Hi, and hello to everyone,
I registered here because I wanted to add to this discussion, as it's about very fundamental topic I was already confronted with several times. There once was KONxISE that compressed and encrypted executables, but nothing you do, not even Refox protection, protects the p-code all the way.
Because you can always run something, go into task manager, details tab, right click a process and use "create dump file". No matter if you use this native encryption function or Refox or KONxISE, the only way any executable can run is to be decrypted p-code when it's in memory. And so this decryption is done when your executable runs. And the dump option may not be as known as the task manager is known o kill a process, but it's there, i's a native option, not even a hacker tool from the dark web.
So what's the protection really worth? I'd mainly agree with Mike Lewis, the best part of your software is you and your knowledge about it, your ability to maintain and extend it, to know it as good as no other and understand it. For source protection it's already the best option to not add debug info in that sense, as then you really need a decompiler and can't just see source code within the EXE or dump file.
Mike says there is a quality of error handling that's missing, if you don't include debug info. That's somewhat true, it can become a nightmare to orient yourself with a line number only, but if you write error handling including your software version and maintain source code versions with a source versioning system, you can find the code in your project, too. The debug info does not add much more than that and you put all your source code in there, including comments, that can blows up the executable size extremely and adds a bit of documentation, too.
What you also don't achieve at all is protection against software theft, usage by more users than are licensed, etc. There are other mechanisms for that aspect anyway.
We share this overall problem with the whole industr. The only good ties in that aspect where in C/C++ tims, when compilation really meant that, ie transforming C code to assembly code and compiling that to machine code, really. So you needed decompilers that were reconstructing C by knowing what assembly macros certain C compilers used. In the end there never was full protection, since you can always extract the final executable code anyway, today getting back somehing you may even try to exend and maintain on your own is an achievale goal, but if someone is actually interested in selling stolen software, taking own control of it is rarely the goal anyway, so the major issue isn't even stealing your sources. As Mike also said, if you're as genius as cracking that and extracting the sources, then you could also write something yourself. So the question is: How much value actually is in the feature of our software you're most proud of? Is it really something revolutionary that you're fraid someone would steal?
If your major interest would be proteting data/privacy, as lso already said that's more a job for data encryption and then also never including such things in source code anyway, so that's a very separate topic.
Chriss
