Good news for RPG shops everywhere: IBM gave us a way to protect our code from prying eyes, while keeping all the functionality of the debug views! The code is there, but it’s hidden.

Written by Rafael Victoria-Pereira

As you might have guessed, anyone with access to STRDBG, the command that replaces STRISDB, will also have access to your source code! This gets especially sticky if you run a shop that designs and sells software; you need to secure your source code and can’t let your customers peek inside your programs. Fortunately, IBM included a new parameter in CRTRPGMOD and CRTBNDRPG, which allows you to encrypt your debug views. In other words, now you can ship debuggable code and know that your code is not visible to your customers.

How does it work? The new parameter is called Debug Encryption Key (DBGENCKEY). Entering a value in this parameter will force the debugger to encrypt the debug views. You’ll have to enter the debug encryption key (read: a password) for the views to be decrypted. I’ll explain how in a minute, but first let me go over a few important things about DBGENCKEY’s password. You might be wondering how safe this password is. Well, the debug encryption support uses the Advanced Encryption Standard (AES), a private key-based block cipher encryption methodology, which is accessed via the IBM i Cryptographic Services APIs. Once the debug data is encrypted, it’s inaccessible unless the correct key is provided.

This new parameter takes a 16-byte key value. If you enter a key shorter than that, the system will pad it to 16 bytes with blanks. Note that the key is case-sensitive, so “password” is not the same as “Password.” If your source and target systems do not use the same code page (which might be the case with overseas customers), the key should contain only characters that are the same in both code pages. In other words, ensure the characters used for the key value are contained in the invariant character set, which is a set of characters whose code point assignments don’t change from one EBCDIC code page to another. This set generally includes uppercase letters A–Z, digits 0–9, and the space character.

Another option is using a hexadecimal string for the key. How do you do that? Simple: if you prompt the CRTRPGMOD command, the DBGENCKEY parameter will initially show a 17-character input area. In order to type a hexadecimal string for the key, you have to enter the ampersand character (&) followed by a blank space, and the input field is widened to 25 characters. This can be done repeatedly to increase the field length to 32, 50, 80, 132, 256, and 512 characters. It’s also important to mention that, because this parameter is available only for V7.1 and newer versions of the operating system, the Target Release (TGTRLS) parameter must have a value of V7R1M0 or *CURRENT to specify a debug encryption key.

So now that you have your debug views encrypted, how do you get them decrypted when you need to debug the program? On the STRDBG command, there is a parameter called Decryption Key (DBGENCKEY) in which you can enter the key. Alternatively, you can wait for the debugger to prompt you for the key when an encrypted view is encountered. Since each module can have its own key, and there could be several modules, the debugger caches the keys for the debug session. It will try all the cached keys before it prompts for a key. The cached keys will be cleared when the debug session is over.

When the debugger prompts for the encryption key, you’ll have three tries to enter a valid key. If you fail to do so, the debug view will not be decrypted. However, the module is still debuggable, so setting breakpoints and displaying variables will be possible; you just won’t see the source code. It will behave as if the *STMT keyword (discussed two TechTips ago) was entered in the DBGVIEW parameter when the object (module or bound RPG program) was created.

Naturally, I can’t stress enough that this works only if you don’t ship your sources along with the objects. That would make encrypting the debug views pointless. It’s also important to mention that, even though you can use very long passwords, don’t go overboard with them or you might be forced to recompile the program “back home” and sent it to the target system again.

That’s all for now! The next TechTip will be about the debug process itself, which is a little bit different from the old STRISDB debug. Until then, I’d like to hear from you! Use the Comments section below to share your ideas, experiences and criticisms about this TechTip or even the whole RPG Academy series.

Rafael Victória-Pereira has more than 20 years of IBM i experience as a programmer, analyst, and manager. Over that period, he has been an active voice in the IBM i community, encouraging and helping programmers transition to ILE and free-format RPG. Rafael has written more than 100 technical articles about topics ranging from interfaces (the topic for his first book, Flexible Input, Dazzling Output with IBM i) to modern RPG and SQL in his popular RPG Academy and SQL 101 series on mcpressonline.com and in his books Evolve Your RPG Coding and SQL for IBM i: A Database Modernization Guide. Rafael writes in an easy-to-read, practical style that is highly popular with his audience of IBM technology professionals.

Rafael is the Deputy IT Director - Infrastructures and Services at the Luis Simões Group in Portugal. His areas of expertise include programming in the IBM i native languages (RPG, CL, and DB2 SQL) and in "modern" programming languages, such as Java, C#, and Python, as well as project management and consultancy.

---

MC Press books written by Rafael Victória-Pereira available now on the MC Press Bookstore.

		Evolve Your RPG Coding: Move from OPM to ILE...and Beyond Transition to modern RPG programming with this step-by-step guide through ILE and free-format RPG, SQL, and modernization techniques. List Price $79.95 Now On Sale
		Flexible Input, Dazzling Output with IBM i Uncover easier, more flexible ways to get data into your system, plus some methods for exporting and presenting the vital business data it contains. List Price $79.95 Now On Sale
		SQL for IBM i: A Database Modernization Guide Learn how to use SQL’s capabilities to modernize and enhance your IBM i database. List Price $79.95 Now On Sale