protection on your ea from being unlocked | Forex Factory

Options

Go to
Permalinks
Print Thread

Similar Threads

Why your broker is your friend and your enemy 8 replies

Your EA is being HACKED! Time to migrate! 42 replies

How does being a CFA help in your trading journey? 2 replies

EA programming- How to save your EA from being sold? 6 replies

Program Your Trading Ideas without being a programmer 4 replies

Attachments: protection on your ea from being unlocked
Exit Attachments

protection on your ea from being unlocked

  • #1
  • First Post: Oct 6, 2017 9:26am Oct 6, 2017 9:26am
Hi all,

first of all i want to clarify i am not a hacker and i don't have intention to hack anyones EA. i code my own EA with acc lock so that they can join my affiliate

what i do is when someone registered under me, i will send them the ex4 file to be used but i have some suspicion they are getting the ex4 to be unlocked by someone so it can now be freely used. Why i suspected so? because there is 1 guy who after registered, deposited USD1k trade only a few small lots and after a while he asked to give him ex4 for another 5 more acc on the pretense he wants to use different strategy for different acc

after i gave him the ex4 for 5 acc, i noticed he withdraw his funds and the original acc and these 5 acc never had any trading activities since

the only conclusion i can make is, he is trying to unlock my EA. I have asked around and what i gather is build 600++ can't be decompiled but it can't be unlocked (something about injector). this has me worried

the way i locked my EA is different in the sense if the account doesn't matched what is set in the EA, the EA will still run BUT i set a few traps where the EA will do abnormal things. my target was to make it harder for a hacker to hack it by making it less obvious

bwt, i plan to do more advanced security for my next EA upgrade

Question :
All the security features i have put in placed are just to counter what i guess the hackers are looking for when they try to unlock. but i actually have no idea what they are looking for. It is just like shooting a machine gun in the dark, hoping it will hit the target somehow

What i really need to know is what the hackers are actually looking (just high level ideas) when they are hacking so that i can put in codes to make it tougher or confusing for them

wish someone can help me here

TQ
  • #2
  • Oct 6, 2017 10:12am Oct 6, 2017 10:12am
Hi,
Many coders/traders have same question like you. It's the biggest troubles if you want to share your indicator or EA, while you always shy someone will crack it.
Today, there is no way to decompile build 600++, but what will be tomorrow... Everything that has been built - can always be broken.

I tried to ask Mr.Google and here are few answer:
1. Put your code in a DLL
2. Don't let anyone can understand your strategy . They can decompile your EA, but can not understand anything, or at least, very difficult.

Here are some links for you:
https://www.mql5.com/en/forum/149767
https://www.mql5.com/en/articles/1572
  • #3
  • Oct 6, 2017 10:24am Oct 6, 2017 10:24am
Quoting Ducdaovn
Hi, Many coders/traders have same question like you. It's the biggest troubles if you want to share your indicator or EA, while you always shy someone will crack it. Today, there is no way to decompile build 600++, but what will be tomorrow... Everything that has been built - can always be broken. I tried to ask Mr.Google and here are few answer: 1. Put your code in a DLL 2. Don't let anyone can understand your strategy . They can decompile your EA, but can not understand anything, or at least, very difficult. Here are some links for you:...
thanks for the feedback. my replies below

1) i did read those articles earlier (i also google up) but i can't get a solid conclusion from them
2) I need to explain how the EA works as it is not so simple without it

actually, what i need is to have some knowledge what the hackers are looking for, so i can somehow mess those things up to make their life super difficult so that they will just give up
  • #4
  • Oct 8, 2017 5:52am Oct 8, 2017 5:52am
Quoting tanwt
{quote} thanks for the feedback. my replies below 1) i did read those articles earlier (i also google up) but i can't get a solid conclusion from them 2) I need to explain how the EA works as it is not so simple without it actually, what i need is to have some knowledge what the hackers are looking for, so i can somehow mess those things up to make their life super difficult so that they will just give up
anyone?
  • #5
  • Oct 8, 2017 6:03am Oct 8, 2017 6:03am
Putting code into DLL makes it even easier to hack it. Because there are many more tools to do this available.

