RPG Academy: Debug Done Right - Encrypting Your Debugging Views

  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Good news for RPG shops everywhere: IBM gave us a way to protect our code from prying eyes, while keeping all the functionality of the debug views! The code is there, but it’s hidden.

Written by Rafael Victoria-Pereira

As you might have guessed, anyone with access to STRDBG, the command that replaces STRISDB, will also have access to your source code! This gets especially sticky if you run a shop that designs and sells software; you need to secure your source code and can’t let your customers peek inside your programs. Fortunately, IBM included a new parameter in CRTRPGMOD and CRTBNDRPG, which allows you to encrypt your debug views. In other words, now you can ship debuggable code and know that your code is not visible to your customers.

How does it work? The new parameter is called Debug Encryption Key (DBGENCKEY). Entering a value in this parameter will force the debugger to encrypt the debug views. You’ll have to enter the debug encryption key (read: a password) for the views to be decrypted. I’ll explain how in a minute, but first let me go over a few important things about DBGENCKEY’s password. You might be wondering how safe this password is. Well, the debug encryption support uses the Advanced Encryption Standard (AES), a private key-based block cipher encryption methodology, which is accessed via the IBM i Cryptographic Services APIs. Once the debug data is encrypted, it’s inaccessible unless the correct key is provided.

This new parameter takes a 16-byte key value. If you enter a key shorter than that, the system will pad it to 16 bytes with blanks. Note that the key is case-sensitive, so “password” is not the same as “Password.” If your source and target systems do not use the same code page (which might be the case with overseas customers), the key should contain only characters that are the same in both code pages. In other words, ensure the characters used for the key value are contained in the invariant character set, which is a set of characters whose code point assignments don’t change from one EBCDIC code page to another. This set generally includes uppercase letters A–Z, digits 0–9, and the space character.

Another option is using a hexadecimal string for the key. How do you do that? Simple: if you prompt the CRTRPGMOD command, the DBGENCKEY parameter will initially show a 17-character input area. In order to type a hexadecimal string for the key, you have to enter the ampersand character (&) followed by a blank space, and the input field is widened to 25 characters. This can be done repeatedly to increase the field length to 32, 50, 80, 132, 256, and 512 characters. It’s also important to mention that, because this parameter is available only for V7.1 and newer versions of the operating system, the Target Release (TGTRLS) parameter must have a value of V7R1M0 or *CURRENT to specify a debug encryption key.

So now that you have your debug views encrypted, how do you get them decrypted when you need to debug the program? On the STRDBG command, there is a parameter called Decryption Key (DBGENCKEY) in which you can enter the key. Alternatively, you can wait for the debugger to prompt you for the key when an encrypted view is encountered. Since each module can have its own key, and there could be several modules, the debugger caches the keys for the debug session. It will try all the cached keys before it prompts for a key. The cached keys will be cleared when the debug session is over.

When the debugger prompts for the encryption key, you’ll have three tries to enter a valid key. If you fail to do so, the debug view will not be decrypted. However, the module is still debuggable, so setting breakpoints and displaying variables will be possible; you just won’t see the source code. It will behave as if the *STMT keyword (discussed two TechTips ago) was entered in the DBGVIEW parameter when the object (module or bound RPG program) was created.

Naturally, I can’t stress enough that this works only if you don’t ship your sources along with the objects. That would make encrypting the debug views pointless. It’s also important to mention that, even though you can use very long passwords, don’t go overboard with them or you might be forced to recompile the program “back home” and sent it to the target system again.

That’s all for now! The next TechTip will be about the debug process itself, which is a little bit different from the old STRISDB debug. Until then, I’d like to hear from you! Use the Comments section below to share your ideas, experiences and criticisms about this TechTip or even the whole RPG Academy series.