Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I am developing stand-alone software in BDS 2006. I want to provide a trial version for 6 months -- the user can use it for just 6 months, but no more on a particular system.

I have handled most cases but I do not know how to handle some other cases including:

1. On formatting a pc

This is because I am saving the encrypted data (no. of tries,and other releted info) in a file and in the registry. On format these will be lost so if the user uses software for 6 months and formats the pc and reinstalls again he will get to use the software for another 6 months.

2. Stopping the time so that to use Trial Version software forever without Expiration.

There are some s/w available which will stop the clock to use the software forever. I found solution to this by tracking the number of tries. If the number of tries exceeds a limit it will not allow the application to run, but I still want to prevent the user from resetting the date.

EDIT1

If I get the hardware details while downloading and saving it in database and checking on every download whether I have seen that h/w configuration to deny access.

In this case the user can download from other systems (so obviously h/w details will not match and he will be able to download and reinstall on the system).

Does anyone have any ideas?

share|improve this question
1  
For 2) one common trick is to check the changed date of certain system files. This prevents the user from changing the date just before he starts your program to trick it. But it's still easy to defeat. – CodesInChaos Apr 23 '12 at 12:48
1  
Is a solution that involves your product dialing home to check if it is still authorised to run possible? – Graham Hill Apr 23 '12 at 12:51
3  
Most copy protection systems like this can be defeated by changing the system's date. An easy way to prevent this is to verify the date from an outside source and compare it. This would require the system have access to the internet. – Ramhound Apr 23 '12 at 14:45
1  
And what do you do in a network error, not allow use, how do you stop that comparison being patched out so it doesn't even attempt to check? – ewanm89 Apr 23 '12 at 20:24
1  
@Ramhound modifying any file is trivial, finding what bits to modify to what is a bit harder, even with decrypting unpackers it's easily possible. There are those around that do it quite frequently. – ewanm89 Apr 27 '12 at 14:01
show 3 more comments

1 Answer

up vote 1 down vote

I am saving the encrypted data (no. of tries,and other releted info) in a file and in the registry.

If your users are tech savvy, you won't be able to squirrel away information in the registry without them noticing. They can simply roll back to an earlier version of the registry entry.

Microsoft tried device fingerprinting by storing device characteristics in wpa.dbl. I haven't managed a Windows machine in a while, so I don't know how well it works, if it's used on Windows 7, or whether that file is readable by other processes. I do recall that they had to do a bunch of work to make the device fingerprint robust against minor changes to devices.

In its simplest form, activation (on a Net-connected PC) is a matter of sending a unique code from your PC to a server at Microsoft. That server then returns an activation code, which allows you to keep using the operating system. The unique code belongs to your computer alone and acts as a flag to Microsoft if your copy shows up on another PC or you significantly alter some part of your PC. Fully Licensed, a software-licensing technology firm in Germany, figured out how the process works and shared the details with the world. Activation starts with an Installation ID--a packet of encrypted data containing the 25-character XP serial number combined with hardware information--which is sent to Microsoft over the Internet. While you have the option to register your copy of XP (that is, send personal information to Microsoft separately from activation) during the activation process, Fully Licensed verified that no personal information is gathered, stored, considered, or transmitted during activation. The registration process, on the other hand, does collect personal data, such as your name, address, and e-mail address, but as a separate process that is not required for activation. If your PC isn't connected to the Internet when you install or activate XP, the OS presents the Installation ID on your screen, and you must read it over the phone to a Microsoft customer service person. (A special program, called msoobe.exe, creates the ID.) At Microsoft's activation server, a program checks the ID to verify that the data arrived intact and that the product ID has not been used with a different hardware fingerprint (that is, another computer). XP stores the system fingerprint on your PC in a file named wpa.dbl. From now on, whenever you reinstall that copy of Windows, the Microsoft server compares the original system fingerprint and OS serial number created at first activation with the current system fingerprint for that product serial number.

If the product ID and hardware fingerprint from a new installation are not significantly different from a previous activation, the activation server generates a 44-digit Confirmation ID code and sends it back to your PC.

It looks like there are other commercially available device fingerprinting solutions on the market.

So if you can derive a device fingerprint or piggyback off the MS activation one, you could encrypt it with a private key on a server, and have your software check it with a public key embedded in the software so that the machine need not be reliably connected to the network for your software to start.

None of this helps though if the Windows install is inside a virtual machine where devices are virtualized.

Alternatively you could try non-hardware fingerprints. I vaguely remember some Berkeley folk coming up with a way to identify personal machines even when Tor was running by looking at the fonts installed. Many Windows programs carry fonts, fonts are rarely uninstalled, and fonts are available to browsers, so by looking at particular font versions they could come up with a reasonably reliable fingerprint. That might survive reimaging, assuming the user of your software wants to keep running other programs on the same machine.

http://panopticlick.eff.org/browser-uniqueness.pdf

In general, plugins and fonts are the most identifying metrics...

We tested the hypothesis that font orders are informative, by checking to see if any returning, cookie-accepting users had font lists whose order had changed.

Just keep in mind that sending this information to a server, even in digest form, might be something you need to seek user consent for ahead of time.

share|improve this answer
One might also point out that even with the entire system's framework at Microsoft's control, they have been unable to solve the "piracy" problem, only reduce it to the point where most people don't feel its worth it. – Ramhound Apr 27 '12 at 12:25
@Ramhound, yep. If someone controls the hardware or virtual hardware, then they control what software sees and what software does. The best you can do is make it more expensive to buy your software than to pirate it. – Mike Samuel Apr 27 '12 at 14:54
Thanks @Mike Samuel. i found your answer regarding fonts and plugins very interesting..that means,after format the fonts in folder font remains ..? if i place a text file in the font folder it won't get deleted right?and what if user deletes the font folder itself before format? – pradnya Apr 30 '12 at 5:54
@pradnya, formatting a drive deletes everything. The thing about fonts is different machines tend to have different fonts, and applications can enumerate the fonts on the system which lets them fingerprint a machine. – Mike Samuel Apr 30 '12 at 5:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.