Protecting source code

Hi all,

im just having preliminary thoughts on protecting EA source code - if anyone has links to articles, discussions or ideas on different methods to a) minimise the chance of decompilation and b) even possibly never release the ex4 onto the target desktop ?

Any ideas/discussions on this topic appreciated.
Thx

I have no idea how it is done but I think the way to go is to implement your functions in a dll with some other language and just call it from metatrader. Something like myfxbook does with their EA.

A dll does is not protection, Dll's can be decompiled but it is still better than .ex4 files.

Having an understanding of any code that is placed on a client pc either via a dll or .ex4 file can never be totally secure from decompilation is important. Essentially if someone wants it bad enough they will find a way. So the best you can do is make it as tricky as possible that a hacker deems it worth while to spend the effort to hack.

There are usually two questions in this area. How do I protect my source code from decompilation. How do I stop illegal copies.

How do I protect my source, well to make life more difficult for hackers, you use tricks like obfuscation, encrypting source that sort of thing. It can be very tricky to develop a good secure scheme and the complexity added to the program also adds the possibility of bugs, so support can become and issue. There are commercial products around to help with this, but most of them have been hacked, after an exhaustive search the only one I think worth looking at is themida. It seems the VM of themida still is yet to be cracked and is a source of frustration to hackers (well that is from my research a few months ago). Its worth searching hacker forums, its a good source of information when trying to protect your software. Oh and themida is pretty good, it is commonly used by malware creatures to protect there source from virus scanners.

How to protect illegal copies, usually you could come up with a scheme to generate a key for each client, the key is then validated when the program starts, if valid it continues. The problem is the logic for this needs to be embedded in the source, so you then need to deal with the above issue. Most programmers make the mistake of having a single check, in this case the hacker only needs to locate this piece of code, they then decompile your source locate the appropriate logic that does the key check, disables it, recompiles and now they have a fully functional program that doesn't require a key. So as a developer you should do multiple checks for the key, maybe spawn some worker threads that work on timers that also to key validation, the key here is to make it difficult for the hacker to remove the key checks.

An alternative approach is you don't embed the source in a dll but have the dll call a web service, this way all your source is on a client. As a web service you could then validate all users on the web server, when they validate you then stream your data back to the client. This approach is technically far more difficult.

Ultimately protection is time consuming which equates to expensive to do it properly and there is no way to know how strong the method is. You could spend months working out a secure scheme you think is impossible to crack only to find it cracked in the first few days of release. Keep in mind all the big companies with millions to spend on this usually get cracked in the first few days.

My recommendation would be, put as much logic of your program in the dll. Then use something like themida and win licience (or companies offering the same sort of products). Something that offers you a good level of protection and licensing options that is reasonably priced. Spend some time in hacker forums to see how strong/secure the actual product is. And spend more time developing your systems etc than wasting it on protection which will invariably will be hacked if someone wants it bad enough.

10trades thx - lots of food for thought there, appreciate it

Here is a guide from mql4.com:
http://articles.mql4.com/934

The guys who run the free metatrader reporting site www.mt4i.com have a commercial solution:
http://www.matchpeg.com/mqldefender/