

I cant work on it now, because one of my most important servers failed and I am trying to restore it

[rikgale]

I suppose a licence is better than no licence.

Server def. comes 1st. I hope that you get it working again, and it is not terminal (for the hardware).

[rikgale]

Heys guys, been quiet here for a while.

Martin, how's that bust server going?

MOON, where are you man? You've been awfully quiet as of late.

I've also come up with another idea, in that would it be possible to encrypt the RunOnceEx.cmd in some way. I tried making and exe out of it and running it at T-12 with no luck. I tried lots of different ways to no avail.

Regards to all

Rik

[Martin Zugec]

Hey Rikgale!

I left for vacation, I returned this week and had to finish some work (backup implementation)...

However we can continue with work now.

I am preparing one 15 hours long presentation about deployment + 21 hours about scripting + 6 hours about Vista + MSH, so my response will be quite delayed these days, however I dont want protectua to die.

[rikgale]

however I dont want protectua to die.

Neither do i.

I just got a PM form MOON, wondering what was going on.

Concentrate on work, those sound like some pretty intence presentations that you've got to do. MOON and I, will still be here when it all calms down.

Keep well

Rik

[Martin Zugec]

If I could ask you and MOON, please write a 2do list...

[MOONLIGHT SONATA]

Hi Martin & Rikgale,

Protection is like Phoenix, always rises from ashes! Nice to hear from you guys.

Martin, here's my 2Do List (Rikgale please add yours by another post, Mate, find no time to make the list in collaboration with you..)

1.) Include BIOS Release Date & Version as usual; Also include HDD Serial Number, it's the Killer punch.

2.) I "Prefer" inclusion of CD Media VolumeSerialNumber as I'm also in favour of 2-OR-Multi-CD Protection. After inclusion, i'll write a guide on Protecting CD from CD-Copy type breach of Security. Rikgale, and also you or anybody then help me out by burning some CDs to check how far it works to our advantage.

3.) Martin, I really want 2-levels of protection and 2-time checking of Protection Files. As, we run the whole Authentication from RunOnceEx.CMD, anybody can learn the path and file name of the .vbe script. If someone just deletes the same command from RunOnceEx.cmd, running of .vbe gone! Yes, they couldn't extract the encrypted ZIP file for sure, but the get Vanilla XP Installation completely. Moreover, if after entrance of RunOnceEx keys into Registry, when machine reboots, i press F8 and enter SafeMode, don't you think whole RunOnceEx entries are bypassed? If bypassed, then next time if i boot into normal mode, will protection work at all?

That's why in our protection scheme i want a script from you that pass authentication on the basis of MD5 Checksum checking of Protect.vbe file and then comparing the same with what written as its MD5 Checksum Value in reference file. If, someone deletes the entry for .vbe command in RunOnceEx.CMD file and alongwith deletes the .vbe file from $$\system32, our protection still works as MD5 checksum-based authentication will go against it as no checksum could be done for missing .vbe file. One more point, this extra step has some advantage as it's not relying on WMI Class Query, so wee can schedule its running at a much earlier time before 1st logOn.

Hope, i could make you understand my points... Waiting for your kind response....

P.S. Somehow, i feel better and relaxed today, after getting PMs from both of you...Thanks.

[rikgale]

Roll on the Fort Knox of XP!

2do, figure a way of protecting/encrypting the RunOnceEx.cmd. So that the contents of it can't be viewed easily.

I did trying using QBFC to make an .exe but could never get the **** thing to Run at T-12, wondering if there is another way around it. Atm, I am using runonceex.cmd to call .exe converted .cmds which in turn run/install programs and associated .reg entires.

Or one idea that just came to mind is encypt and compress the entire $OEM$ dir and extract in someway like the BTS driver packs do before t-39. The only issue I can see with this that there will probably be very few/no WMI classes avaible at the time. Maybe the extraction could be done later. This then also adds a speed issue into the whole thing in that if you are extracting this on a slow machine it could take ages

MOON I can try and test the 2 CD/DVD idea, but that would mean figuring out a CD switching utility and all the associated stuff that goes with it, I suppose I could figure something out so that I can call my cleanup.cmd from another CD/DVD. Currentely I only use 540Mb of a CD for everything I install.

