Printable View
If I was to burn my new Visual Basic 6 program to a CD-R and distribute it with packaging and all, how could I stop people from simply copying the CD and giving it to their friends (I don't have the money to let them do this). Is there any kind of program that prevents people from ripping me off or anything?
Read and write an encrypted code to the registry, and add a checksum to ensure your exe has not been tampered with. Megatron has an example of simple xor encryption, or see www.kedaman.com (when site is available that is) for more secure encryption algorithm.
Can you please explain that out a little more, how I can go about finding out exactly how to do it, etc.
Assuming you know how to read and write to the registry, here is an encryption algorithm from Kedaman: Just pass it the string (code in this case) you want to encrypt, the key (any length string), and a seed for the random number e.g. 100)
To decrpyt the string just call the function again and pass it the encrytped string, and the same key and seed, and it will decypt the string.
Code:Function KKRSE(text As String, Optional Key, Optional Seed) As String
Dim ab1() As Byte, ab2() As Byte, keylen%, aa$
ab1 = StrConv(text, vbFromUnicode)
If IsMissing(Key) Then
For n = 0 To UBound(ab1)
ab1(n) = 256 - ab1(n)
Next n
Else
aa = Key
ab2 = StrConv(aa, vbFromUnicode)
If IsMissing(Seed) Then
For n = 0 To UBound(ab1)
ab1(n) = ab1(n) Xor ab2(n Mod Len(aa))
Next n
Else
Rnd -1
Randomize Seed
For n = 0 To UBound(ab1)
ab1(n) = ab1(n) Xor ab2(n Mod Len(Key)) Xor Int(Rnd * 256)
Next n
End If
End If
KKRSE = StrConv(ab1, vbUnicode)
End Function
How would an encrypted code in the registery prevent people from making a copy of the original CD?
If you want to prevent this, you need to use a software that will make the copied CD useless. (such as Safedisc, Securom, Laserlock...)
I think that the way to do that is to make a exe that will read the true exe located in hidden sectors on the CD.
In consequence, the CD will be needed to use the program.
How do you do that?
In my opinion, don't do it!
Some CD burner software are able to copy CD protected with these methods.
Even if your burner isn't supported with this software, you can still find patched exe of the program that you're copying. That will allow run the program by using the patched exe instead of the one that came with the installation.
Don't you think that microsoft would prevent the copy of Windows, VS and Office if it could?
Krushstone
To be honest, I don't think you can stop people. If they are that determined to get your program nothing you do will stop them.
In my opinion it comes down to how hard do you want to make it on them? If you make it hard enough, that will stop a lot of people from bothering because it isn't worth the hassle... but it will not stop everyone.
Now I could be wrong, but I don't think there are any programs out there that can't be copied (that are availabe to be purchased).
If you can't afford to have your program copied, you may want to put some serious thought into if it is a) worth being stolen (no insult is intended, just some programs aren't worth it), and b) how much you potentially stand to lose. If it is too much, you may want to reconsider distribution.Quote:
(I don't have the money to let them do this.)
Just some random thoughts.
Michael
Well just to add,
I have not found ANY application or game that CANNOT be copied. All the new games with SecureROM 2 and SafeDisk2 I have been able to copy just fine and dandy. Yes most people cannot/don't know how to do it but it is done quite easily if you have a quality CD-R drive and a nice piece of software. (which I won't give brands for security purposes(but certainly EasyCD Creator won't do it, neither will Nero do most of them)
Zevlag
You can't stop someone copying a cd, however, through the use of encryption and checksums you can make it very difficult for would be crackers. Instead of giving up, I prefer to fight back a little ;)
Have you heard of what ms are appearently doing with office xp? You install it and it give the user a unique key generated by a sum from their hardware. They then have to get in touch with ms with a certain amount of time and give that code to ms who will then give them a key back. If they dont, office will stop working.
How about to prompt for registration key upon setup the program?