Quoting Ducdaovn
Hi, Many coders/traders have same question like you. It's the biggest troubles if you want to share your indicator or EA, while you always shy someone will crack it. Today, there is no way to decompile build 600++, but what will be tomorrow... Everything that has been built - can always be broken. I tried to ask Mr.Google and here are few answer: 1. Put your code in a DLL 2. Don't let anyone can understand your strategy . They can decompile your EA, but can not understand anything, or at least, very difficult. Here are some links for you:...
  • #6
  • Oct 8, 2017 6:22am Oct 8, 2017 6:22am
Quoting tanwt
Hi all, first of all i want to clarify i am not a hacker and i don't have intention to hack anyones EA. i code my own EA with acc lock so that they can join my affiliate what i do is when someone registered under me, i will send them the ex4 file to be used but i have some suspicion they are getting the ex4 to be unlocked by someone so it can now be freely used. Why i suspected so? because there is 1 guy who after registered, deposited USD1k trade only a few small lots and after a while he asked to give him ex4 for another 5 more acc on the pretense...
Its knowed protection was broken ( about b600+ ). Even you have general info how works and steps to do it. Anyways the code you get is asm then is useless in many cases. Not all protections are easy to crack when you have the code decompiled ( in this case protection broken ) and always depends if the effort to do it compensate. Evidently in forex tools never compensate this because all profitable chances depends directly of trader using them. That is my opinion...
Try don't lose pants never...
  • #7
  • Oct 8, 2017 11:25am Oct 8, 2017 11:25am
Quoting braintheboss
{quote} Its knowed protection was broken ( about b600+ ). Even you have general info how works and steps to do it. Anyways the code you get is asm then is useless in many cases. Not all protections are easy to crack when you have the code decompiled ( in this case protection broken ) and always depends if the effort to do it compensate. Evidently in forex tools never compensate this because all profitable chances depends directly of trader using them. That is my opinion...
sorry i don't quite understand you

ts knowed protection was broken ( about b600+ )
** You mean the protection on build 600+ is no more?
  • #8
  • Oct 8, 2017 1:23pm Oct 8, 2017 1:23pm
Quoting tanwt
{quote} sorry i don't quite understand you ts knowed protection was broken ( about b600+ ) ** You mean the protection on build 600+ is no more?
Yes. It was broken. But they will change soon...
Try don't lose pants never...
  • #9
  • Oct 8, 2017 5:27pm Oct 8, 2017 5:27pm
How protecting our ea is a famous question between coders always but unfortunately there is not any certain safe answer for this question yet
but if you want to sell your ea or sharing it a good way is that you run your ea on investor accounts yourself, and and to avoiding that they copy your ea trading on another accounts you can hide positions some hours in a week by changing the password for a few hours..
or you can refer them to myfxbook to follow trading and your ea performance via myfxbook
Regards
  • #10
  • Oct 9, 2017 12:20am Oct 9, 2017 12:20am
Quoting braintheboss
{quote} Yes. It was broken. But they will change soon...
As far as i know it was not broken/hacked in the way that you can decompile all build stuff. Only some stuff protected by MT in their market and even then only under well defined circumstances.

For me the best protection is always not to share the vital calculation. So the safest way for me is to build a webservice that gives you the calculation results and only build the webclient with mql. So you have all protection strategies + calculations at your server and never at client site. Decompiling the client will give them nothing of interest.
  • #11
  • Oct 9, 2017 2:11am Oct 9, 2017 2:11am
Quoting JensItzig
{quote} As far as i know it was not broken/hacked in the way that you can decompile all build stuff. Only some stuff protected by MT in their market and even then only under well defined circumstances. For me the best protection is always not to share the vital calculation. So the safest way for me is to build a webservice that gives you the calculation results and only build the webclient with mql. So you have all protection strategies + calculations at your server and never at client site. Decompiling the client will give them nothing of interest....
It was completely broken. Steps for bypass protection are there. Market tools are safe because have a second protection layer. Anyway you get asm code not source code then is not big problem
Try don't lose pants never...
  • #12
  • Oct 9, 2017 2:41am Oct 9, 2017 2:41am
Quoting JensItzig
{quote} As far as i know it was not broken/hacked in the way that you can decompile all build stuff. Only some stuff protected by MT in their market and even then only under well defined circumstances. For me the best protection is always not to share the vital calculation. So the safest way for me is to build a webservice that gives you the calculation results and only build the webclient with mql. So you have all protection strategies + calculations at your server and never at client site. Decompiling the client will give them nothing of interest....
for hackers, it is not necessary to decompile all stuff (although it will be ideal)

what they need to do is find within ex4 the bytes that locked the EA to the acc and remove that. This way, although they can't decompile it, at least there's no restriction to use it pass the expiry date or use it on other acc. This is something i would like to avoid or at least try to make it so hard that it is not worth the effort

i googled up about hex editor and downloaded a hex editor tool and tries to see what my ex4 looks like. i compiled the same mql4 (with just different file name) 3 times. attached are what i saw

