Sorry your browser is not supported!

You are using an outdated browser that does not support modern web technologies, in order to use this site please update to a new browser.

Browsers supported include Chrome, FireFox, Safari, Opera, Internet Explorer 10+ or Microsoft Edge.

DarkBASIC Professional Discussion / Copy protection using unlock keys

Author
Message
Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 4th Apr 2011 01:23
I'm working on a way to add copy protection to my DBPro software that involves the use of unlock keys.

I need a way for my program to uniquely identify the computer it's running on so that I can generate an unlock code that will only work on that computer.

To reduce this problem to its bare basics, I need a way to generate a number that will always be the same on any given computer, and will (with a reasonable degree of certainty) be different between two separate computers. I can employ a mathematical formula to calculate an unlock key using this number as the variable.

If the generated number is truly unique that would be excellent security, but in practice it doesn't have to be absolutely unique. It just has to be uncommon enough that keysharing becomes pointless: you'd have to try a thousand codes to get one that worked, and it's easier to just send the developer five bucks to get your own.

I thought about pulling the Windows OEM code from the registry (the one that Microsoft uses for what I'm trying to do, to stop people pirating Windows), reducing it to a number by mathematical formula, and using that as my unique identifier. There's a couple of problems with that method though. Not all versions of Windows use keys at all, and even the ones that do have codes that are not truly unique these days on account of the keysharing I'm trying to avoid.

Does anyone know of a way to pull such a unique number from a computer at DBPro code level? Or a better method of protecting software than unlock keys? I can't use "Put the original CD int he drive" as my software is distributed electronically.

Any ideas?
Kevin Picone
21
Years of Service
User Offline
Joined: 27th Aug 2002
Location: Australia
Posted: 4th Apr 2011 02:37
The cpu / hard drives (and probably most other devices) have serial numbers which you can query.

Which presents the problem of how strict the system id matching is. If it's 100%, then the user couldn't change any of the key system components and have it the test still work. So some type of greater than say 60/70% match might be better. Would surely cut down on the number of support emails

Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 4th Apr 2011 05:08
Perhaps it's a once off, though, so that once it's activated it will stay activated.

That will allow the hardware to change but will present the problem of people then distributing unlocked versions.

Perhaps a way to detect if the program is not on the same hard drive it was originally installed to? Maybe by putting a hidden file somewhere else, somewhere unexpected and checking for its presence? That could be easily cracked if the secret file was discovered though. Just throwing ideas around... perhaps there's some other way to determine if the software has been "copied" rather than "installed"?
Kevin Picone
21
Years of Service
User Offline
Joined: 27th Aug 2002
Location: Australia
Posted: 4th Apr 2011 06:36
Quote: "Perhaps a way to detect if the program is not on the same hard drive it was originally installed to?"


You might as well use the drives serial data and encrypt the program data to the drive with a key based upon the HD serial. Which can circumvented also (by faking a constant serial), but you know.

Lost in Thought
20
Years of Service
User Offline
Joined: 4th Feb 2004
Location: U.S.A. : Douglas, Georgia
Posted: 4th Apr 2011 08:26
Small time sharing isn't going to kill your sales a whole lot. Just give them a key tied to the customer's name in some way. When they avtivate it you just keep track. Give them say 3 activations before they have to email you like action 3d reducer does. Action 3d reducer also ties theirs in with a timestamp so you can't copy the activation files to another computer (or even back them up for yourself sadly though).

Quel
15
Years of Service
User Offline
Joined: 13th Mar 2009
Location:
Posted: 4th Apr 2011 10:15
I hate programs to have licenses for a specific machine.

Even had one which expires if you reinstall the Windows 3 times.

Just place a random generated number, which still follows some rules hard to figure out, hide it well in there so it cannot be hacked. Then the user would need to activate online. This is not a big deal nowadays finally, everybody has some kind of internet connection all around the world. ESPECIALLY if they got your program online...

