I have an arduino-based product I'm planning to sell. I don't want customers to try to access the code or board. What are some ways to decrease the chance of that?
I was thinking to remove/de-solder the USB input, or put superglue/hot glue to seal the socket. Perhaps loctite the screws on the outer housing to make it more difficult to access the board.
I know the code that can still be reverse engineered is binary and not the actual C++, but I would still like to decrease customer tampering if able.
Be aware that if people see the behavior of your application, it is often far easier (cheaper) to rebuild from scratch then to try to reverse engineer it.
Some ideas to spent time to make reverse engineering more difficult:
blank all identification on chips resistors and PCB e.g 4.7K 10uF DHT22.
use a 6 layer PCB, place GND and 5V layer on the outside so all logical tracks are in the middle 4 and hard to see with X-ray
place unused components on the PCB as smoke screen (or even merge another application on the same board in an illogical way)
place components as irritating as possible
add smoke screen code in your sketch to make it fill up the PROGMEM (without disturbing the main code). An example is to add code to generate primes distributed in all existing code.
encrypt your EEPROM data, constant strings etc.
...
However as said before rebuilding from scratch is often easier, and it allows one to improve on your application, including fixing bugs and introducing new ones ;).
Applications are relative hard to copy if the used algorithms are sophisticated, or some unique hardware (e.g. home made sensor) is used. Patenting those or the whole application is expensive and enforcing patents is even more costly.
The best copy protection might be to keep the price so low that it is financially not interesting to copy or reverse engineer it.
Are you sure you don't use any open source code (libraries etc.) that forbids you to do so?
And if you are:
Copying can easiliy inhibited by setting lock bits ( at least at AVR processors without a bootloader ). And reverse engineering is nearly impossible if you inhibit reading the binary.
If the code inside the Arduino is accessible, it can sometimes be determined that an open-source library was used by searching the compiled code for text messages used by the library, fixed data tables from the library, etc. No need to do any decompilation for that.
It might also be noticeable just by looking at output from your code, if it is displaying messages that are commonly associated with a particular library.
Library code of all known versions is an essential part of a decompiler. I used it already in the 80s. Hardware related (firmware) libraries are very easy to identify.
In the public domain, but usually with open source software licenses that require any code that uses the library to be under the same software license, which would require your code to be open source.
If they are open source, you must follow the rules for open source which includes providing the source or at least a link to the source. Doing so in no way makes your product easier or more difficult to reverse engineer.
No general unspecified "open source" license exists. Instead any number of license schemes can be used: GPL, LGPL, BSD, MIT...
Also (additional, paid) licenses without open source restrictions may exist, at the authors' choice.
There exist other ways to find out more about running code. Also the use of protection mechanisms invites hackers to crack your code, for pure joy and fame.
