How does "watermarking" in applications work?

Question

By watermark I mean: A byte array that is somehow integrated into a .exe / .dll file, which can be searched for. Many anti-piracy / anti-reverse-engineer programs include a system called "watermarks" as a featuer. For example VMProtect.

How does this work? If someone was to crack and / or copy the protected binary, what exactly prevents him from just removing the watermark. The idea is that you, as the creator of your software, can download a pirated copy of your own program, then you can see who exactly leaked / uploaded this copy. What exactly prevents an attacker to just scan for the watermarks and remove them??

Second part of this question: It is said that a watermark is (or should be) included many times at different, random positions in the binary. Obviously they are not completely random. Because that would damage the binary in the same way a defective hard drive would. The program cannot just overwrite code in the binary with the watermark, that's for sure. How can the protection program include a watermark in different (and random) locations in the binary? How are these locations choosen?

Third part: Assuming I have a watermarked binary. How would the protecting program later scan for the watermarks. How does it find the watermarks again?

Also how can there be information included with the watermark (a small string, identifying the original owner of the copy) ? Is the information somehow encrypted into the watermark?

Answer 1

I don't know what your goal is but:

• watermarking is as you describe putting some unique byte sequence into the binary
• the byte sequence mst be inserted carefully as not to make the binary unusable (depends on the type of binary - i.e. .NET or .jar or native .EXE etc.)
• the byte sequence must be such that it is hard to identify for anyone not familiar with this specific watermarking system (for example you could use some sort of http://en.wikipedia.org/wiki/Steganography)
• all this makes it very hard to remove watermarking when cracking the software
• the protecting program can scan for watermark because it knows the algorithm and keys used for watermarking
• you could include anything in a watermark (depending on the algorithm)... the watermarking software should somehow encrypt it before putting it into the watermark (it could even just put a hash into the binary instead of the real information and still be able to identify it)