Your program connects to a basic server, where there is a database containing all the available serial numbers. If one is already registered, the new ones won't be accepted, and your program not just tells the user he can't activate, but totally disables the program from running again. And let's you know you've got yourself the first illegal try.
Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 5th Apr 2011 07:02 Edited at: 5th Apr 2011 07:04
Quel, the system you suggest means one user can install the program once, and that's it. It not only prevents the user from installing the software on a second machine, it also prevents them from reinstalling it on the same machine even if its hardware hasn't been changed. It's therefore even more restrictive than the hardware checksum system I was considering.

I'm trying to avoid requiring my users to have an internet connection to unlock the software. This disqualifies the "3 registrations only" system as well as any system involving the use of an authentication server. I need a system in which the user inputs a code, places a file, or something along those lines, and the program can figure out all by itself whether or not it's valid. There must be a way for the program to figure out whether the code has been used before, or to tie the code to a particular user in such a way as to be difficult to duplicate to another user.

Hasn't anybody attempted basic copy protection before? Surely someone has some ideas.
Grog Grueslayer
Valued Member
18
Years of Service
User Offline
Joined: 30th May 2005
Playing: Green Hell
Posted: 5th Apr 2011 08:58 Edited at: 5th Apr 2011 09:02
We went over this a bit ago. In the following thread I posted code to make an authentication key using the users name.

http://forum.thegamecreators.com/?m=forum_view&t=183004&b=1

You can use that to generate the authentication key and place it into the registry of the computer it's installed on. And check that before the program starts to make sure it's registered. You can use the registry to pull the productid of windows too or a program like Keyfinder.

Lost in Thought
20
Years of Service
User Offline
Joined: 4th Feb 2004
Location: U.S.A. : Douglas, Georgia
Posted: 5th Apr 2011 14:00
"I'm trying to avoid requiring my users to have an internet connection to unlock the software. This disqualifies the "3 registrations only" system as well as any system involving the use of an authentication server. I need a system in which the user inputs a code, places a file, or something along those lines, and the program can figure out all by itself whether or not it's valid. There must be a way for the program to figure out whether the code has been used before, or to tie the code to a particular user in such a way as to be difficult to duplicate to another user."

If you don't use the internet then it wull be very simple to bypass anything you do. How will you tie the machine to the original exe? Say I download your program and make 100 copies before installing or using it. I can then install the 100 copies on 100 machines no matter what you do. I can see no way without the internet.

Grog Grueslayer
Valued Member
18
Years of Service
User Offline
Joined: 30th May 2005
Playing: Green Hell
Posted: 6th Apr 2011 00:36
There's no way to link it to the users system without the internet unless you tell them they have to physically mail their computers stats (made by a program you make). You take something like the windows key and their user name or address to create a key that will only work on their system.

Most of the time when we buy games the key is with the CD so there's really no linking to a specific system at all for the majority of industry... unless it has online registration.

A r e n a s
15
Years of Service
User Offline
Joined: 9th Jun 2008
Location:
Posted: 6th Apr 2011 09:28
What would be wrong with giving a key and having it link to an online SQL database of keys, check valid keys and active/non active and then allow the program to run accordingly. If the program is being distributed electronically then they should have internet connection. You could have it check validity of the key every use and given them 5 uses of no network being detected before they need to connect again to check it is valid. This would mean people without network connection constantly, would still be able to buy your product.

Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 6th Apr 2011 22:07 Edited at: 6th Apr 2011 22:12
Hello again.

Quote: "How will you tie the machine to the original exe? Say I download your program and make 100 copies before installing or using it. I can then install the 100 copies on 100 machines no matter what you do. I can see no way without the internet."

By issuing a key derived from some sort of hardware checksum that is submitted with the request for a key. My original question related to how I might obtain such a checksum, but it doesn't seem to be possible in DBPro.

