Hi, i could use a comprehensive tut or guide for this. I want to have an encryption algorithm contained in the file, that way you need the .dll and the exe to complete a login or encryption. Thanks! :cool:
Printable View
Hi, i could use a comprehensive tut or guide for this. I want to have an encryption algorithm contained in the file, that way you need the .dll and the exe to complete a login or encryption. Thanks! :cool:
I don't know where you got the idea for implementing a DLL in this factor but let me say that a DLL is more of a threat to security than a blessing in this situation.
First off you hinder the application you are using because it will need that DLL when it could have just as easily put it in the binary itself. Nobody likes external parts if they don't need them. Putting it inside the .rsrc section of the binary won't work either, because thanks to things like Process Explorer and PEiD you can edit all of that to your hearts content.
Another thing wrong here is that by using a DLL you are opening yourself to API hooking, through both Inline hooking (see: The Detours Win32 API library) and IAT hooking (see: Programming Applications for Microsoft Windows, 4th edition by Jeffrey Richter, Chapter 22: DLL Injection and API hooking.) Anybody with a little bit of experiance can hook this external function to always return TRUE for example and always log you in.
Aside from the fact that DLL also makes runtime decrease a lot (loading DLLs does take a preformance hit), anybody with a simple copy of OllyDBG or preferably IDA Pro can simply open up that DLL file, look at the exports and find that encryption function. This will be a lot easier because that DLL file will only contain that export while you will have to look through a lot of code in the actual executable file in which you will have to set breakpoints and such to find the call to it and then examine it.
A rule of thumb I try to follow is that if I don't NEED a DLL then I will try to avoid using one. Yes yes, they may be great for interoperability between two languages, they may enhance feature and ease the versioning process of an application, but do you really need an entire DLL simply related to an encryption function used for logins and such?
Well the purpose was say the user has one and only one copy of that .dll file on, say, a USB flash drive. They hook-up the drive then run the program. If they have the .dll file, the login will go smoothely, if not then it wont work. I have heard of people using this before. Thanks!