Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have seen them plenty of times, with many different types of software, but the one thing I have always wondered, is how software keygens know what key to generate. I know the basic principle of it: the keygen looks somewhere in the software installation files and creates a key that matches some encrypted file which allows the program to work. But I wanted to know how they do that, and how to prevent it. This is really a multiple part question.

  1. How does the key-system work?
    • How do programmers usually create software that works based on a key. I am an intermediate programmer, but I never learned much of the security/anti-piracy aspect of it. How do they create and/or recognize the keys to allow the software to start working?
  2. Where does it usually look to find this "encrypted file"?

    • Is it in a physical file on the computer, or an of-site database that it calls?
  3. What do the companies do to encrypt that file?

    • I would emagine that the key must be stored in more than just plaintext, what do they do to keep it encrypted?
  4. What method is the keygen using to create the key?
    • I have played around a llitle with some password-cracker software such as "cain & able" and I have noticed, that with some of the password-cracking methods, such as brute-force and dictionary, it gives me ETAs in years, however keygens seem to create keys instantly. Are they using different methods entirely?
  5. What measures can companies take to prevent the use of keygens in pirated software?
    • I am starting to write my own software to be distributed, I was wondering what existing, relitivly easy methods can I use to prevent
share|improve this question
    
Be warned that this sort of algorithm is patented. It is highly likely that you have to buy a license if you want to use it and haven't done your homework to circumvent the patents. –  jippie Apr 1 '12 at 16:46
    
which algorithm are you referring to? –  Ephraim Apr 1 '12 at 17:47
    
Don't know exactly, just remember reading a handful articles couple of months ago about several companies having to license a patent for unlocking their software or certain features of it. One of those companies was Microsoft. I'd have to DuckDuckGo for details. –  jippie Apr 2 '12 at 6:59
1  
@jippie - Post a source. You don't even know what algorithm Ephraim is talking about. Besides he is clearly over thinking this problem. Key generators are able to generate a key instantly because they were able to figure out what algorithm the program uses. This is done either by trial and error or through plain experence, in the end the key is based on information passed into the alogorithm. –  Ramhound Apr 3 '12 at 11:52
    
If you use digital signatures, key-gens are impossible (cracks on the other hand are still possible). Unfortunately most signature algorithms generate rather large signatures. –  CodesInChaos Jan 24 at 11:01

4 Answers 4

up vote 5 down vote accepted

How does the key-system work?

Well it depends there are many implementations. One of them was discussed in stackoverflow:

Assuming you don't want to do a special build for each user, then:

  • Generate yourself a secret key for the product
  • Take the user's name
  • Concatentate the users name and the secret key and hash with (for example) SHA1
  • Unpack the SHA1 hash as an alphanumeric string. This is the individual user's "Product Key"
  • Within the program, do the same hash, and compare with the product key. If equal, OK.

Note: every key scheme can be cracked. That's why a lot of tools use online validation.

Where does it usually look to find this "encrypted file"?

There usually is no encrypted file when using the previous method. There might be other methods to generate keys with another algorithm, but they never store all keys in the program.

What do the companies do to encrypt that file?

Well if you are referring to storing the key the user typed in your system, then sometimes it's saved plaintext in a config file. Sometimes they use symetric (like AES) encryption with a hardcoded key to encrypt this file.

What method is the keygen using to create the key?

Because there are people that can figure out the scheme the program uses and just implement it in their own keygen.

What measures can companies take to prevent the use of keygens in pirated software?

Online activation, but the harder you make it for the customer to use the software the less likely you they will buy it. In the end there isn't a single piece of software that is piracy-proof. If there was, companies like Adobe and Microsoft would be hiring you instantly.

share|improve this answer
    
Isn't Microsoft's online activation considered piracy-proof? The publickey encryption is unbreakable isn't it? –  Pacerier Nov 13 at 18:58

How does the key-system work?

In most common form if (some-complex-or-not conditions-here) then (OK). Complexity of checked condition limited only by your fantasy

Where does it usually look to find this "encrypted file"?

There are not any common patterns, where and how store and read this information. It can be file and not a file at all (registry key, for example, in case of Windows)

What do the companies do to encrypt that file?

