I have found some software on 1337 that a friend was asking for. It’s for Windows and I’m on Linux. Is test running the software inside a VM the only way to securely vet it (to see what connections it tries to make and what processes it starts)? On VirusTotal, I get one positive and 66 negatives. Preferably, I’d like to hand over the software without worrying about giving them malicious code…

  • Walters, Fern@bookwyr.meEnglish
    3·
    15 hours ago

    You can also acquire the original executable, and compare the differences in a binary/hex editor. VM runs would be after you have sanitized the EXE.

    • altkey (he\him)@lemmy.dbzer0.comEnglish
      2·
      4 hours ago

      ArchiCAD uses a now-usual DRM scheme of either checking a hardware thumbstick key or seeking for a background licensing server at localhost or a set IP (always-on machine with a pool of licenses one can take one from).

      https://help.graphisoft.com/AC/25/INT/_AC25_Help/003_InstallGuide/003_InstallGuide-4.htm (is it the version OP got?)

      A cracker should either patch the requirement off completely (or drop exe, dlls for in-place replacement) or emulate a suitable key/server that is a separate app. With a lot of software I pirated with this DRM model it’s usually the second way, emulating a server with always correct responses. If that’s the case, the primary exe file can as well be original (of some distinct version?) but the crack happens to a separate background program installed with the main app.

      I think we need another look at what is actually downloaded by OP and if there is some patching process jnvolved or everything is provided already cured. Then, to see and notice what processes are running in the VM, what they try to do.

    • TheFogan@programming.devEnglish
      3·
      8 hours ago

      If you have the executable from a trusted source, then you don’t need to spend your time determining if a version you got from an unsafe location is legitimate, you’d just make a copy of the trusted original and throw out the bootleg to be safe.

    • printf("%s", name);@piefed.blahaj.zoneOPEnglish
      1·
      17 hours ago

      In theory I agree, but other than buying the original executable from a reputable vendor, I have no way of verifying the integrity and authenticity of the EXE.