And a quick heads up that I'll be away from the 30th August to 7th September, and my g/f is not letting me near a computer during that time, but I'm about until then, and back working days..........

[MOONLIGHT SONATA]

@Rikgale,

WMI Classes are not available at T-39 Minute Mark, it's not even available at T-13 / T-12 minute marks. Only during 1st logon it can be used. That's why i'm paranoid about "once bitten twice smart" type people. If they just force machine into SafeMode, i suppose all runOnceEx.cmd entries are bypassed, if i'm not mistaking basics.

Nanaki, my very new forum friend has made "CDSWITCH" just to serve this purpose. Do you know, in the latest 0.9 version you can run *CDROM*\Setup.EXE switch to force cdswitch to run setup.exe from the cd in the tray. It's amazing, Mate, you'll love it.

Finally, you made me depresed again, after a long layoff, Phoenix has risen from ashes and you are going underground for such a long time. Hey, Man, Enjoy, and Miss Martin and Me during at your own peril...Refine your 2Do list and post before you take leave....Happy Vacation!! Better Isay Early than Never!!!

[rikgale]

Dont be depressed mate, I ain't going for another 5 days!

I think at the end of the day the smart ppl will always figure away round it, you'd be better off trying to cover the 90% that aren't smart or can't be bothered. Otherwise a very large amount of effort is going to be spent stopping a few. It's like with music downloads, ppl are always going to figure away around DRM and stuff like that, but they are in a minority. DRM happily defeats those that don't know or dont care. I'm not saying protection and security are not important, it's just that they are never 100% fullproof and there's not point getting stressed out over that last 1%

I'll check out that cd swicth util when the time comes

Refined 2do list

1) Protect/encrypt RunOnceEx.cmd

2) Compress/Encrypt all or most of the $OEM$ file structure, and decompress in a similar way to BTS driver pack. (Hard)

[Nanaki]

Nanaki, my very new forum friend has made "CDSWITCH" just to serve this purpose. Do you know, in the latest 0.9 version you can run *CDROM*\Setup.EXE switch to force cdswitch to run setup.exe from the cd in the tray. It's amazing, Mate, you'll love it.

<{POST_SNAPBACK}>

Actually, it's *DRIVE* and it's included in the latest version 0.8.2. I threw it online after you said it worked fine.

0.9 will be focused on working with multiple drives. You guys can always suggest stuff that make CDswitch work along better with your project.

[MOONLIGHT SONATA]

Hey Nanaki,

xtremely sorry for the mistakes done by me. Now, you see MOON has even forgot what switch he used a few weeks back . After such fiasco, Is it fair to put my name in your list of acknowledgement? Until and unless you send me further test versions, very soon i'm going to forget whole cdswitch program. For my sake, as my reputations are at stake, please send some test version quickly.

[MOONLIGHT SONATA]

@ Rikgale,

Sorry mate, i couldn't make you understand my concern. You are right 100%.I know 99% will be defeated by the already developed idea, but i want to keep those 1% guessing. Everything is breakable, but we aim to make that hard. By just running all from RunOnceEx.CMD, neither we're making life harder for 1%, nor we can rest easy believing that 99% is thereby defeated, and remain defeated forever. I don't want to fool myself, i know with time at least 30% out of 99% will even break the protection as they get chance to inspect RunOnceEx.cmd. Atleast, another level of protection is mandatory, and that protection will be based on checking for the presence of our protection files. In the end what you said is permanent, but it only takes the steam out of our effort. Don't misunderstand me....I just want to make the presence of our Protection files must in order to run our UAXPCD. If hardware doesn't match, it'll not run; If software is absent, it'll not run even.