Usual practive - never store as plain-text, use irreversible methods of transforming before storing, but - with key activation even plain-text key-storage may be bullet-proof: stolen key, once activated, will not work from second registration (abusable and hackable method, but may work to some degree)

What method is the keygen using to create the key?

Reverse-engineered method of checking validity helps in reverse-engineering algorithm of creating key-data

What measures can companies take to prevent the use of keygens in pirated software?

Non-technically - reasonable price for products. In this case keygens will (may) appear anyway, but it will be more "just for fun" game for crack-teams, than requested (and used with direct impact) by the mass-consumer product.

Technically - preventing from running under debugger, combined with encrypted code in file (with in-memory decryption, possible - multi-layer for some sensitive parts), chains of memory manipulations, online verification of keys in external storage (see previous methods, which are applicable separately to checker also)...

share|improve this answer

Serial numbers for computer software have a specific pattern, which allows the installer or application to detect whether or not it is a legit key. A very simple example would be that every serial number has exactly three occurances of the number 5 in it - so 1932-1253-2319-5512 would be a working serial number. In a real-life scenario the relationships between the numbers would of course be more complicated.

The shipped software contains an algorithm that checks whether or not a serial is valid. The software creator has a piece of software that allows him to create serial numbers for the product.

To create a keygen, a cracker group (people specialized in breaking copy protection schemes) analyze the program executable to find the part that checks the serial. They then reconstruct the algorithm to create the serials based on the checking code. The finished keygen is an app applying the algorithm to create a serial number.

Sometimes keygens do not really contain the algorithm, but rather a list of valid serial numbers, of which one is selected at random.

The keygen for Windows xp in the later service packs was more complicated, because Microsoft checked not only whether a key was valid, but also whether it had been sold with a copy and was not already in use on another computer. The keygen sent mass requests to the Microsoft server to check whether or not it was a working key.

share|improve this answer

Well first of all I'd suggest you to stop seeing those keygen files, as they are hacked piece of softwares (mostly/sometimes) accompanied with some other non-harmful looking image/nfo/lnk files which in full capacity of the hackers/crackers intentions could be crafted especially to infect your machine itself.

You might have heard of img/lnk/other files infecting boxes just when Explorer tries to access it. Then there are keygens being binary themselves which are supposed to execute and perform any stuff on your box, right.

Now, for your Queries...

You gotta understand, there is no global specific file/memory-location/etc thing to go for.

Designing a keygen for software has two main basic ways:

  • Debugging the original Software's Licensing Action using some advanced process debugger () to look for memory locations interacted by the application to store/match the key. Then try to work your way around it. Need to pick up good Assembly Language skills to be awesome at these.
  • Reverse Engineering the application itself to find out the method involved and then act accordingly.
share|improve this answer
1  
"they are hacked piece of softwares accompanied with some other non-harmful looking image/nfo/lnk files" - just terrible level of misinterpretation and disinformation about reality –  Lazy Badger Apr 2 '12 at 11:39
    
@LazyBadger - Often times they are exactly that. Check out YouTube on World of Warcraft Game Time Code Generators. Every single one of them is malicious. –  Ramhound Apr 3 '12 at 11:57
1  
This is the excessive synthesis ("keygens are...", without an exclusions or at least doubts) of the particular case (WOW, addressed to among dumb sad users and other such lemmings). And - both statement and evidential materials: YouTube - can not be taken as the only proof –  Lazy Badger Apr 3 '12 at 12:50
    
@LazyBadger - I don't disagree. Clearly these files are written by people that have different standards then most of society. So writtng real software to break the copy-protection of some program or creating malware often times is only a few steps in one direction or another of that "line" –  Ramhound Apr 12 '12 at 17:08
    
@LazyBadger first, that line was totally in regard of the way Ephraim said he sees keygens plenty of times with different s/w..... just a simple advise for him/her to stay secure ~~~ AND second, mainly keygens are provided to bypass standard Registration Cycle..... in general, I can say it sounds like Piracy than some minimal specific requirements –  AbhishekKr Apr 19 '12 at 7:40

protected by Lucas Kauffman Jan 24 at 16:39

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.