Password Protecting a Form

[Kryptech]

This is a short tutorial on password protecting your trainer. I will assume you have a basic knowlede of C# for this tutorial, if not, please read this tutorial first http://www.delta-h.net/forum/showthread.php?t=8729.

To start off, make a new windows form project. In the main form properties set the control Box option to false. This disables the close button on the top border. We do this because if you hit this close button on form 2 the applicatin will not close properly.



Next we are going to add a text Box. The only properties you need to set up on this is to set the password char. I used "*" but you can use whatever you want.

I added a tool tip to the text Box control to display when you hover over it with mouse. This is purely optional, but it's so easy to do I figured its worth the time explaining. drag the tool tip control to the text Box. It should show up at bottom of form window. Set the few options to your preference. To make it work simply add the following line to your Form1 Load function so it looks like this:

PHP Code:

private void Form1_Load(object sender, EventArgs e)
{
toolTip1.SetToolTip(textBox1, "Enter the password");
} 


Parameter 1 is the name of the control you want the tool tip to display over, and obviously param 2 is the text you want displayed.

The last thing we need to add to form 1 is the buttons. We need a submit button and an exit button. Go ahead and do that now. Once that is done we are going to make our second form. This will be the actual trainer, but for the sake of simplicity I am just making a simple form with a close button.

Go to Project->add Windows Form Select Windows Form and hit ADD.


Set this form up like the first change the properties so that there is no close buttom on the border. Now add an exit button to this form.

Go back to form 1 and double click the submit button. This will take us to the button click function. Add the following code to that for. At the top after publicpartialclassForm1 : Form
{
add the following line:
Form2 mainForm = newForm2();
This sets up our form object to use.

Then in the button function add the following code so it looks like this.

PHP Code:

private void button1_Click(object sender, EventArgs e)
{
if(textBox1.Text == "password") //This compares the entered text to what is in the quotes.
{
//This makes our second form show
mainForm.Show();
//This makes the first form close without closing the whole program
this.Dispose(false);
this.Close();
}else MessageBox.Show("Wrong password"); 
} 


All thats left to do now is make the exit buttons work. So, on each form, double click the exit button and add the following line to the button click functions:

Application.Exit();

This will close the application properly.

Now compile and run. That is all there is to it. This is what you should have if done correctly:


Now just make Form2 your trainer and you dont have to worry about unwanted people using your trainer.

[Iteration]

Good tutorial. Small suggestion though, don't add an message box stating the password is wrong. That way makes it harder to trace back to the compare.

[KN0WF34R]

Originally Posted by Iteration

Good tutorial. Small suggestion though, don't add an message box stating the password is wrong. That way makes it harder to trace back to the compare.

Hmmm, I need to build and run this in Olly before I go sticking my foot in my mouth with an unresearched reply.

[Bountyhuntr]

Surely that password which is stored in the exe is easily obtainable as it's a string, you could just open it in notepad and see it plain as day.

[Kryptech]

Ofcourse this is not secure against reversing. That is a whole other tutorial. Just trying to give basic explanations of things in C#. From what I can tell it seems to have all the benefits of both VB and C++. I have not tried anything serious with it yet, I am just learning it myself. Pretty much all the rules and techniques for security are the same for a C# app. Don't store the password in a simple variable or as a string in memory. Exit silently if wrong password. Compress and encrypt final file, etc...

[dremation]

You could store a small text file on a remote server and read that file. I'll explain and show an example. This way you can change the username/password as you see fit.

http://mycoolsite.com/mydata.txt

In this text file add the line:

username:password

(replace with your username/password, and I'd go ahead and hash that password)

In C# create a new application or add a WinForm to an existing application. (frmLogin)

For this example you'll need to use to Namespaces. System.Net, System.Web

using System.Net;
using System.Web;
using System.Security.Cryptography; //(if you want to hash your password, witch I suggest)

================================

On frmLogin add 2 textbox's and a button. Cleverly name them txtUser, txtPass and btnLogin.

On the btnLogin click event you want to add the following.

            string dataFile="http://yourcoolsite.com/mydata.txt
            WebClient wc = new WebClient();
            UTF8Encoding utf8 = new UTF8Encoding();
            string requestHtml = "";
            requestHtml = utf8.GetString(wc.DownloadData(dataFile));
           
           string[] loginData = requestHtml.Split(':');
           
            if(loginData[0] != txtUser.Text || loginData[1] != md5(txtPass.Text))
             {
                MessageBox.Show("Invalid Credentials!");
             } 
            else 
            {
                //do your approved work here
            }

If you've opted to use the md5 of the password then include this function as well.

private string md5(string password)
        {
            System.Security.Cryptography.MD5CryptoServiceProvider x = new System.Security.Cryptography.MD5CryptoServiceProvider();
            byte[] data = System.Text.Encoding.ASCII.GetBytes(password);
            data = x.ComputeHash(data);
            string ret = "";
            for (int i = 0; i < data.Length; i++)
                ret += data[i].ToString("x2").ToLower();
            return ret;
        }

That should be it. If you want added protection for the mydata.txt throw an .htaccess file in the directory denying access.

[Kraken]

You could also use DES encryption in the cryptology namespace, or obfuscate your program so it can't be easily decrypted in notepad.

BTW, this is my first post

[treax]

Thanks. Very good tutorial, i tried and it worked