Add password protection to your indicators/EAs - Expert for MetaTrader 4 - MT4/MT5 Resources

Several methods of protecting your code have been proposed in the past, but are either too simple (less secure), requiring the code to be recompiled for each new client (which is fine if you only plan to have a dozen or so clients), or too complex, involving a remote host to authenticate the client.

Here I propose a simple password verification scheme that uses MT4's built-in security engine to provide DES/ECB encryption and does not require recompiling the code for each new client.

Having been involved in several high-profile Canadian smart card initiatives, I am very familiar with the various security schemes used by financial institutions and card issuers. The first question you must ask yourself is "What are the risks?". When starting a project with these people, always conduct a risk assessment. If the answer is "millions of dollars," then this security option isn't for you.

On the other hand, if your answer is "If it took someone about a year to crack my security scheme, it would take a month or two of coding," then this solution is for you. The single DES key used in this encryption scheme provides sufficient security for your code and does not require recompiling the code for new clients.

I've provided two source files for your convenience. The first "Password_Check" is what you will add to the indicator or expert advisor. It will verify the password entered by the user in the input parameter "Password" and if the password is incorrect (or the user is offline) it will display a user-friendly message, delete the expert (if running) and return the INIT_FAILED status.

The second file "Password_Generate" is used to enter the customer name and account number to be protected. It will display the generated password so you can provide it to your client. Obviously you don't want to include this code in your final product! :)

So let's get started...

First we need to define an input string for your indicator or Expert Advisor:

 //--- input parameters
External string password;

Next, we add code in the init() function to check the password and display a message if the password is incorrect, the user is offline, or the user did not enter the password at all.

 //+------------------------------------------------------------------+
//|Verify the client's password
//+------------------------------------------------------------------+
boolean password_check( stringclient )
{
string master key;
Uchar dst[], src[], key[];

// Define your encryption key here.  DES/ECB encryption must be 7 characters // making your password difficult to crack.  Your last name is not a good idea! // Something like "wLdU&$z" would be nice.  Now, we'll use a simple... masterkey = "not a demo" ; 
  
//Convert MasterKey to character array string to character array (master key, key);
  
// Make sure the client string is not empty if ( stringlength (client) == 0 ) return ( false );
  
// Use DES key to encrypt client string to character array (client, source code);
Encryption encoding ( encrypted data encryption standard , src, key, dst);

// Clear key and encode to BASE64 array initialization (key, 0x00 );
Encryption encoding ( CRYPT_BASE64 , dst, key, src);

// Compare passwords and return the result ( character array to string (src) == password);
}

That's it! We can now verify the client name (taken from the client account name in MetaTrader 4) as well as the client account number (also taken from MetaTrader 4).

If your licensing policy allows a single client to use multiple accounts, then you can simply remove the account number from the "client" string, like this:

 // Make sure the client is online in order to get the client name
if ( connected ()) customer = accountInfoString ( accountName );

Of course, you can mix and match Broker Name, Account Name, and Account Login as you see fit. Remember, the longer the "client" variable, the longer the encrypted password will be.

Next, let's look at the "Password_Generate" code. What we want to do is the same as with "Password_Check", but instead of entering a password in the EA, we enter the client name to be encrypted (or a combination of broker name, account name and account login of your choice) and then display the generated password. This is what you will offer your clients when they purchase your powerful indicators and/or Expert Advisor.

Likewise, in the init() function, you will add the following code.

//+------------------------------------------------------------------+
//|Expert initialization function |
//+------------------------------------------------------------------+
integer_initialize ()
{
string password= invalid ;

// Make sure the client input is not empty if ( string length (client) != 0 )
  {  
// Generate client password Password=Password_Generate(client);
  
//Print the generated password (easy to cut and paste) print ( "Customer: '" +Customer+ "' Password: " +Password);
 
// Display the password message box generated for the client ( "Password generated for client/account\n\n'" +client+ "' is:\n" +password, "password generator" , 
MB_OK | MB_ICONINFORMATION );
  }
Other message boxes ( "You must specify a customer/account!" , "Password Generator" , MB_OK | MB_ICONSTOP );
  
// Everything is fine.  Delete Expert. ExpertDelete ();
Return ( initialization successful );
}

Now we slightly modify the "Password_Check()" function to return a string encoding the password. Remember to use the same password in the Password_Check() function and Password_Generate() function. You can imagine what will happen if you don't!

 //+------------------------------------------------------------------+
//|Encrypt client information and return password
//+------------------------------------------------------------------+
string password_generate( string client)
{
string master key;
Uchar dst[], src[], key[];

// Define your encryption key here.  DES/ECB encryption must be 7 characters // It must be the same as the password defined in the "Password_Check()" function! // Make your password difficult to crack.  Your last name is not a good idea! // Something like "wLdU&$z" would be nice.  Now, we'll use a simple... masterkey = "not a demo" ; 
  
//Convert MasterKey to character array string to character array (master key, key);
  
// Use DES key to encrypt client string to character array (client, source code);
Encryption encoding ( encrypted data encryption standard , src, key, dst);

// Clear key and encode to BASE64 array initialization (key, 0x00 );
Encryption encoding ( CRYPT_BASE64 , dst, key, src);

//Return the encrypted password return ( character array to string (source));  
 }

That's it, that's it. You enter the information the customer gives you and then send them a password via email or any other method of your choice. Of course, the beauty of this is that you can do it in your living room in Bora Bora!

As mentioned before, this security solution does not require you to recompile your code or write a server-side validation host for each new client, while providing pretty good security for your hard work of creating powerful indicators/EAs!

Attachment download

📎 password_check.mq4 (3.58 KB)

📎 password_generate.mq4 (3.22 KB)

Source: MQL5 #15534