# Hard code passwords compiled into program **URL:** \ **Category:** questions\ **Tags:** encryption, security\ **Created:** [July 15, 2024, 9:23pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318 "2024-07-15T21:23:56Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![KevinErskine](https://clarionhub.com/user_avatar/clarionhub.com/kevinerskine/32/711_2.png) [@KevinErskine](https://clarionhub.com/u/KevinErskine)\ **Post date:** [July 15, 2024, 9:23pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/1 "2024-07-15T21:23:57Z")
I have several hardcoded passwords and other "secret" information that I need to be kept as hard coded into the program. How are others compiling this into their program to reduce just hex editing the EXE and figuring out some passwords? ---
**Author:** ![AbdullahAkilah](https://clarionhub.com/user_avatar/clarionhub.com/abdullahakilah/32/4818_2.png) [@AbdullahAkilah](https://clarionhub.com/u/AbdullahAkilah)\ **Post date:** [July 15, 2024, 9:57pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/2 "2024-07-15T21:57:04Z")
Can’t prove this is necessarily any better (your potential attacker always has the option of disassembling the binary), but to stop the most obvious method of looking in the binary file for obvious strings the way I’ve seen it done before is to build the password at runtime. So instead of password = ‘12345’ you do password = ‘1’ & ‘2’ & ‘3’ … or password = chr(49) & chr(50) … ---
**Author:** ![Jane](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/ecb155/32.png) [@Jane](https://clarionhub.com/u/Jane)\ **Post date:** [July 15, 2024, 9:57pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/3 "2024-07-15T21:57:37Z")
Realizing that someone who’s determined enough to attach a debugger can find things… I’ve taken a couple of approaches. 1. Having a routine that XORs two hard-coded strings together and uses the result as a password. 2. Combining pieces on the fly, such as: ```auto LOC:Password string(30) LOC:STRING1 string ('<120,125>GPFat%s1.}}Other error' code LOC:Password = '9' & sub(LOC:string1,7,len(LOC:String1)-6) & ' ' & (4*13) ``` ---
**Author:** ![anon77170705](https://clarionhub.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@anon77170705](https://clarionhub.com/u/anon77170705)\ **Post date:** [July 15, 2024, 10:34pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/4 "2024-07-15T22:34:30Z")
Simple ways: - use a very long string containing parts of real passwords - use unusual passwords consisting of non-printable characters like ‘\<01,0AFh\>3\<1Dh\>{99}’ - encrypt actual passwords with a key string building at run time, for example, as bytes from the PE header or located at entry of some procedure. ---
**Author:** ![Julian](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/74df32/32.png) [@Julian](https://clarionhub.com/u/Julian)\ **Post date:** [July 16, 2024, 7:54am UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/5 "2024-07-16T07:54:00Z")
I store “secret” information .. encoded with a simple encoder. I use password generating procedure(s) using the date as part of the algorithm (hence it changes daily), this has turned out to be better than I originally thought because I can give the customer temporary access when he forgets his own password (very convenient). ---
**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\ **Post date:** [July 16, 2024, 9:10pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/6 "2024-07-16T21:10:36Z")
As noted put it in a longer string of random characters like a [strong password generator](https://passwordsgenerator.net/): G7gFEzLyTXUSyuFr3pC9Rf3CJnMYBuFLnsJq2uTbCbVtfumD Then you could use something like Jeff’s Amble Scray > **[GitHub - jslarve/AmbleScrayLite: Scramble text by way of a password](https://github.com/jslarve/AmbleScrayLite)** > > Scramble text by way of a password And / or use this to compress and create a hex string that would not be obvious. > **[GitHub - jslarve/DataToClarion: Convert data to a Clarion-compilable format](https://github.com/jslarve/DataToClarion)** > > Convert data to a Clarion-compilable format ---
