Sir R. M8gic1an
2009-09-15 11:48:37
The title got you interested, did it now?
Well, for those of you who have no knowledge of PHP&*SQL you might as well leave the thread now.
Selling a scar script which isn't later decrypted and destributed freely is a hard achievement, especially if Markus is around as he has earnt himself quite a reputation of decrypting scripts for the fun of it.
However, you can't decrypt something you can't see, now can you? No, i am not talking about pushing the code out of the margin and making it "invisible". I am talking about not having the code in scar and still have it executed.
How? Simple. Use (some) purely logical functions in your script. You won't need scar's abilities to get the result of purely logical functions, you can use something else. (Does anyone see where I'm going yet? ;) )
An auth system usually just sends a login and a password to a website which checks it against a database and returns true/false. This is not what we'll be doing.
SQL Database will have a table with (at least) 3 fields.
| Username | Password | Key |
The 'Key' is the interesting part. When you send your auth information, if it is correct the website will return you a randomly generated key (eg: AfegFG24q3rfE) and you store it in a string var.
If the Auth is true (After you check it against your db) you return the 'key' as result, and you store it in your database as well.
So far, nothing too unusual.
Now comes the fun part. Remember me talking about pure logical functions and how you don't need scar for that?
[php]
function WhatIsBestAxe ($key, $MyLevel)
{
if ! ($key == $DbKey) { retun $KillScript; exit; }
if ($MyLevel >= 61) { return $Axe_Dragon; exit; }
if ($MyLevel >= 41) { return $Axe_Rune; exit; }
if ($MyLevel >= 31) { return $Axe_Addy; exit; }
if ($MyLevel >= 21) { return $Axe_Mith; exit; }
else { return $Axe_Bronze; }
}
[/php]
Please excuse my php, I haven't properly used it in a very long time. I could probably use a Switch Case for that, but i wouldn't quite remember how to, syntax wise.
This is just an example. You could have 10's of purely logical functions. How would you use it?
Now, if Markus saw this, he probably would just re-write the function in ScarScript and be done with it. If it were 10 functions like this, he might still do it. Now Imagine you obfuscated it?
Now, what the hell would Markus do?! he has no idea what each function does! How the hell would he get around that? Re-write the script? Might as well not have bought it in that case :)
Now, if you wanted to be really annoying towards him,
And the final trick, each time you execute a function outside of scar, you give a person a newly generated random key.
:)
/me waits for Markus' reply
~RM
Well, for those of you who have no knowledge of PHP&*SQL you might as well leave the thread now.
Selling a scar script which isn't later decrypted and destributed freely is a hard achievement, especially if Markus is around as he has earnt himself quite a reputation of decrypting scripts for the fun of it.
However, you can't decrypt something you can't see, now can you? No, i am not talking about pushing the code out of the margin and making it "invisible". I am talking about not having the code in scar and still have it executed.
How? Simple. Use (some) purely logical functions in your script. You won't need scar's abilities to get the result of purely logical functions, you can use something else. (Does anyone see where I'm going yet? ;) )
An auth system usually just sends a login and a password to a website which checks it against a database and returns true/false. This is not what we'll be doing.
SQL Database will have a table with (at least) 3 fields.
| Username | Password | Key |
The 'Key' is the interesting part. When you send your auth information, if it is correct the website will return you a randomly generated key (eg: AfegFG24q3rfE) and you store it in a string var.
var
Key: string;
function Auth(user, pw: string):boolean;
begin
Key := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', user, pw);
end;
If the Auth is true (After you check it against your db) you return the 'key' as result, and you store it in your database as well.
So far, nothing too unusual.
Now comes the fun part. Remember me talking about pure logical functions and how you don't need scar for that?
Function WhatIsBestAxe(MyLevel: integer):integer;
begin
case MyLevel of
1..20 : Result := Axe_Bronze;
21..30: Result := Axe_Mith;
31..40: Result := Axe_Addy;
41..60: Result := Axe_Rune;
61..99: Result := Axe_Dragon;
end;
end;
[php]
function WhatIsBestAxe ($key, $MyLevel)
{
if ! ($key == $DbKey) { retun $KillScript; exit; }
if ($MyLevel >= 61) { return $Axe_Dragon; exit; }
if ($MyLevel >= 41) { return $Axe_Rune; exit; }
if ($MyLevel >= 31) { return $Axe_Addy; exit; }
if ($MyLevel >= 21) { return $Axe_Mith; exit; }
else { return $Axe_Bronze; }
}
[/php]
Please excuse my php, I haven't properly used it in a very long time. I could probably use a Switch Case for that, but i wouldn't quite remember how to, syntax wise.
This is just an example. You could have 10's of purely logical functions. How would you use it?
Function WhatIsBestAxe(MyLevel: integer):integer;
begin
Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', MyKey, MyLevel);
end;
Now, if Markus saw this, he probably would just re-write the function in ScarScript and be done with it. If it were 10 functions like this, he might still do it. Now Imagine you obfuscated it?
function aaaaaa(aaa: integer):integer;
begin
Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaa);
end;
function aaaaaaaaaa(aaaaa: integer):integer;
begin
Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaaaa);
end;
function aaaaaaaaaaa(aaaaaaaaaaaaaaa: integer):integer;
begin
Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaaaaaaaaaaaaaa);
end;
function aaaaaa(aaa: integer):integer;
begin
Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaa);
end;
Now, what the hell would Markus do?! he has no idea what each function does! How the hell would he get around that? Re-write the script? Might as well not have bought it in that case :)
Now, if you wanted to be really annoying towards him,
function aaaaaa(aaa: integer):integer;begin;Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaa);end;function aaaaaaaaaa(aaaaa: integer):integer;begin;Result :=ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaaaa);end;function aaaaaaaaaaa(aaaaaaaaaaaaaaa: integer):integer;begin;Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaaaaaaaaaaaaaa);end;function aaaaaa(aaa: integer):integer;begin;Result := ConnectToWebsiteOrWhateverTheFunctionNameIs('www.', aaaaaaaa, aaa);end;
And the final trick, each time you execute a function outside of scar, you give a person a newly generated random key.
:)
/me waits for Markus' reply
~RM