I'm curious about how time-limited (e.g. 30-day trial) software works.

I know how serial keys are generated and designed, but the time-limiting part is more complicated to understand, because it is not simple to ensure that the system's time is correct (e.g. user change it manually).

Full or "perfect" protection is impossible, but I'm curious to see some proof-of-concept or any suggestions.

I guess that used a trusted NTP server is an early solution, but it's not perfect (required Internet connection).

From my own experience, I have seen software with very robust time-limiting mechanism (impossible to cheat, even if we shut down network, change time manually or so)!

closed as unclear what you're asking by TildalWave, Adi, NULLZ, Iszi, Scott Pack Oct 3 '13 at 20:08

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    @LucasKauffman If DRM is off-topic, why is there a DRM tag with many questions? I think this is a valid IT Security question. – Matrix Oct 2 '13 at 10:38
  • @LucasKauffman How is DRM off-topic? It's a security measure. Security measures are on-topic whether they work or not — dissecting how efficient they are is a big part of what we do here. – Gilles Oct 2 '13 at 12:43
  • I don't care much either way concerning the on/off topicness of DRM. But IMO 1) @Matrix 16 isn't "many". 2) DRM is only obscurity, not security. – CodesInChaos Oct 2 '13 at 14:50

There is no cryptography in there. It is all a matter of state. The application can access the system time, also the hardware clock (that's the clock with a battery which keeps time when the computer is off). The application can also look at the modification dates of various files to try to detect foul play with the system clock; and it can measure elapsed time while it runs and accumulate it (in one of its files).

IF you install the software in a virtual machine, then snapshot the whole VM, and, later on, restore that snapshot completely, taking care to set back the (virtual) hardware clock back to the date of the snapshot and to deactivate the network, then you will be able to fool the time limit. The economic efficiency of this kind of time limit relies on the idea that VM snapshots and clock games are too cumbersome for most customers to use them on a regular basis.

  • Does hardware clock keeps you safe in this scenario: When trial ends format the system, manipulate the system time, then install the software again. – Kerim Oguzcan Yenidunya Oct 2 '13 at 11:29
  • 1
    For the time-limit to resist a format, it must store some state information somewhere else. This can be on a server (contacted through network) or maybe in some format-resistant piece of hardware (which would be quite "invasive"). It is technically feasible to store data in the first sectors of a disk, which resists formatting of partitions, but not the complete wipe of a disk (which takes hours and is not recommended for SSD, therefore rarely done). – Tom Leek Oct 2 '13 at 11:40
  • @TomLeek An unusual solution might be to construct some of the (product-unique) core business logic circuits from proof-of-work equations; but with an off-site product server having a PoW shortcut. This way the program can run fully without an internet connection but will be slower (perhaps much slower) than if it routinely authenticates against a product server. This means less business logic needs to be run "Diablo 3 style" on a remote server, while achieving a scalable disincentive to exceeding the re-authentication objectives such as trial time-limits. – LateralFractal Oct 3 '13 at 2:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.