Good news for RPG shops everywhere: IBM gave us a way to protect our code from prying eyes, while keeping all the functionality of the debug views! The code is there, but it’s hidden.
Written by Rafael Victoria-Pereira
As you might have guessed, anyone with access to STRDBG, the command that replaces STRISDB, will also have access to your source code! This gets especially sticky if you run a shop that designs and sells software; you need to secure your source code and can’t let your customers peek inside your programs. Fortunately, IBM included a new parameter in CRTRPGMOD and CRTBNDRPG, which allows you to encrypt your debug views. In other words, now you can ship debuggable code and know that your code is not visible to your customers.
How does it work? The new parameter is called Debug Encryption Key (DBGENCKEY). Entering a value in this parameter will force the debugger to encrypt the debug views. You’ll have to enter the debug encryption key (read: a password) for the views to be decrypted. I’ll explain how in a minute, but first let me go over a few important things about DBGENCKEY’s password. You might be wondering how safe this password is. Well, the debug encryption support uses the Advanced Encryption Standard (AES), a private key-based block cipher encryption methodology, which is accessed via the IBM i Cryptographic Services APIs. Once the debug data is encrypted, it’s inaccessible unless the correct key is provided.
This new parameter takes a 16-byte key value. If you enter a key shorter than that, the system will pad it to 16 bytes with blanks. Note that the key is case-sensitive, so “password” is not the same as “Password.” If your source and target systems do not use the same code page (which might be the case with overseas customers), the key should contain only characters that are the same in both code pages. In other words, ensure the characters used for the key value are contained in the invariant character set, which is a set of characters whose code point assignments don’t change from one EBCDIC code page to another. This set generally includes uppercase letters A–Z, digits 0–9, and the space character.
Another option is using a hexadecimal string for the key. How do you do that? Simple: if you prompt the CRTRPGMOD command, the DBGENCKEY parameter will initially show a 17-character input area. In order to type a hexadecimal string for the key, you have to enter the ampersand character (&) followed by a blank space, and the input field is widened to 25 characters. This can be done repeatedly to increase the field length to 32, 50, 80, 132, 256, and 512 characters. It’s also important to mention that, because this parameter is available only for V7.1 and newer versions of the operating system, the Target Release (TGTRLS) parameter must have a value of V7R1M0 or *CURRENT to specify a debug encryption key.
So now that you have your debug views encrypted, how do you get them decrypted when you need to debug the program? On the STRDBG command, there is a parameter called Decryption Key (DBGENCKEY) in which you can enter the key. Alternatively, you can wait for the debugger to prompt you for the key when an encrypted view is encountered. Since each module can have its own key, and there could be several modules, the debugger caches the keys for the debug session. It will try all the cached keys before it prompts for a key. The cached keys will be cleared when the debug session is over.
When the debugger prompts for the encryption key, you’ll have three tries to enter a valid key. If you fail to do so, the debug view will not be decrypted. However, the module is still debuggable, so setting breakpoints and displaying variables will be possible; you just won’t see the source code. It will behave as if the *STMT keyword (discussed two TechTips ago) was entered in the DBGVIEW parameter when the object (module or bound RPG program) was created.
Naturally, I can’t stress enough that this works only if you don’t ship your sources along with the objects. That would make encrypting the debug views pointless. It’s also important to mention that, even though you can use very long passwords, don’t go overboard with them or you might be forced to recompile the program “back home” and sent it to the target system again.
That’s all for now! The next TechTip will be about the debug process itself, which is a little bit different from the old STRISDB debug. Until then, I’d like to hear from you! Use the Comments section below to share your ideas, experiences and criticisms about this TechTip or even the whole RPG Academy series.
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online