Attack Economics: The Cost of the Second Break

The previous lesson named your attacker. This one follows the money. Every attacker, from a bored teenager to a professional reverse engineer, is running a private cost-benefit calculation whether they know it or not. They will spend effort on your code only while the reward is worth more than the hours. Your entire job as a defender is to move their calculation into the red. Understanding how they account for cost is how you do that deliberately instead of by luck.

Fixed cost versus marginal cost

Borrow two words from any economics class. A fixed cost is paid once, up front, no matter how many units you produce. A marginal cost is what each additional unit costs after that. Attacking obfuscated code has both, and the whole game is which one dominates.

• Fixed cost: the first-time effort of understanding a protection scheme. Recognising the layers, finding the decoder, learning the shape of the virtual machine, writing a script to undo it. This can be days of skilled work.
• Marginal cost: what it takes to break the next protected file once that understanding exists. This is the number that decides whether an attacker keeps going or quits.

Think of it like a lock-picking course. Learning to pick one brand of lock is the hard, slow part. After that, every lock of the same brand opens in seconds. The course was the fixed cost, each lock is the marginal cost. If a building used a different, unpredictable lock on every door, the course would never pay off, because the skill would not transfer. That is the whole idea, in one sentence, and the rest of this lesson is just that sentence made precise.

Amortization: how one break becomes many

Amortization is the accountant's word for spreading a fixed cost across many units. It is also the single most dangerous thing that can happen to your protection. Suppose an attacker spends three days fully defeating one of your builds. If every build you ship shares the same structure, they now write a small automated tool, point it at your whole catalogue, and every past and future release falls for free. Their three-day fixed cost has been amortized across thousands of files. Per file, the attack cost is essentially zero.

This is exactly the economics that has broken DRM scheme after DRM scheme. The protection was often genuinely elaborate. It did not matter, because it was the same elaborate wall every time, so one well-funded crack produced an infinite supply of free replays. The wall was strong and the investment was still worthless.

Variance: keeping the marginal cost high

The counter-move is to deny amortization. If each build differs in exactly the details that an attack depended on, then the understanding gained from breaking one build does not carry to the next. The attacker pays close to the full fixed cost again, in skilled human hours, every single time. The tool they wrote for build A produces garbage on build B.

The rename pass below is a stand-in for this idea. Watch how the same program can be re-expressed so that a script keyed to one output has nothing stable to grab onto in another. In a real protector this variance runs far deeper than names, reaching into structure, encoding, and layout, but the principle you can see here is the whole point: no two outputs give the attacker the same handhold twice.

Judge any protection scheme by one ratio: the cost of attacking the second output divided by the cost of attacking the first. Near zero is a skeleton key waiting to be cut. Near one is a defense that keeps charging the attacker full price forever. Raw strength decides how big the first bill is. Variance decides whether they ever get to pay it just once.

Notice how this reframes the buying decision. A single very strong but fixed layer raises the fixed cost and lowers nothing else, so it invites one well-funded effort followed by unlimited free replays. A moderately strong layer that varies per build raises the marginal cost, which is the number that actually governs whether an attacker stays in the trade. For a commodity product sold at volume, the second is almost always the better investment, even though the first looks more impressive in a feature list.

There is a subtler consequence for how you price your own protection effort. Variance converts a one-time capital expense for the attacker into a recurring operating expense. Capital expenses get raised once and forgotten; operating expenses are re-evaluated constantly and killed the moment margins thin. Piracy is a business like any other, and the fastest way to end a piracy operation against your product is to make each unit of stolen output cost the thief real, non-recoverable labour. You are not trying to build an unclimbable wall. You are trying to make climbing unprofitable per climb.

Frequently asked questions