• Registered: 2017-03-30
  • Posts: 9

Topic: Is there any way to encrypt or hide script.pas

Hi:

Im currently evaluating the My Visual Database by creating a program that would justify my reason to purchase the software. By reading previous post here, I manage to create a simple program using MySQL. I connect to the server using the script which i also found in this forum.

Is there any way to encrypt or hide the script.pas, to protect the Database from unwanted connection.

i just want to avoid the user from accessing this line:

     frmMain.MySQLConnection.Server := '111.###.###.###';
     frmMain.MySQLConnection.Port := 3306;
     frmMain.MySQLConnection.Username := '#####';
     frmMain.MySQLConnection.Password := '#########;
     frmMain.MySQLConnection.Database := '#######';
  • Registered: 2015-02-24
  • Posts: 446

Re: Is there any way to encrypt or hide script.pas

Hello Robin,


I don't think you need to encrypt the script.pas file because, once your application debugged and ready for distribution, you don't have to distribute it with the project. The only file you have to leave in the script folder is the script.dcu file.


Cheers


Mathias

I'm a very good housekeeper !
Each time I get a divorce, I keep the house
Zaza Gabor
  • Registered: 2017-03-30
  • Posts: 9

Re: Is there any way to encrypt or hide script.pas

Mathias:

Last time I tried i erase the entire folder :-)
I erased the script.pas then it works!
Thank you very much....

Robinx

  • Registered: 2014-06-25
  • Posts: 863

Re: Is there any way to encrypt or hide script.pas

Have you ever tried to open the script.dcu? wink It is not encrypted at all...

This has been a discussion for a while already and there is no way to hide that folder, I think the script.dcu should be embedded into the .exe so it would be much more difficult to hack.

  • Registered: 2017-03-30
  • Posts: 9

Re: Is there any way to encrypt or hide script.pas

Tcoton:

You're right i peek at script.dcu.. all information about MySql Server is there.

Again back to my question, to those experienced user of MVD, how do you prevent this in your apps distribution.

  • Registered: 2015-11-13
  • Posts: 652

Re: Is there any way to encrypt or hide script.pas

What I do and I know it's not perfect is instead of assigning the password as a literal, I break the password down into pieces, one or two characters, and hide the pieces of the password on a form as labels.  You can place them on frmWait if you are using the Application.ProcessMessages or on your first form. I only use one character label names to conceal some more. Then in the password assignment I add each label caption together.

Like I said, it's not perfect, but the password does not pop out as a literal in the script.dcu file. It would take a little effort to figure it out and it would require knowledge of how MVD works behind the scenes. But I agree, it would be nice if the script.dcu file could somehow be embedded into the exe file.

Example:


frmMain.MySQLConnection.Password := frmWait.w.caption + frmWait.x.caption + frmWait.y.caption + frmWait.z.caption;

  • Registered: 2017-03-30
  • Posts: 9

Re: Is there any way to encrypt or hide script.pas

Hi Ehwagner:

Can you send me a sample file of what you did. I do understand the line you had posted but i dont know how to call it in script.
Thank you very much for your time.

  • Registered: 2017-03-30
  • Posts: 9

Re: Is there any way to encrypt or hide script.pas

Guys:

Ehwagner trick works, at least we can hide the MySQL Information a little bit.
My code goes like this

frmMain.MySQLConnection.Server := frmConnect.label2.Caption;
frmMain.MySQLConnection.Port := StrtoInt(frmConnect.label3.Caption);
frmMain.MySQLConnection.Username := frmConnect.label4.Caption;
frmMain.MySQLConnection.Password := frmConnect.label5.Caption;
frmMain.MySQLConnection.Database := frmConnect.label6.Caption;

I hope in future the script.dcu be embedded in .exe file.

Thanks Ehwagner for sharing your idea..

  • Registered: 2017-02-01
  • Posts: 106

Re: Is there any way to encrypt or hide script.pas

robinx1578 wrote:

Guys:

Ehwagner trick works, at least we can hide the MySQL Information a little bit.
My code goes like this

frmMain.MySQLConnection.Server := frmConnect.label2.Caption;
frmMain.MySQLConnection.Port := StrtoInt(frmConnect.label3.Caption);
frmMain.MySQLConnection.Username := frmConnect.label4.Caption;
frmMain.MySQLConnection.Password := frmConnect.label5.Caption;
frmMain.MySQLConnection.Database := frmConnect.label6.Caption;

I hope in future the script.dcu be embedded in .exe file.

