Find out how your software really breaks.
We assess authorised Windows binaries from an attacker’s perspective, then deliver an evidence-based report of the weaknesses we demonstrate within the agreed scope.
Reverse engineering with evidence you can inspect.
We examine software protections and demonstrate the weaknesses we reach within an agreed scope. A successful bypass is not guaranteed. Windows binaries only. No macOS, Linux, mobile or web projects.
Crack-resistance audit
We assess the protections in your authorised Windows build. You receive the agreed analysis and report, with a working proof of concept for each weakness demonstrated within scope. If none is demonstrated, we report the work performed and its limitations.
Something else?
Got a reverse engineering job that isn't a standard audit? Tell us what you're after and we'll say honestly whether it's something we can help with.
Permission and scope come first.
Start with an enquiry. Before any analysis, we verify ownership or owner permission and agree a limited free first look in writing. You receive a firm quote and a personalised agreement to read and accept by email reply or digital signature before payment. No source code is required for the audit.
Initial analysis
After authority is verified and written permission is given, we take a limited first look and quote for the agreed scope. This part is free.
Full analysis
You review the personalised agreement and accept by email reply or digital signature. We confirm it, issue payment instructions and start the commissioned analysis after full payment and receipt of the required files.
Attack and prove it
Within the written authorisation, we investigate potential weaknesses and provide a working proof of concept for each one we demonstrate.
The full report
You receive the agreed report, demonstrated findings, evidence and limitations. The audit informs your decisions; it does not itself harden the software. Confidential throughout; an NDA can be agreed in advance.
The kit we reach for
We use the same tools a serious attacker would. The list grows when a job needs something else.
Only with verified authority and written permission.
SboxLock carries out authorised assessments for software owners and their representatives. We do not accept requests to bypass protections in software that the customer has no authority to have assessed.
Sending a binary is not authorisation. We verify ownership or written owner permission before any analysis, obtain written approval for the limited first look, and require a separate written authorisation for the full audit. The scope identifies the exact build, permitted actions and exclusions. Permission for a binary does not extend to third-party servers or infrastructure.
You come to us first
Start with a high-level description of the Windows software and the professional purpose of the assessment. An enquiry is not an order or permission to test.
You name the software
Identify the exact build and concerns. We agree how to transfer files and what the free first look may include before any analysis.
You prove it's yours
Show that you own the software or have the owner’s authority. The personalised document then records permission for the commissioned work; payment does not replace it.
We price each job after we've seen it.
We issue a firm quote after the authorised free first look. You pay for the agreed analysis and deliverables, not for a guaranteed crack or a minimum number of findings. The full fee is due before commissioned work begins.
Crack-resistance audit
- We attack your Windows build
- A proof of concept for each demonstrated weakness
- A full report you can act on
Something else?
- Another RE job, not an audit
- Get in touch
- We'll say if it's for us
Before paying, you receive and accept the personalised agreement by email reply or digital signature and authorisation. See how payment works and download the public agreement preview.
Questions we get a lot.
Who are you?
We are a small team working on Windows binary reverse engineering. Your contract and invoice are issued by the self-employed provider behind SboxLock in Portugal. SboxLock is the name of the service, not a separate company.
How soon can you start?
We can take on only a small number of jobs at a time. We usually reply within one business day and agree the start date and delivery timetable in your Order Summary. Commissioned work starts after the accepted agreement is confirmed, the full payment is received and the required files and permissions are in place.
Can I see an example report?
Yes. Ask through the contact form for the sample audit of a demo target we built and assessed ourselves. It shows the report format without disclosing client work.
Do you need my source code?
No source code is required for the audit. We work from the compiled Windows build. A source extract is only one optional way to prove ownership; other verification methods are available.
What do I need to send to get a quote?
Start with a high-level description. We then agree a private transfer channel, verify your authority and obtain written permission for a limited free first look. Send the unsigned Windows build with the DLLs, data, configuration or installer it needs, without a licence key or activation. Sending files alone does not authorise analysis.
What is required before the full audit?
Ownership or owner permission must be verified, and we need the linker .map for the exact build. You receive a personalised Service Agreement and Software Analysis Authorisation, including the quote, scope and deliverables. Review it and accept by replying to our email with the requested declarations or returning a digitally signed PDF. After we confirm acceptance, we issue the invoice and payment instructions. Full payment is required before work starts.
How much does it cost?
Each job has a firm quote after the authorised free first look. The price depends on the build, scope and work involved. Automated findings may require less work than a deeper manual audit. No charge is due for the first look or quote, and we do not add extra work or charges without written agreement.
What if you find no weakness?
You pay for the agreed analysis and report, not a successful crack or a minimum number of findings. If no weakness is demonstrated, the report describes the work performed and its limitations. It is not a certificate that the software is secure or uncrackable.
Does the audit make my software harder to crack?
The audit identifies weaknesses demonstrated within scope and gives you evidence to inform your decisions. It does not itself harden the software. Fixes, implementation and retesting require an express agreement if they are to be included.
Which platforms and customers do you cover?
Windows binaries only, for businesses and people buying for their trade or profession, including self-employed developers. We do not take macOS, Linux, mobile or web projects, or consumer orders through this service.
How do payment and refunds work?
After the personalised agreement is accepted and confirmed, we send an invoice and private bank-transfer or cryptocurrency instructions. The full fee is due before commissioned work begins. We do not offer discretionary change-of-mind refunds, but legal remedies for non-performance or other valid grounds remain available. Read the payment page and terms before committing.
What happens to my files after the job?
Working binaries are kept only while needed for the agreed work and follow-up, then deleted, or deleted on request. Necessary agreement, invoice and dispute records may be retained for legal purposes. An NDA can be agreed before sharing files. See the privacy notice.
Do you use AI?
We use local AI on our own machines for routine tasks and research. Your binary and code are not uploaded to cloud AI services. We remain responsible for the analysis and findings.
How do I reach you?
Use the contact form or email contact@sboxlock.com. For sensitive material, agree a transfer method first; the contact page also lists a PGP key and qTox details. There is no phone line and we do not use social media for client communications.
Do you use cookies or track visitors?
We do not run advertising or audience analytics. Hosting logs and the contact form process technical data for delivery, security and spam prevention; Cloudflare Turnstile processes browser and network signals. See the privacy notice for details.
Tell us what you ship, and what you're worried about.
A Windows desktop application, SDK, library or game: tell us what you want assessed and why. We agree the scope and permission before analysing it, and the deliverables and fee before you commit.
Get in touch