:)Code:Procedure
1. Modified the Setup1.EXE that come along with VB.
a. Setup1.EXE should be able to generate a system key/reference key
base on:-
i. Remaining Free diskspace.
ii. Current system Date/Time.
iii. User input like Name, org or email.
sample system key: HG24G JK2SK C2HS2 HQLQU GFDKA
iv. Save this into registry (posible encrypt it)
b. Include a new product key input form.
c. User should get the Product key base on the generated system key
through phone call/email.
d. Product key generator should be able to mesh up the 25
character in the system key and reformat a new product key.
2. ReCreate a P&D with the new Setup1.EXE
I do not have the time right now to implement this, but thank you very much, that should be helpful. I know I can't stop a lot of people from copying it, but I want to stop some lamer parents who don't give a care about my profit or anything. I want them to not be able to copy it with the common CD-RW and copy of Easy CD-Creator, basically I want to stop as many copy attempts as possible.
NSLock is freeware. It lets you set a code to enable the program.
It works this way: when the program is first installed in the user machine, it generates a random code. The user phones/mails to you this code, and you process it and a password of your own in a little .exe that will return a validation code for your user. Then the program will work OK.
You can enable/disable certain portions of your programs (print, save, etc) to let the user evaluate the program, and when they are sure, they can pay you and get the validation code.
Surfe the net for details.
Well if it is such a pain in the ass you might want to distribute your program inside floppy disks and put some code inside your setup file that checks for the floppy serial number and if it doesnt match then the setup file doesnt work and wipes out the other files inside the disk:D
The only problem with this is that floppies might not be able to store your app without using a lot of them:(
But the big problem i think are the runtime files they are big so why dont you distribute a CD and a floppy the CD contains all runtime files and stuff not vital for the app (This usually takes a lot of space) and inside the floppy just attach the app EXE file and well it wont matter if you copy the CD because then the app wouldnt work without the files inside the floppy.
Just remember that anyway everything is crackeable and that for doing this you will have to make your own setup program.
But this might help you i hope it does
reivaJ, that is not a bad idea reivaJ, how so you extract a SN for a floopy?
Also is it possible to get an equivalent to a floppy SN for a CD?
You think its a good idea :)
well i dont know how to get the SN in VB but i do remember that if you go to DOS and type Dir or format at some point it displays the SN, i dont know about getting a CD SN but it might be a good thing to do.
i found this code on the net it works great i think the only need for this is to display the serial number as Hex(Just add the function)
Option Explicit
Private Declare Function GetVolumeInformation& Lib "kernel32" _
Alias "GetVolumeInformationA" (ByVal lpRootPathName _
As String, ByVal pVolumeNameBuffer As String, ByVal _
nVolumeNameSize As Long, lpVolumeSerialNumber As Long, _
lpMaximumComponentLength As Long, lpFileSystemFlags As _
Long, ByVal lpFileSystemNameBuffer As String, ByVal _
nFileSystemNameSize As Long)
Const MAX_FILENAME_LEN = 256
Private Sub Command1_Click()
Label1.Caption = SerNum("C") 'C is the standard harddisk
End Sub
Public Function SerNum(Drive$) As Long
Dim No&, s As String * MAX_FILENAME_LEN
Call GetVolumeInformation(Drive + ":\", s, MAX_FILENAME_LEN, _
No, 0&, 0&, s, MAX_FILENAME_LEN)
SerNum = No
End Function
well i dont know but i am starting to think that the serial number comes from the files inside the CD or floppy and not from the disk itself so maybe 2 cds with the same info might have the same serial number and that would suck i hope im wrong
:rolleyes:
You might have cracked it reivaJ (no pun intended). Well done.
Cheers and kudos to you!
I tried making a program that read the serial number from its own floppy and if the serial number was different from the programmed one it would display something saying the app was not in its original diskette but the thing is
if i copy only the file im interested on then the it works because the serial number in the other disk is different:)
But if i copy the entire original floppy using disk copy the Serial Number of the original floppy becomes the serial of the copied one:(
Please someone else give this a try i think this may help us a lot
if you wanna see the code of the program just ask for it
Does anyone know if the same thing happens when you copy a CD?