**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\ **Post date:** [July 16, 2024, 9:18pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/7 "2024-07-16T21:18:00Z")
We must still be cognizant of the fact that if you are decoding something into memory, all of the clever little dances that we do are just clever little dances that we do while cleverer people read our stuff ---
**Author:** ![anon77170705](https://clarionhub.com/letter_avatar_proxy/v4/letter/a/ecccb3/32.png) [@anon77170705](https://clarionhub.com/u/anon77170705)\ **Post date:** [July 16, 2024, 9:39pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/8 "2024-07-16T21:39:49Z")
Place a breakpoint in the debugger on Cla$FILE\_OPEN and all files’ passwords are yours… ---
**Author:** ![Jane](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/ecb155/32.png) [@Jane](https://clarionhub.com/u/Jane)\ **Post date:** [July 16, 2024, 9:53pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/9 "2024-07-16T21:53:52Z")
> cleverer people read our stuff Armadillo debugger-detector/blocker for the win! ---
**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\ **Post date:** [July 17, 2024, 3:49am UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/10 "2024-07-17T03:49:45Z")
She said, confidently 🙂 ---
**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\ **Post date:** [July 17, 2024, 8:44pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/11 "2024-07-17T20:44:21Z")
GitHub can search Repositories for specific kinds of secrets > **[Secret scanning alerts are now available (and free) for all public repositories](https://github.blog/news-insights/product-news/secret-scanning-alerts-are-now-available-and-free-for-all-public-repositories/)** > > Secret scanning alerts are now generally available for all public repositories. Admins can now turn on the alert experience with one click. Edit: Fixed link, thanks ---
**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\ **Post date:** [July 17, 2024, 9:00pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/12 "2024-07-17T21:00:32Z")
@CarlBarnes your link is broken. ---
**Author:** ![PurpleEdge2214](https://clarionhub.com/user_avatar/clarionhub.com/purpleedge2214/32/5109_2.png) [@PurpleEdge2214](https://clarionhub.com/u/PurpleEdge2214)\ **Post date:** [July 18, 2024, 1:29am UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/13 "2024-07-18T01:29:01Z")
> **[Secret scanning alerts are now available (and free) for all public repositories](https://github.blog/news-insights/product-news/secret-scanning-alerts-are-now-available-and-free-for-all-public-repositories/)** > > Secret scanning alerts are now generally available for all public repositories. Admins can now turn on the alert experience with one click. ---
**Author:** ![RchdR](https://clarionhub.com/letter_avatar_proxy/v4/letter/r/d78d45/32.png) [@RchdR](https://clarionhub.com/u/RchdR)\ **Post date:** [July 25, 2024, 10:56am UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/14 "2024-07-25T10:56:18Z")
If net access is an option, short term certs like a 1 day cert can help expire things. MS SBS and other software would fail during installation if the system date time was too far in the future due to the certs. Making an app download pertinent dlls to run in memory at runtime can also help. But nothing is perfect, time, knowledge and resources are the enemy which probably explains why windows is so bloated! ---
**Author:** ![RchdR](https://clarionhub.com/letter_avatar_proxy/v4/letter/r/d78d45/32.png) [@RchdR](https://clarionhub.com/u/RchdR)\ **Post date:** [August 6, 2024, 9:31am UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/15 "2024-08-06T09:31:46Z")
Saw the below link and thought of this post. Haven’t tried it myself but the link is here if someone fancies trying it out. Change a message into a password! > **[Hiding messages in x86 binaries using semantic duals](https://blog.yossarian.net/2020/08/16/Hiding-messages-in-x86-binaries-using-semantic-duals)** ---
