Jump to content


Photo

Security Script Update V2 [new Script]


  • Please log in to reply
9 replies to this topic

#1 uuf6429

uuf6429

    Covac Software

  • New Member
  • 2522 posts
  • Version:Unknown

Posted 20 May 2007 - 07:57 PM

The following code returns a value showing if the entered code is secure.
WARNING!! MEMORY EDITORS COULD STILL CHANGE THE SCRIPT !!!
But memory editors can change pretty much everything in GM and this could actually become a small solution.
////////////////////////////////////////////////////////////////////////
// Checks the entered code for potentially dangerous GML code
////////////////////////////////////////////////////////////////////////
// ! error 5 = execute_ file, string, shell > may result in further infection
// ! error 4 = resource handlers > may rip program data
//   error 3 = files and registry > may change computer settings
//   error 2 = execute_ program, external_* > may point to data, not giving resources
//   error 1 = uses global. variables > may change program
// ! - Potentially dangerous to your program (hacking resources)
////////////////////////////////////////////////////////////////////////
// argument0 - code to check.
////////////////////////////////////////////////////////////////////////
var cd;
cd=argument0

if string_count("execute_file",cd)!=0 then return 5
if string_count("execute_shell",cd)!=0 then return 5
if string_count("execute_string",cd)!=0 then return 5

if string_count("sprite_",cd)!=0 then return 4
if string_count("sound_",cd)!=0 then return 4
if string_count("background_",cd)!=0 then return 4
if string_count("path_",cd)!=0 then return 4
if string_count("script_",cd)!=0 then return 4
if string_count("font_",cd)!=0 then return 4
if string_count("timeline_",cd)!=0 then return 4
if string_count("object_",cd)!=0 then return 4
if string_count("instance_",cd)!=0 then return 4
if string_count("room_",cd)!=0 then return 4

if string_count("registry_",cd)!=0 then return 3
if string_count("file_",cd)!=0 then return 3

if string_count("execute_program",cd)!=0 then return 2
if string_count("external_",cd)!=0 then return 2
if string_count("set_program_priority",cd)!=0 then return 2

if string_count("global.",cd)!=0 then return 1

return 0
There are 6 security warning levels:
0 - no problems
1 - changes in global. variables
2 - execute programs/external dlls
3 - files/registry usage
4 - resource changers (ie sprite_*)
5 - execute files/shell/scripts/strings
Error indexes 4 and 5 may unpack resources from your exe.
Error indexes 2 and 3 may do unauthorized changes to the opereating system/files
Error index 1 may gain access to global. variables and/or change them.

Here is a new script, it works as the UI part of the above script:
////////////////////////////////////////////////////////////////////////
// This is the interface part of the is_secure() script, you may use it
// for simpler use of the is_secure() script.
// There are 3 operating modes:
// 1) straight execution - no security risks
// 2) question + execution - the script is executed at user's risk
// 3) no execution - resources unpack risk, shows only an error message
////////////////////////////////////////////////////////////////////////
// argument0 - [STRING] - Code to execute
////////////////////////////////////////////////////////////////////////
switch (is_secure(argument0))
{
 case 0: {execute_string(argument0) break}
 case 1: {if show_question("Error: Security violation level 1 occured. The Script, [#"+argument0+"#] could modify program global variables.#Do you want to continue?") then execute_string(argument0) break}
 case 2: {if show_question("Error: Security violation level 2 occured. The Script, [#"+argument0+"#] could execute external files.#Do you want to continue?") then execute_string(argument0) break}
 case 3: {if show_question("Error: Security violation level 3 occured. The Script, [#"+argument0+"#] could access files and the registry.#Do you want to continue?") then execute_string(argument0) break}
 case 4: {show_message("Error: Security violation level 4 occured. The Script could modify load/save internal resources.#The script was aborted.") break}
 case 5: {show_message("Error: Security violation level 5 occured. The Script could execute unauthorized code.#The script was aborted.") break}
}

Edited by uuf6429, 23 May 2007 - 07:32 AM.

