How long will the best software-only protections last?

[dyn!o]

Hi,

I've seen/tested several software protections such as armadillo and asprotect. While I'm not all that good yet, from reading tuts on cracking Armadillo (Ricardo) and other protections I have not heard of a protection lasting more than a few weeks.

And you heard good. The best protection can last not more than 10-14 days (for the first attempt or serious update and ~1 day for the next deprotection).

Would it ever be possible to make software-only protection last a few months?? My guess is no. Seems like hardware is the only way to go.

Theoretically it is possible. Practically.... life will show.

For instance, if the protection were to crash the computer/delete files when something was tripped (but not immediately and it would have to detect virtual machines), and then morph itself upon running.. is this only a nuisance ? It would also have to have many sections encrypted, then decrypted when needed and reencrypted again (wouldn't this be removed like Ricardo does by debugging and stripping out the code upon decryption).

Still too simple.

The market needs something different. Something really new. Imagine StarForce vm. Did they invent something new? Nope. They used all the best and known ideas. But they succeeded. The same concerns Themida. Now imagine what would happen if you bring something really new. Something people (crackers) will not understand and be not able to deal with using known methods. Someone may say: "then new crackers will be born". Assuming so then why StarForce is still not commonly crackable (in PRO version), not to mention Themida? New crackers will face much harder way to cross than we had in the time of starting our hobbies few years ago (compare Aspack to Themida or the first SecuROM to the actual version.... not to mention StarForce).

It seems like debugger checks, parent/child protection, crc checks, and everything else is just a nuisance.

Anti-debugger (based on INT1/INT3 and exceptions), parent/child checks, crc checks are already outdated.

Regards.