1) Although all 3 ex4 are the same (except file name), i see completely different hex value. This means mt4 somehow added some stuff within their compiler to make each ex4 unique

2) even though my ea has strings, i can't seem to find anything that resembles something i can make out

My conclusion (again i am not a hacker, i am just trying to find ways to protect my ea) if just using hex editor, it is quite hard to pin point what and where to change

am i right in this?
Attached Image (click to enlarge)
Click to Enlarge Name: hex_editor.jpg Size: 268 KB
  • #13
  • Oct 9, 2017 2:46am Oct 9, 2017 2:46am
Quoting tanwt
{quote} for hackers, it is not necessary to decompile all stuff (although it will be ideal) what they need to do is find within ex4 the bytes that locked the EA to the acc and remove that. This way, although they can't decompile it, at least there's no restriction to use it pass the expiry date or use it on other acc. This is something i would like to avoid or at least try to make it so hard that it is not worth the effort i googled up about hex editor and downloaded a hex editor tool and tries to see what my ex4 looks like. i compiled the same...
I explained before. Protection is broken. Evidently you are working with protected stuff then you have the captures behaviour
Try don't lose pants never...
  • #14
  • Oct 9, 2017 3:26am Oct 9, 2017 3:26am
Quoting JensItzig
{quote} As far as i know it was not broken/hacked in the way that you can decompile all build stuff. Only some stuff protected by MT in their market and even then only under well defined circumstances. For me the best protection is always not to share the vital calculation. So the safest way for me is to build a webservice that gives you the calculation results and only build the webclient with mql. So you have all protection strategies + calculations at your server and never at client site. Decompiling the client will give them nothing of interest....
i have no clue how the webclient thing works

any keywords i can use to google it?
  • #15
  • Oct 9, 2017 4:32am Oct 9, 2017 4:32am
Quoting braintheboss
{quote} I explained before. Protection is broken. Evidently you are working with protected stuff then you have the captures behaviour
According to everyone over on the mql5.com forums there is no evidence that recent builds can be decompiled and everyone so far claiming to do so has turned out to just be a scammer. I sent one of my own ex4 just to test and of course it too was a scam. I'm curious where did you find evidence that protection is broken?
  • #16
  • Oct 9, 2017 5:03am Oct 9, 2017 5:03am
Quoting Nicholishen
{quote} According to everyone over on the mql5.com forums there is no evidence that recent builds can be decompiled and everyone so far claiming to do so has turned out to just be a scammer. I sent one of my own ex4 just to test and of course it too was a scam. I'm curious where did you find evidence that protection is broken?
i understand for now it is not possible to decompile but possible to just change the ex4 content to unlock the EA eg if it is locked to acc no or has an expiry?
  • #17
  • Oct 9, 2017 5:09am Oct 9, 2017 5:09am
Quoting tanwt
{quote} i understand for now it is not possible to decompile but possible to just change the ex4 content to unlock the EA eg if it is locked to acc no or has an expiry?
How can that be done without the source code.
  • #18
  • Oct 9, 2017 5:19am Oct 9, 2017 5:19am
Quoting Nicholishen
{quote} How can that be done without the source code.
i am not 100% sure but i was told hackers do something to ex4 file with hex editor or memory dump or some sort of injector. i have no idea how it is done (if possible)
  • #19
  • Oct 9, 2017 6:12am Oct 9, 2017 6:12am
Quoting Nicholishen
{quote} According to everyone over on the mql5.com forums there is no evidence that recent builds can be decompiled and everyone so far claiming to do so has turned out to just be a scammer. I sent one of my own ex4 just to test and of course it too was a scam. I'm curious where did you find evidence that protection is broken?
Did you ask service desk? If you work with them normally sometimes they can answer you some questions. Anyway you have one mql5 thread with a real case. Moderator confirms that file was broken then no doubt about was real case. But we are talking about remove coder protection like time bomb. When you bypass file ex4 protection you get asm code, not source code. Then you can bypass protections like games but you cant restore legible code as previous b600 ex4 files
Try don't lose pants never...
  • #20
  • Nov 5, 2017 7:55pm Nov 5, 2017 7:55pm
Quoting Nicholishen
{quote} How can that be done without the source code.
cracker doesn't need mql4 but .ex4. I got my EA being cracked recently. I can trace all activity from my EA by that way I confirm my EA being cracked. All datas I collected show me no doubt about it
0 traders viewing now