  • 0

#2 TGMG

TGMG

    G-java creator

  • New Member
  • 706 posts
  • Version:GM8

Posted 21 May 2007 - 12:23 AM

Its a good idea, but I could get a memory editor and replace all occurrences of yourscriptname with the normal execute_string ;)
  • 0

#3 uuf6429

uuf6429

    Covac Software

  • New Member
  • 2522 posts
  • Version:Unknown

Posted 21 May 2007 - 05:51 AM

That gave me an idea, putting all code into a global variable and replacing argument0 with arg0 then running the script with execute string. eg arg0='the code to check for' result=execute_string(global.security)
It might be harder to find or not? Or maybe putting it into a constant?

I heard somewere that it is difficult to find/change constants i it true?
  • 0

#4 uuf6429

uuf6429

    Covac Software

  • New Member
  • 2522 posts
  • Version:Unknown

Posted 23 May 2007 - 07:33 AM

Apart from the update, what about my questions above ^^ ?
  • 0

#5 TGMG

TGMG

    G-java creator

  • New Member
  • 706 posts
  • Version:GM8

Posted 23 May 2007 - 11:25 AM

No it is actually very easy, try it yourself, there are many free memory editors.

All you have to do is search for the name and it comes up. To change the value just note down the caption of a room you can easily go back to. Find that caption in memory, Go a few bytes after, change the size of the room creation code to whatever size your code will be, add in x amount of bytes, edit them with the code, e.g show_message, save and when you go back to the room, GM executes the code you added in via the memory. So with the new functions such as sprite_save etc it is actually possible to write a whole gm6 from that info. And when you have a gm6, open in gm7 and you can edit everything about the game. And yes you can get all room info, and even actions (although it involves memory editing).

Also if you wanted to change a constant for a specific game you could get a trainer maker. So no GM game is actually safe, so never put in ftp details or personal info. Use dll's for that, although if they can be got by you they can probably be got by someone trying to crack your game.

I use winhex, but I paid for it, its the best tho.
  • 0

#6 uuf6429

uuf6429

    Covac Software

  • New Member
  • 2522 posts
  • Version:Unknown

Posted 23 May 2007 - 03:15 PM

Who says i don't use winHEX? It's an awesome tool. Unfortunately i can't pay for it :P

I did this for small ahckers so people could load data from files by directly executing them. Not serious breakers like you (and might be me =) ).

Regards,

Edited by uuf6429, 23 May 2007 - 03:18 PM.

  • 0

#7 FIREBALL5

FIREBALL5

    GMC Member

  • New Member
  • 138 posts
  • Version:GM7

Posted 19 August 2007 - 04:00 AM

Dude, I think its a great idea, except for that small weakness about the memory editors. I'm generally a security person, but idk much about memory editors. I'm checking one of those out now.

Are you asking for credit for this script? I might want to try it, maybe increase the protection, b/c I've been working on something similar. Regardless, that script is better than mine!
  • 0
I am an in the GM Quiz!
Probably the main reason that I answer questions is so that you will read and respond to stuff in my signature!!
If you could, would you put any functions into Game Maker? If so, what would you? Message me with your ideas, I'm trying to create a big database of ideas to maybe later send the author of Game Maker so that he can put those functions in!!

#8 uuf6429

uuf6429

    Covac Software

  • New Member
  • 2522 posts
  • Version:Unknown

Posted 20 August 2007 - 07:00 PM

I clearly indicated its no use against memory editors.
  • 0

#9 YopYop

YopYop

    GMC Member

  • New Member
  • 120 posts

Posted 01 October 2007 - 09:25 PM

If i'm not wrong, with gm7 exe, a memory editor can only change objects scripts, but you can't change any script wich are on the script folder of gm no ?
  • 0

#10 uuf6429

uuf6429

    Covac Software

  • New Member
  • 2522 posts
  • Version:Unknown

Posted 02 October 2007 - 09:35 AM

I am not sure, I don't use GM7 right now. Generally speaking its no use againt memory editors as protected processes could be suspended, edited and then resumed. But lets keep this trick off the way.
  • 0