Well maybe the best but most complex solution is to use a dongle for your app:rolleyes:
Here it is:Quote:
Originally posted by Nucleus
Megatron has an example of simple xor encryption
Code:Sub EncryptFile(ByVal sName As String)
Dim b() As Byte
Dim nb() As Byte
n = FileLen(sName)
ReDim b(n - 1)
ReDim nb(n - 1)
Open sName For Binary Access Read As #1
Get #1, , b()
Close #1
Kill sName
For i = LBound(b) To UBound(b)
nb(i) = b(i) Xor 5
Next i
Open sName For Binary Access Write As #1
Put #1, , nb()
Close #1
End Sub
reivaJ, unfortunately same problem with cds. Nice try though.
I once saw an example of a copy protection thing with some disks apparently the disks intercepted the copying attemps from the OS and made them bounce around the thing was that it looked like you were copying the files but when you checked the other disk it was empty:D
cool isnt it well the bad side of this is that this was designed for DOS hehehehe.
Well, I thought of it overnight. I got 2 new radical ideas on how to prevent the copying of a CD.
1) Whenever you copy files in Windows, it changes the last date of modification (BANG!!!!). So whenever your installation program runs, you can run a boostrap that make sures that a file on the cd has the same date of modification when you actually copied the cd.
2) This idea will make sure that your software will not run on more then one PC!!! It involves selling your CD ROM with a floppy as a writable media. Whenever your setup shield runs, you can run a boostrap that checks to see if the software has been installed (from a file on the floppy), if not, it will go ahead with the installation. On going ahead with the installation, it will make a file in the windows directory and also write to a sector of the floppy saying that it has been instaled or something like that. If the floopy indicates that the program has been installed, it will check for that file in the windows directory. If it's there, it will know the software has been installed on that PC before and will go on installing it again. If not, it will know the software is being installed on a new PC. It's as simple as that.
Check out my theory please make some suggestions its kinda like Yash_Kumar said but please make some suggestions so we can make a good protection scheme.
Well, what if the guy knows your protection and format a brand new floppy which allow to choose the serial number that will be given to the floppy disk (yes, that's possible).
He just has to copy the floppy BEFORE installing the software .
And what if I'm totaly legal and that i format my hard drive and that his serial number changes? my floppy will be erased?
The serial number of a disk is only a random number give to it right after it is formated. If you know where this number is located on the disk then you can change it.
I just looked at a test CD that I have. it as 13 sessions on it, and I can choose the session that I want to access (maybe because I have EZ CD installed)
The point is that I tried 2 different sessions and they didn't have the same serial number! Which is normal in my opinion, but makes me doubt that it is a good idea to include a disk's serial number within a protection.
Krushstone
Reivaj,
If you want to use the floppy method, there are some tricks that old DOS programs used to use. Peter Norton talks about them in The PC Programmer's Bible if you're interested.
It involves renumbering the sectors on the floppy disk and using BIOS disk services to read from them. This will (he claims) keep apps using DOS file services from reading all the data on the disk (ie. from copying it). I'm not sure what complications you would run into, but I'm sure you'd need routines in assembly to (1) create the disk and (2) to read from it during install.
Again not fool-proof, but likely to fool almost everyone...
John
One other thing Reivaj,
When you create the floppy originally, add an encrypted file that uses the serial # of the floppy itself.
When someone tries to copy the disk "out-of-the-box", the new disk will have a different serial number but the same encrypted file. Your install routine can decrypt the file, check if the serial number matches the one in the file, and then proceed with installation.
John
I never thought my question would spark such an interest in copy protection. I think these are all great ideas, what we need to all do is form one theory to stop cd copy and use it and/or present it to companies or something. I just think we have something going here.
This is a good idea, am I missing something as to why it wouldn't work?Quote:
Originally posted by Yash_Kumar
Whenever you copy files in Windows, it changes the last date of modification (BANG!!!!). So whenever your installation program runs, you can run a boostrap that make sures that a file on the cd has the same date of modification when you actually copied the cd.
