Best Practices for Implementing Protection! – in a Nutshell
The following is brief description of best practices for implementing of Protection!:
- Design your application security logic. For example - your application's evaluation version could be limited in features in comparison to the full commercial license.
- Embed used Protection! classes with dependencies into your application archive.
- Obfuscate your application with good obfuscators like Zelix Klassmaster http://www.zelix.com/klassmaster/ which allows 2nd level obfuscation which optionally can encode all string literals to make it completely unreadable.(At the very least you should obfuscate classes responsible for protection implementation)
- Utilize Protection! Integrity Module functionality to protect most critical classes from potential code patching.
- Make several different classes in different locations that check Integrity.
- And, of course, do not tell the world that you are using Protection! and because Protection! classes should be embedded into your application archive and obfuscated - there is practically no way for someone to find this out by simply looking at your obfuscated classes.
- NEVER show an explicit message to the end-user when you've discovered an integrity violation. Instead silently make some strange actions to complicate use of your application. Therefore a malicious user wouldn't be able to guess about the existence of such a check and therefore would never attempt to break it!