**Author:** ![SerhatSatir](https://clarionhub.com/user_avatar/clarionhub.com/serhatsatir/32/1953_2.png) [@SerhatSatir](https://clarionhub.com/u/SerhatSatir)\ **Post date:** [August 9, 2024, 5:39am UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/16 "2024-08-09T05:39:44Z")
Both are very similiar. To hide the fixed password in the code I used different lines like this; . password[4]=‘4’ . (some other codes) . password[2]=‘2’ . (some other codes) . password[1]=‘1’ . (some other codes) . password[5]=‘5’ . (some other codes) . password[4]=‘4’ ---
**Author:** ![Owen](https://clarionhub.com/letter_avatar_proxy/v4/letter/o/b2d939/32.png) [@Owen](https://clarionhub.com/u/Owen)\ **Post date:** [August 9, 2024, 6:04am UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/17 "2024-08-09T06:04:59Z")
I have moved away from hard coded passwords within the exe. I am using two components, one stored in the user’s profile, the other stored within the user’s registry settings. The two components combined form the password. I am using industry standard cryptography algorithms to combine the two components. ---
**Author:** ![KevinErskine](https://clarionhub.com/user_avatar/clarionhub.com/kevinerskine/32/711_2.png) [@KevinErskine](https://clarionhub.com/u/KevinErskine)\ **Post date:** [August 9, 2024, 1:59pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/18 "2024-08-09T13:59:31Z")
yeah, i used to do that in days gone by. I have dozens of pass codes, api keys, secrets etc.. I may just create an encrypted TPS file to old everything as 1 large encrypted JSON string that is loaded at run time. I wish there was compiler directive to encrypt/encode as it is being compiled to hide sensitive information in the EXE/DDL/LIB **MyEquatePassword EQUATE(‘somesecretpassword’),ENCRYPT** That would encrypt as compile time and unencrypt at run time. We are not too concerned about the actual app running being hacked, just the image on disk. ---
**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\ **Post date:** [August 9, 2024, 9:43pm UTC](https://clarionhub.com/t/hard-code-passwords-compiled-into-program/7318/19 "2024-08-09T21:43:39Z")
> [@KevinErskine](#): > > I may just create an encrypted TPS file to old everything as 1 large encrypted JSON string that is loaded at run time. You could [encode Base 64](https://www.base64encode.org/) or [encode Base 85](https://cryptii.com/pipes/ascii85-encoding) so its not plain text. ```auto Original: Secr3t Pa$w0rd Base 64: U2VjcjN0IFBhJHcwcmQ= Base 85: ;e9HZ1NXa9@3g%NEb# ``` Then take some steps so that it is not obvious Base 64 with just your password than can easily be decoded. Note that [Base 64](https://en.wikipedia.org/wiki/Base64) takes 3 Bytes and encodes as 4 characters `[A-Za-z0-9+\]` with “=” for padding. A few thoughts… 1. Make the Length a multiple of 3 so no obvious trailing “=” padding in Base 64. 2. Mix the secret in a longer junk string you know to ignore 3. Mix in parts in a longer junk string so all the bytes are not together, or reverse, etc 4. Make the leading junk length Not a multiple of 4 so it will not decode right E.g. the below the Password is mixed in with other Base 64. It starts with Junk that is 9 bytes that will cause it not to decode. The 14 byte password padded with ‘X’ so no ‘=’ on end ```clarion MySecrets GROUP,PRE(Secret) Junk_9 STRING('N2dGRXpMe') !9 bytes incomplete encode of '7gFEzLyTXUSyu' Password STRING('U2VjcjN0IFBhJHcwcmRY') !Base 64: `Secr3t Pa$w0rd' & 'X' Junk_12 STRING('Rkxuc0pxMnVUYkNiVnRmdW1E') !Encode Junk: FLnsJq2uTbCbVtfumD END ``` Only you know to Decode `MySecrets.Password` and Cutoff the ending ‘X’. Trying to decode the entire MySecrets `N2dGRXpMeU2VjcjN0IFBhJHcwcmRYRkxuc0pxMnVUYkNiVnRmdW1E` will return `7gFEzLy` … then high/low ASCII that not your secret. * * * It would be simple to code your own Base 64 function that changes the translation map `[A-Za-z0-9+\]` which would make it harder to crack. But then you cannot use an online Encoder / Decoder. I might pass in a Number that is used to rotate the Map e.g. (1) moves the ‘A’ in [1] to [64].