I think that if the pirater just changed the date on there computer to the date the file was modified and then copied it, it would still run.
I don't know about you guys, but if I spent 25-40 bucks on a program and found out I bought a floppy, I would be pi$$ed. Aslo you have to take in the fact that floppies are not reliable. good one second and bed the next, heck, bad right out of the box.
And there are programs out there that cannot be copied. When I was in college we had a cd that had a program on it for the electronics class and it was setup on one computer. the thing is, once it was loaded on there the key was no good. I looked all over for that SN in the registry and finally found it. It didn't matter though it didn't work. I was told later that the key for the program was on the cd and everytime it loaded on the computer it added to itself on the cd. Don't ask how it was done but that is what the company told us. I know that sounds strange if not impossible but I was unable to get that program to work without ordering a new key.
I also heard that the Simms Game CD is very hard to copy. Haven't tried it but that is what people are saying. even if you got the patch for the copyright protection.
Just my 2 cents
Give me a break. The local MS Office couldn't find their own asses with both hands. This sucks, typical Microsoft.Quote:
Originally posted by lord_dude
Have you heard of what ms are appearently doing with office xp? You install it and it give the user a unique key generated by a sum from their hardware. They then have to get in touch with ms with a certain amount of time and give that code to ms who will then give them a key back. If they dont, office will stop working.
DeepBlueCode
You have to be careful not to upset legal users while protecting yourself from pirates.
Our software has no copy protection what so ever. Sure it is being used illegally, but we have this big notice on the CD about convicting pirates. Had a copy of extra sales when finding illegal copies. The threat of our lawyers, FunnelWeb WHite Pointer & Associates, is normally enough.
Currently doing a software audit for a majort customer. Ten illegal copies of our software, (getting the cheque MOnday:)) and hundreds of Windows and Office. Have organised a site licence for em.
Thanks for good advice Jethro and and thanks for your two cents. I just don't see why the modified date thing wouldn't work. Sure, it's simple, but it *MIGHT* work. I don't know, I jsut can't afford to have some lazy parents spreading my software like a disease. Since I will be making about 300+ copies of it, I'm thinking that I could ID each one and do something with that. I am a first time ditributor for this app (I've never tried to sell a program before) and I want to make sure that my program that is truly a great idea, does not get spread out of my city and into the internet, where it will become freeware on Chinese FTPs. I am only selling the software in my city you see and I want to make sure it stays here before some major company steals it and copies it.
So you haven't discussed this with Bill Gates yet then. Bet the guys at netscape are kicking themselves for inviting Bill over to look at the new software.Quote:
Originally posted by DeepBlueCode
Thanks for good advice Jethro and and thanks for your two cents. I just don't see why the modified date thing wouldn't work. Sure, it's simple, but it *MIGHT* work. I don't know, I jsut can't afford to have some lazy parents spreading my software like a disease. Since I will be making about 300+ copies of it, I'm thinking that I could ID each one and do something with that. I am a first time ditributor for this app (I've never tried to sell a program before) and I want to make sure that my program that is truly a great idea, does not get spread out of my city and into the internet, where it will become freeware on Chinese FTPs. I am only selling the software in my city you see and I want to make sure it stays here before some major company steals it and copies it.
We distribute a database called mvBase. That uses the current date in its actervation generation. You have to email, the serial number and date of install, they send back a 30 character code to activate it. Yeap, have tried installing the db the next day on the same PC using the code, and it don't work. Still is a major pain in the ass, waiting for the code.
I understand that every software company has the same problems, it's just I want to try to do something about it instead of giving in to the a-holes of the internet (hackers, crackers, and slackers). I'm gonna give them hell trying to copy my program, just need to know where to start.:cool:
Wish you luck.....nearly every product gets hacked and posted on the web. Some one posted a link to getting vb6 a while ago.Quote:
Originally posted by DeepBlueCode
I understand that every software company has the same problems, it's just I want to try to do something about it instead of giving in to the a-holes of the internet (hackers, crackers, and slackers). I'm gonna give them hell trying to copy my program, just need to know where to start.:cool:
When you copy a cd using most burning software, there is an option to preserve the original dates and times. This is where the problem lies.
