#Windows and Novell
14 messages in this thread
I would like to find out if there have been any solutions for the
problem of copy-protecting Windows *.exe files from theft in the Novell
NetWare 386 environment. Due to the way in which Novell alters the file
structure during the change to an EXECUTE ONLY file, it is impossible to
set this right for Windows *.exe files, since Windows will not recognize
the file as a valid EXE file. Has anyone any ideas about this problem?
I am creating a Novell Network using Novell NetWare 386, and it will
be running in an University environment. Theft of expensive software is
definitely NOT desired. We need to be able to cover ourselves regarding
licensing agreements, also, I do not want people to be able to wantonly
steal software.
Does anyone know if this problem will be solved with the release of
Windows v.3.0? It seems that with the growing acceptance of Windows as a
GUI, and the large base of Novell network users, that this would be a
reoccurring problem.
Thanks for the help in advance!
Yours truly, Tom Tregilgas, University of St. Gallen
you might try making the EXE completly unavailable at all from the users,
and having a stub EXE that is. The stub is a non-windows program and is
protected, but it doesn't really matter. The stub executes at a different
UID/priority/whatever and can then execute the windows program on the users
behalf. Get the drift?
–John
John, I am but an egg. Could you maybe elaborate on your soultion to my
problem? If I understand you correctly, you think that by creating a tiny
exe program, I could then call the various programs with IT, not by
starting/ launching the other programs? Is that right? By the way, my
trouble isn't with windows.com or WIN386.*, but rather with the APPLICATION
programs, such as EXCEL, PAGEMAKER, WORD FOR WORD , adnaeseum. HELP!
Thanks alot for the reply. Tom
That was the idea: make a tiny EXE that then runs the desired program.
Rig things so that the user can't access the target program directly, but
the tiny EXE can. I don't know how to go about changing the group or owner
or whatever from the program, so you'll have to find a guru for your
network. On UNIX for example, the user cannot create a subdirectory. The
system call will error with "user does not have that right" which is pretty
much the same situation you have with the network rights assignments.
However, the MKDIR program executes with more privleges, and it can do so
for you.
–John
Thanks for the clarification! Although *I* am the local network guru, I'll
see what I can do about gettin some tiny exe files made. Any suggestions
as to the programming language? Thanks!
Tom
for something that small, why not ASM? All it has to do is issue a
function call to change its privledges, and then issue a dos call to exec
the file now that it can reach it. It the enhanced priveliges are stored
as part of the file description, the first is not even needed.
–John
What about all that WINDOWS jazz that needs to be done? Can a Windows
Omtype file be called using a normal DOS Call? Would a DOS call suffice?
Could I then put execute only privs on the (for example Pagemaker.exe) exe
file? Questions, questions, questions…
Thanks for the answers!
Tom
For a trivial program that does not do any user IO, I don't see any need to
make it "special". It does not manage any data either. Not much to worry
about.
The point is that PageMaker would _not_ be marked as ExecuteOnly, since you
can't do that. Rather, it is completely inaccessable to the user. The
little program has rights to access the PageMaker.EXE, and has full rights
to do whatever it wants to do with it. However, the only thing it does is
execute it.
–John
Netware 3.0 is a little past my experience, but with 2.1x and below this
kind of thing just can't be done. Netware 2.x security is strictly by
user, there is no such thing as a "privvied program."
But perhaps (things are gettin' weird…) the little "execute only" program
could bypass MS-DOS's "exec" routines and load Pagemaker (et al.) into
memory itself? Then the pagemaker EXE could be ENCRYPTED (but don't use
S-coder–HA!) and only the little "execute only" would have the key.
Then set Pagemaker read-only, accessable to all. The BIG drawback is that
writing your own loader that the OS won't choke on is megatricky.
— John Millington
I was just thinking of making a program that copied EXE-only programs 🙂
It could trick the network into thinking it was a loader, and grabbing the
bits instead of processing them.
–John
Ah, yes, but tricking the network into thinking you are a loader isn't
really trivial. You can't just open() the EXE, it'll fail. I haven't
analyzed it (yet? :Z) but it seems that there are two possibilities:
1) NET3.COM checks the Exec-only bit when it opens the file, and fails
the caller if it's set.
2) NET3.COM just sends the open request through and the server fails it
if exec-only is set. This would mean that NET3 is sending some slightly
different info to the server when it is trying to open a file fo loading
purposes, so the server will know what kind of open() is being attempted.
The answer seems to just be: disassemble COMMAND.COM and NET3.COM and do
what they do… Any better ideas, anyone?
P.S. there is a loader in Wendon's Operation System Toolbox. It is easier
than I thought.
–John
If ya don't trust 'em to live up the the license agreement, dump 'em.
Well, to be honest, I wouldn't mind dumping them. But, since they are auto
Omnomous, I don't know as how I could keep all the users from using the
network I am not too certain that the PROGRAM could only have rights to the
file. To run a file, one has to have rights to the file. Not too sure how
to avoid that Thanks for the help!
Tom