How to protect key in software I need to encrypt/decrypt data from my software by AES, the problem is how to make the AES key secure, there is no HSM, should I hard code the key in my code? It seems that a hacker can read the key data by reverse engineering the software.
If your software needs to decrypt the data and you want to prevent even those with physical access from decrypting without your software, you are basically out of luck. It is impossible to achieve purely in software, since even if a good white-box algorithm existed, an attacker could copy it into their software and be able to decrypt (without directly knowing the key, but who cares).

However, if you are willing to ignore those attacks and only protect the data against those who do not have access to the exact device and its software, you should use device specific keys, not hardcoded ones. That way even if an attacker would extract the key from their device, they would not be able to use that to attack other devices.