Interestingly even Adobe doesn't know what it is, the detection software was supplied to them as a binary. I messed around with it in a similar way to the author out of sheer curiosity and ended up completely baffled by the whole thing, even trying to eliminate parts that aren't triggers is impossible by my measure. I should make it clear I have no desire whatsoever to thwart the system (as others point out, simply using different software does that), but the methods it is using seem to completely defy all of the fingerprinting systems I'm aware of and is therefor incredibly interesting as a result.
Doesn't AFL rely on being able to compile the application with it's hooks? It's been a long time since I've messed with Photoshop, but it's a complete mess of random dead code inside (even includes poems about a dead dog believe it or not), chances are you're looking for a completely obfuscated bunch of assembly in the hundred plus megabyte binary. I love Hopper, but not that much.
According to wikipedia [0], the code that recognizes money was given to Adobe as a binary blob. So no go even if you have acces to the Photoshop source code.
[0] http://en.m.wikipedia.org/wiki/EURion_constellation
Yes, you're right. I'm admittedly not at all an expert on this type of thing, but surely some randomised testing, starting from a real banknote and making small mutations, would be doable.
Oh sure, you could make a quick imagemagick script to make random variations and get a pass/fail with AppleScript, or even do some exploring with a debugger while opening one. Main barrier is motivation, I have no desire to counterfeit money (and who would use PhotoShop for that anyway), so I decided to let that rest.
Which means this entire thing can be defeated by Software Cracking 101 - look for the error message that gets triggered when you do the thing you're trying to change, work backwards, and change the JE/JNE assembly instruction or NOP it out.
Somehow I think it's not that simple, but also somehow I think that real counterfeiters will not be deterred by this manner of weak DRM.
It's not meant to deter "real" (professional) counterfeiters -- this, along with the copy machine code, is meant to stop casual counterfeiting. Which is a good thing, as there are quite a number of people who are normally honest, yet could be overcome with a strong enough temptation (getting a free $20 bill), if it appears easy enough.
And of course they will get caught and have their lives ruined. So by making the act of falling into the temptation a bit harder, you are keeping more honest people honest.
I've run into this a couple of times over the last 10 oer so years when scanning documents. Rarely, a document will trigger a false-positive on a network scanner (or printer-scanner-copier) and I have had to manipulate the document by trial/error to trick the device into scanning it properly.
A few months ago, one of our Konica all-in-one units flat out refused to scan a customer invoice, claiming that it's illegal to scan banknotes.
In the Netherlands there is nothing illegal about copying money; what is illegal is spending it (or having it spent by someone else) as real money on purpose.
Idea behind that, I think, is that there is a gradual scale from real money to good counterfeit to lousy counterfeit to images of money printed in a journal or even on a coffee mug to basically whatever can be printed.
Though from what I understand, it's illegal to make copies (electronic or otherwise) of banknotes in both Scotland and the USA.
When I was recently in the US, I bought a novelty pad of oversized $100 bills from the Bureau of Engraving and Printing gift shop. It's obvious they're not real but they have all the hallmarks of a real bill - a serial number, same print, series number and even the phrase "THIS NOTE IS LEGAL TENDER FOR ALL DEBTS, PUBLIC AND PRIVATE". Even a fake (monochrome, scanned and non-reactive) security strip.
My fiancée bought a similar pad of oversized novelty £20 notes here a few years ago which were littered with the word "specimen" and small print stating that they were for novelty use only. Additionally, many government websites with images of banknotes here have the word "specimen" printed quite prominently on their images (except where the image is a photograph of a banknote in some setting, not stand-alone).
In the US you are allowed to create fake banknotes but there are some restrictions on how closely they can resemble real ones. According to the Counterfeit Detection Act of 1992, a reproduced bill must be: a.) either less than 75% or more than 150% the size of a real bill, b.) one-sided, and c.) made with only one color