Quote: "Most of the time when we buy games the key is with the CD so thre's really no linking to a specific system at all for the majority of industry"

This is true. But then again, piracy is rampant for the majority of industry.

Quote: "...unless it has online registration."

Indeed. I acknowledge that this type of system is very strong protection, but it's inconvenient for my purposes.

It's obviously very easy to secure against the majority of piracy using online authentication. It's a simple matter to set up such a system and I'm sure I'd be online and running with little more than a day's work. There's certainly nothing wrong with this method.

However, my very specific circumstances require that, even though the internet connection is certainly there (as the software is distributed electronically, ie, downloaded from the internet), I don't want to use an internet connection in the actual authentication process. I don't want to turn this thread into a debate over why, I just want an alternative.

Using keys derived from names is a moderately acceptable method, but it's just as easy to distribute names with keys as keys alone, making the name pointless. Keys alone would do just as good a job.

Thanks anyway for all the comments about online systems, but I just can't use suggestions that don't meet the requirements I have. I need as secure an alternative as possible, and I was hoping a brainstorm might turn up something better than the standard CD-Key system.
Grog Grueslayer
Valued Member
18
Years of Service
User Offline
Joined: 30th May 2005
Playing: Green Hell
Posted: 6th Apr 2011 23:11 Edited at: 6th Apr 2011 23:15
Quote: "By issuing a key derived from some sort of hardware checksum that is submitted with the request for a key. My original question related to how I might obtain such a checksum, but it doesn't seem to be possible in DBPro."


Yes it is possible. Without going into the registry you can create a key using the users hardware. All Darkbasic programs require DirectX to run so you can bet that the computer running your program has DirectX so we can use DXDiag.exe to get some hardware stats.

The first lines of a file made with DXDiag.exe are like this (from my computer):


If you extract the machine name, system model, and processor that's enough to make a key that requires this machine to run. With the machine name added only this computer should produce the specific key even if a computer with exactly the same hardware is used it will not have exactly the same machine name. Using the code I posted in the other thread instead of getting the user name we use those instead.

This requires IanMs Matrix 1 Utilities Plugin:


Attached is what I get from running the above code.

Attachments

Login to view attachments
Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 7th Apr 2011 11:38
Excellent Grog, this looks like precisely what I was after. I'll have a closer look at this code after I get home from work.
Lost in Thought
20
Years of Service
User Offline
Joined: 4th Feb 2004
Location: U.S.A. : Douglas, Georgia
Posted: 7th Apr 2011 12:30
I still can't see how that helps if you are using your exe to do the query. But I hope I'm wrong and wish you luck anyways. Happy coding I'd be glad to test and see how easy it is to pirate though. I'm thinking pretty easy no matter what you do without the internet and even then only the timestamp thing has been hard for me to find a way around. I researched this alot when thinking about selling my game before dropping DBP.

Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 7th Apr 2011 23:29
If you have to do anything more than just zip up all the files and dump them on another machine then most people either won't bother or won't figure it out. I'm not concerned about the 10% of computer users who know how to break simple copy protection because there's no way to defeat them anyway; I just want to make piracy as much of a hassle for the other 90% as possible. I acknowledge that the system I want to implement is straightforward to defeat, but the majority of users won't bother - especially when a legitimate copy only costs a couple of bucks anyway.
Kevin Picone
21
Years of Service
User Offline
Joined: 27th Aug 2002
Location: Australia
Posted: 8th Apr 2011 05:49 Edited at: 8th Apr 2011 05:50
No. All it takes is 1 person to known how to zip the files/remove the protection, they then torrent / upload it to any one the file sharing services. It'll proliferate from there.

Price is not a factor, nothing is as cheap as FREE.


Quote: "
However, my very specific circumstances require that, even though the internet connection is certainly there (as the software is distributed electronically, ie, downloaded from the internet), I don't want to use an internet connection in the actual authentication process. I don't want to turn this thread into a debate over why, I just want an alternative.
"


You can hide the process from the user by offering an initial down loader package, rather than the entire thing.