SafeDisc etc are probably the best methods to use, although these are still not entirely impossible to get round.
I'm sure my idea is stupid and old but it works!
What I did is created a php script that checks a file which has:
username,password,computername
Then I added a webbrowsercontrol in my app which is invisible, then when the app loads and the user types his username/password it posts to a checkuser.html page on my server the username password and winsock1.localhostname (network computername) and the script prints "OK" or "NO" and the program responds by that.
and I made it build a log file so I can see if people tried to get in or just typed wrong info.
actually that is pretty smart. but what if the user was not online?
I do like your idea though.
Who doesn't have a connection now days?Quote:
Originally posted by scoutt
actually that is pretty smart. but what if the user was not online?
I do like your idea though.
You want my auth script?
I realize a lot of people have connection to the interent, but I was asking if you can run your program without going on the net? Ya send me the script for it, that would be cool.
[email protected]
thanks
And what if your server is down?
The guy wants to use your prog but he can't because your server is down...
Is your prog related to the internet?
Krushstone
So you make a redirector (i.e. you.6x.to/you.vze.com etc) and if your server goes down, sign up with freehost and change redirector, simple.
I have a flaw! WHat happens if the person gets a virus and need to completely format his/her harddrive?
Or what if I make an exact copy of the floppy? I mean exactly the same, so even the same serial number.
I can now install it on 2 computers at the same time?
TiPeRa is right. If my hard drive crashes, I can't uninstall the program so my floppy won't work anymore.
If the floppy is only for the installation, I just have to install it and then zip all the files...
maybe a little registery patching will be needed, but...
Krushstone
Well maybe my theory was not so good because of the thing that wipes out the disk but that is not something i cant skip:rolleyes: its just that pirates piss me off and i want to at least make it hard for them :cool: maybe if we could mix Yash_Kumar theory with mine we could have some improvements or maybe a lot of them and please make suggestions to the theory(Constructive ones).
Just one thing Yash_Kumar if you completely copy a floppy the SN is the same but the SN changes only if you copy a couple files to the disk(Maybe your files) so thats why my theory has that point if a stupid cracker only copies the files that he need BOOM!; another thing this is just a secondary check.
Krushstone about what you said about the user formatting his HDD Ok my theory takes data that is not supposed to change unless youre pirating Windows too this data might be the name of the Windows Owner or the company name that uses windows the other that shouldnt change is the SN of the HDD and well if my theory finds out that these data havent changed it will work :p
Another thing Krushstone if he copies the disk before even running the first install with it then it will be OK that disk will only be not safe until someone runs an install with that disk cause after someone runs an install with the disk it wont matter if he copies the disk the data with the disk and the pirating PC wont match :o
So use my way, but change it to only first time check, after wards store a cookie or something (which will contain coded localcomputername).
What I meant was, let suppose that I know how the protection works.
I open the box containing the floppy and CD. I copy both floppy and CD without running anything.
I give a copy of each one to my friend and we now have 2 computers running the program....
Also, the serial number of the drive will change if it is reformatted.
Personnaly, I wouldn't like to have a lot a trouble to reinstall a software if my HD die and that I replace it...
Krushstone
With tools like SoftIce/API/installation monitors you cant do anything that the cracker dosen't know about, GIVE IT up and admit defeat it's impossible to fully protect a program, all you can do is try to make life difficult for them.
But anyone who's determined can and will get past any protection!!!
Nothing new here!:mad:
I didn't read all of the posts, but I'll tell you how I managed for not to give my work away. If the final user wants to have "his" program registered, he/she has to send me a registration file (a dat file with hardware info, the serial number for the HD, e.g.) and the make a key code codifying his/her name, his/her email and this specific hardware info. If he/she wanted to passed his/her code to a friend it won't work, most probably since the HD's serial number won't be the same, almost for sure!!. Hope this helps for something.