Thanks Ehwagner for sharing your idea..

You can find it still at forms.xml. Together with script.dcu, which shows the labels, you can re-asgin the values.
Working for script kiddies but not if somebody really want to get into the database.

Currently only way is to store the values xor encoded or as hex value. There are some examples at the forum how to do it.

  • Registered: 2017-03-30
  • Posts: 9

Re: Is there any way to encrypt or hide script.pas

Teco049

But still its a little better than the default setting.
I guest for now all we can do is wait until its embed in exe file.

  • Registered: 2017-03-30
  • Posts: 9

Re: Is there any way to encrypt or hide script.pas

Guyz:

I think i just found the solution to protect the MySQL Database from unauthorized access by reading deeply into the script.dcu and forms.xml
What i did is link the MySQL server login information to the label then embed the forms.xml to exe file. I used another software to embed the forms.xml to exe file. I tried to embed the script.dcu but im having an error since its reside inside the script folder.

Here's the link of the file.. Please take your time to view if this thing really works. Dont worry its nothing in there, txtbox are not even connected to the database. But it shows the message connecting to MySQL Server..

https://drive.google.com/open?id=0Bzbqq … 29ycVh5QlU

Special thanks to Teco049, Ehwagner and mathmatho. Let me know if there still chance to view the MySQL Server login information coz its very important for all of us.

  • Registered: 2017-02-01
  • Posts: 106

Re: Is there any way to encrypt or hide script.pas

robinx1578 wrote:

Guyz:

I think i just found the solution to protect the MySQL Database from unauthorized access by reading deeply into the script.dcu and forms.xml
What i did is link the MySQL server login information to the label then embed the forms.xml to exe file. I used another software to embed the forms.xml to exe file. I tried to embed the script.dcu but im having an error since its reside inside the script folder.

Here's the link of the file.. Please take your time to view if this thing really works. Dont worry its nothing in there, txtbox are not even connected to the database. But it shows the message connecting to MySQL Server..

https://drive.google.com/open?id=0Bzbqq … 29ycVh5QlU

Special thanks to Teco049, Ehwagner and mathmatho. Let me know if there still chance to view the MySQL Server login information coz its very important for all of us.

Looks good at first sight.
Which software are you using for linking?
For a full test I recommend to do some statistical test like
- merging two files with known text and seaching for added/changed parts
- Analysing of the changed parts if they are compressed or encrypted
.
What kind of application are you writing? Normal office people have regulary not enough backround to analyse .dcu or forms.xml for getting the Connection information. Do you have some fears about hackers or internal/customer requirements?
.
Depending on this you are looking at the wrong end of the work-chain to create a safe database application because there are still a lot of ways to get the database connection information. But for any recommendation some more information would be helpfull. At this point I would say a interested hacker would need some more time to get the connection information and can do much more to ruin you planning.
.
The connection to the database is not safe for high security applications...

  • Registered: 2017-03-30
  • Posts: 9

Re: Is there any way to encrypt or hide script.pas

Teco049:

Im just writing a database that can be used by our division and region. Its about computer inventory, a simple database program that can be distributed via usb without install. Lets say hundreds  of public schools will be using the final product. Im still new to MVD, and im using the shareware.. I know nothing about programing except vb6. Somehow i do understand how the script works by downloading n reading the samples.

I tried to secure the mysql connection line from end user to our hosting company. That's my first thing to do. Little by little, i succeeded to embed the \script\script.dcu and forms.xml to the main exe files. This is enough for me for now.. Im using "VMProtect Ultimate", there's a lot of stuff you can do the program and for me its perfectly good to use along side with MVD.

I still have a lot of question of how MVD works but thats coz another thread to start. Hopefully i can finish the program ASAP. and they approve my proposal to purchase a licensed copy. I am in educational sector, Hopefully the author will offer discounts to educational institution :-). This is a good program.. Thanks Dmitry... hopes you grant my request...