So the down loader first susses the system ID (from HD serials), sends this info back to the server and the server encodes the data files specifically for this system during download.

The user could enter their serial (sent back during ordering) at this point also. The serial is hashed to the server for download authentication. So if the user want to install the app on another system (Which most licensing terms disallow anyway), they grab the downloader & run it from that system.

The server can then profile the system id's against the serials, so perhaps allowing 5/10 different machines. Beyond that and they're stretching the fair use rights.

Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 9th Apr 2011 11:30
Quote: "No. All it takes is 1 person to known how to zip the files/remove the protection, they then torrent / upload it to any one the file sharing services. It'll proliferate from there."


This isn't the way it works in the real world. Yes, almost any software can be found via torrent, and everything that can be cracked has been cracked, but *most* people do not acquire software via torrent. The majority of software proliferation today takes place via legitimate sales.
Kevin Picone
21
Years of Service
User Offline
Joined: 27th Aug 2002
Location: Australia
Posted: 9th Apr 2011 13:21
Quote: " This isn't the way it works in the real world. Yes, almost any software can be found via torrent, and everything that can be cracked has been cracked, but *most* people do not acquire software via torrent. The majority of software proliferation today takes place via legitimate sales.
"


In a Utopian society perhaps, but why would there be less piracy now, when the number of distribution opportunities is far easier and wider then ever before ? - It's no longer just passive (hand to hand) distribution, but entire networks dedicated to it.

People will buy software, hell I make my living selling software online, but that's not the point. Why go to the trouble of adding a protection scheme (even a simple one) if you're not concerned about the possible piracy impact ?

Agent
19
Years of Service
User Offline
Joined: 7th Sep 2004
Location: Sydney, Australia
Posted: 10th Apr 2011 00:06
Because that majority of software proliferation taking place via legitimate sales which I mentioned is predicated upon the comparative ease of making a valid purchase through clearly visible means (clicking a button in the software) versus having to search for an alternative that isn't presented on a silver platter. It's a very real psychological thing - even though it's just as easy, and cheaper, to search for a torrent and download it, people are more prepared to click on a "purchase" button (which is right in front of them) than have to find the cracked version (even if it only takes thirty seconds to do so). Taking the path that's mapped out for you is psychologically and perhaps unconsciously preferable than carving out your own road to the goal, even if the carving of that road only takes a few seconds. This is the one reason that legitimate sales is the primary source of software proliferation.
Kevin Picone
21
Years of Service
User Offline
Joined: 27th Aug 2002
Location: Australia
Posted: 10th Apr 2011 06:32 Edited at: 10th Apr 2011 06:35
There's a lot factors prohibiting sales, everything from the colouring, position, wording, payment method, price, language etc etc.. Without even considering the competition in the market, so every click is an opt-out point in the purchase process.

So even when the visitor traffic is highly targeted, a 1-2-3% conversion rate isn't uncommon (1 in 100 unique visitors). If you're hoping for mass impulse buying here, then that's only really associated with the current social buzz words / it thing, something like Minecraft would be an obvious one today.

Optimizing the sales process is one part, but it's worthless without feed in traffic. Creating sustained awareness is difficult, without deep pockets or some type of media stunt (viral).

So beyond the cyclical pimping of the app through the regular news/reviews/download /social media/pad sites etc etc.. then there's endless stream of visitors sitting at search engine right now typing queries in.

Search engine visitors can't be considered potential customers though, but from the type of queries they're entering it can give some insight into the objective when they click through. Ie.. 'order product name' , 'download product name', 'crack product name' All very different mind sets. So make sure you check those referral logs.

Anyway, best of luck..

Login to post a reply

Server time is: 2024-05-07 02:40:33
Your offset time is: 2024-05-07 02:40:33