Hi;
I didn't have time to read all of your posts, but I think I have one that pretty much sums your original question up. No, there is no way to totally protect your programs. There exists several burners that copy everything; even so-called "bad-sectors" that are put on original ("real") disks to prevent regular burners from copying CDs. But (I think it's Plextor) there is at least 1 kind (as mentioned before) that copies it.
Also, the encryption-string-thingy can easily be found using a registry search and copied.
As Spiv said, GIVE IT UP. I know a few "professional" hackers/crackers who are experts. No matter what method I've devised they find ways around it.
JD
P.S. Mc Brain: I'm **VERY** interested in your method. Could you send information? (possibly even a copy of the program that does it -- changed, of course, so I wouldn't copy yours exactly -- :) ????????????)
jon_davis24:
I don't have that code here (right now), but I could explain you the idea better. I have a "demo" program which is the one that the final user can download. This app is restricted, not in "time-life", but in functions. There are some things he/she won't be able to do with the obvious message letting him/her know that the "full version" won't have those restriction. Nothing new so far.
When the user clicks on the "Register" option (in the help menu), I open a form where I ask Name, email, address and whatsoever you like. The first two are NOT OPTIONAL. When the obligatory data is input I enable the "send" button. This is when I create the .dat file (which is a simple text file) I save into it all the data (even the blank ones) and the hardware info I will use. As I said in the previos post (the HD serial number). I suggest to codified this data (with the algorithm you'd like best... I also add some kinda "parity bytes" so that I could be sure the codified data was not edited. There's always a chance to change it and even though still match the parity bytes (if they're changed as well)... but in that case, the KEY CODE won't work for him either.
Then I open an email (directed to me) and beg for attaching that file (created on the directory it was installed) -I can't remember now if I managed to attach it myself-
And that's the whole idea. When I receive the DAT file I have all the info I need to codify the NAME, EMAIL and HD's Serial number (with the algorithm you'd like best -doesn't have to be the same- ) and send him/her back. I guess it's pretty clear that the app should be programmed so that it could verified whether the NAME, EMAIL and HD's Serial Number (in which it's installed) to be sure the Key Code entered is correct
If this person would like to pass its key to a friend, I guess the only way it would work would be to make a copy (with Ghost® or similar program) of the whole HD (I'm not really sure that it copies the serial number as well.. that's why the "I guess"). And if he/she tries to copy (with the usual way) into other HD would not work. I guess you can see why, the HD's serial number will not be the same so the Key Code would not be a "good one".
And if you're wondering about the odds for two HD to have the same serial number... this is the tiny number: 1/4294967296. Needless to say that the odds for those two HDs to belong to a couple of acquaintances is so much smaller.
Hope this helps!
:confused:
It sounds good! I only have two problems with doing that:
One, I have no clue on how to grab the HD's s/n. And I also don't know how to create an algorithm for a custom keycode. If you could help me with some source code (or info on where to get code -- i.e. a web site or book) I'd be very appreciative.
Thanks,
JD
Just a recommendation,
NEVER allow for easy download a semi-functional just requires a key for full function type of program. Sure list the function in the Menu Bar but don't actually have them included in the program. WHen they pay/register then let them get a version with the full code, but still rquires a key (which you just sold them) to allow full function.
Sure the Full requires a key version will be passed around on Warez but hey it sure cuts down alot on standard users just using a way to easy to make keygen or crack for your program.
Hmmm, that's a glaringly simplistic statement. The majority of computer users do not have access. Figures released in OZ, state that approx 30 % of computer users have access to the web, ergo the vast majority do not. Therefore to answer your question, the majority don't have access. Sorry, l just hate this shoot at the hiip answers that people bandy about without actually researching what they are saying.Quote:
Originally posted by rsitogp
Who doesn't have a connection now days?
You want my auth script?