1

I am trying to implement a copy protection (or licensing) mechanism for an android app. The app is not distributed through Google Play or other online market and instead it is distributed through media such as CD/DVD. So we cannot employ market based licensing methods.

The app is a learning app for different levels of education. Students purchase the app media and install the app to their devices (an android tablet) over a USB cable. Students have limited access to Internet so we cannot force them to connect to our servers except one time for app activation over school wireless connectivity.

I know that there is no hack proof mechanism for piracy protection specifically for off-line scenarios and the app price is too low as well as target audiences are students without professional knowledge of hacking or cracking, though my client is willing to protect the app somehow as strong as possible.

I think the mechanism must be something like Machine Locking Scheme but I do not know what the best method is.

Any help or suggestion will be appreciated.

Improve this question
4
  • Out of curiosity, why aren't you distributing through a regular store? Traditionally, it's not the "common" end users (those without the necessary ability) you actually have to worry about, it's the bored people who do. These people aren't even necessarily your target audience! Low price and a simple/quick/easy registration process (combined with an app that doesn't react adversely) are your best defense against these people. I'd actually advise against a machine-locking scheme, especially with something like an android tablet, unless you have a simple way to switch legitimate machines.
    – Clockwork-Muse
    Commented Jun 7, 2014 at 10:39
  • Thanks for comment. Actually it is my client requirement. In fact they have been producing and distributing educational materials through CD/DVD for years and now they are willing to find a way of doing so in their old fashion manner for android apps.
    – anonim
    Commented Jun 7, 2014 at 12:03
  • ... there might be a problem with that - some tablets/phones likely don't allow such sideloading without developer accounts. Also, if the device is on contract, they may get it replaced - which would be a major problem if you do device locking. Note that doing it this way would require an unusual install path - you have to tell the OS to install from an untrusted source (look for instructions online), which people are often leery to do, for obvious reasons. It appears the store has built-in licensing, too...
    – Clockwork-Muse
    Commented Jun 7, 2014 at 12:59
  • You could actually buy a professional level CP like a StarForce. They provide protection for DVDs and also allows you to protect Android apps if it was written using C/NDK. StarForce is hard to hack and its not that wide used in Android. Rare copy protections are harder to crack.
    – user61123
    Commented Nov 20, 2014 at 11:27

2 Answers 2

Reset to default
2

Each device has a unique hardware-ID - We will call it HID for readability.

Create an algorithm that takes the HID and generates an unlock-serial-number

Pseudo-code:

Generate_Serial(input = HID)
{
    scramble that HID
    add a secrete value to it
    send the value to costumer
}

Have a sms/phone-calls bot to answer requests coming from your clients devices. Automation of the process is your goal here.

The bot will take the HID and then sends back the unlock-serial-number, which will be used to unlock the app via another on-app algorithm as follow:

Pseudo-code:

Unlock_App(input = unlock-serial-number)
{
    unscramble unlock-serial-number
    remove the HID value
    do you have the secrete value?
    YES : Unlock
    NO : Print Error
}

Think about this as your favorite IM app (WhatsApp, Viber, etc..) verification process.

Note: Be careful storing your secrete value on-app! - you will have to protect it somehow from reverse engineering.

I hope this was helpful!

Improve this answer
2
  • ... If it's present on the client device, it's findable. You'd be better off to do something with a public/private key hash, thus no secret value to find. In fact, doing it in this fashion is likely more noticeable, because of the checks and success/failure. In the case of IM apps, they're usually talking to a server to pass messages, so can simply refuse requests from unregistered accounts. Heck, if you're using something this simple, I'd just dummy out the method call - normally these verifications have to be spread throughout the client code.
    – Clockwork-Muse
    Commented Jun 7, 2014 at 12:17
  • The hardware-ID is not unique, it can be changed if the user has root. And with root, any copy protection is gone: user can dump all contents from your app and load on some other cellphone.
    – ThoriumBR
    Commented Sep 25, 2018 at 20:55
0

Offline DRM? Not likely to work.

If the user copying your code have root enabled on his phone, he can just dump your app with adb, and send to another phone. On that phone he can edit the AndroidID and set it to be the same as the original phone.

Using the Play Store and Google SafetyNet this would be easier.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .