2 ms·

There's a number of techniques. Mostly they have to do with abusing the debug registers. http://en.wikipedia.org/wiki/TRESOR http://en.wikipedia.org/wiki/TRES

• groby_b 12y ago
  It's indeed TRESOR-based. See http://opencfp.immunityinc.com/talks/64/ http://opencfp.immunityinc.com/talks/64/
• falcolas 12y ago
  TRESOR would rely on the user applying a kernel patch (I don't believe it's broadly disseminated yet), and if you wanted to run more than one HARES based program, well, you couldn't (unless they rely on a single key for all HARES applications, which opens them up to having their private key posted on pastebin). Plus, the decryption key would have to be stored in the binary somewhere, unless they want to provide custom dongles which would provide the key to the hardware directly. As for blocking GDB and its ilk, the knowledge of how to disable ptrace blocking in executables is already fairly broadly disseminated on the internet. I also don't see it working around the VM problem (short of saying "I don't run in VMs, period", which would severely limit the reach of such binaries). Interesting idea in theory, but without significant changes to the underlying hardware or kernels, I don't see it functioning in practice (yet). It has the capability of blocking your casual user from accessing the application, but the folks they seem to really want to defend against would have few problems working around these limitations.
  • pstrateman 12y ago
    It's certainly DRM and thus broken. The question is how broken relative to other DRM.