2

I am working on an application that I intend to sell to clients. The clients intend to have several separate installations of the same application on one or more computers. I will be charging them for each separate installation regardless of how many computers they use. My problem is I want to have a unique registration key for each of the installations so that they cannot copy the program from one folder to another without obtaining another license.

So far my only idea is to create a hash of the physical path to the program and the MAC address of the computer. Checking the stored hash with the recalculated hash would tell me if the program had been moved or copied. A big problem is, if the program is stored on a file server and each user access it from a different computer, the path to the exe might not be the same in all cases. Is this a decent solution or are there better ones?

Please try to keep your answers language neutral as I'm writing my application in assembly, not .NET.

3
  • With the detail you've given that sounds OK to me, though you should note that MAC addresses can be changed/spoofed, so I guess it's a risk based on how tech-savvy/desperate your client is. If you trust your clients anyway, why not just use an "honesty" approach where they tell you how many times they have it installed and pay the correct fee?
    – brindy
    Jan 20, 2011 at 13:46
  • Exactly, I trust the client, just don't want to make it too easy for them to side step the contract. The MAC address, in this case, is secure enough. Jan 20, 2011 at 13:49
  • I don't know how tech-savvy your clients are, but you might want to add explicit code to check for VMware and similar VM solutions. Otherwise it's "install once, run anywhere."
    – ChrisV
    Jan 20, 2011 at 16:02

1 Answer 1

1

If you trust your clients that they are not going to reverse engineer your software protection then a good solution would be the following:

1) You ask from your clients the necessary info you mentioned, MAC and Path

2) You can concatenate these 2 info + a long enough secret seed that you will only know (in order to avoid make it easy for them to generate valid hashes that will be used as decryption keys read below..) and generate a valid hash from all this info.

3) Write a function in your application that is called on startup and uses that hash as a key in order to decrypt the rest of the program.

4) Before sending the application for the new license purchased encrypt the code (except ofcourse the necessary parts that are used by the decryption function) with the new key.

So each time, they will have to ask you for a new copy of the application in order to put it to another folder and/or computer. The decryption key that is going to be read by the decryption function by every copy of the application can be stored in registry in a different regkey or in a file.

I know that it looks complicated but this can work. However, don't forget that also this can be cracked, but if they don't intend to do so, then you will have the results you want.

I hope that helped...

2
  • Thanks for the thought out answer. I'm thinking about it a little differently however. I'm going to use the location of the exe (calculated automatically as in the other question) to generate a hash. Then the client will ask for a registration key based on that hash which will be stored locally and verified on startup. It's a little more communication, but I think it will work. Am I really awarding you the accepted answer twice in one day?? Jan 21, 2011 at 12:21
  • I think yeah you just did :O) Your way can work too of course, it's just more easy to bypass. Anyway if you trust them go for it :O) Jan 21, 2011 at 14:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.