[RESOLVED] Identify computer

[Eduardo-]

I was asked to add a feature to a software to handle the license by identifying the computer for which the license was issued.

I don't think that's an uncommon requirement, so I'm asking if someone has already an approach.

The point would be to identify the hardware, preferably with serial numbers or something else not easily repeatable in other computers.

So, the if the motherboard is changed, or the disk is changed, the license should still recognize that part that is known hardware and still work.

Anyway, I could search how to get hardware serial numbers (and maybe mac address?), but I decided to ask because I guess others may already have this issue a bit more "cooked".
TIA.

[VanGoghGaming]

There is no perfect solution but you could try a number of things:

- Most motherboards don't have a serial number so you're out of luck there (they do have Manufacturer and ProductName strings).

- MAC addresses can be changed by savvy users and you must be careful to weed out virtual Network Adapters from physical ones (both wired and wireless).

- The CPU has a ProcessorID number that could be used.

- Each RAM stick has a useful serial number.

- Hard drives and SSDs also have a hardware serial number (not to be mistaken with the volume serial number which changes with every format) but you need to identify the boot drive in case there are more hard drives present in the system.

You need to decide which of these to use (how many hardware components (if any) can the user change before you decide it's a different computer). Then you compute a hash value from this information and save it in the registry (optionally encrypted and checked against an online database). CryptProtectData is a suitable function for this purpose as it is tied to the current Windows installation.

Other caveats worth mentioning:

- There are different ways to obtain this hardware information (some lower level than others). From Windows 7 onward, the WMI object is a pretty reliable way to obtain everything you need.

- Most of this hardware information is missing or returns generic results if the software is run inside a virtual machine rather than the actual physical computer. You may want to check the presence of a virtual machine.

As you can see it's a lot to consider and you need to decide how far you want to take things since no solution is perfect.

[Eduardo-]

And there is nothing already cooked (or half cooked) for something that one can think should be quite common need?
I mean, some code with the fallout, in case there is ProcessorID use that, in case there is motherboard serial number use that, in case there is only manufacturer/model use that, Etc.

I would allow to change almost everything, if only one element match, for example a memory, for me the license is valid. For example if they keep one same disk, it would be OK for using the license.

My idea is to generate a number, for example 3654-9702-3865 where the first 3654 is a checksum for the processorID/mother-Serial/LAN-Mac/Mother-whatever, the second may be a disk serial number and the third may be RAM serial, one of the sticks.
I could add more disks, more RAMs, but it would require more 4-digit numbers.
I think 12-digit long numbers (info for 3 computer elements) are fine to dictate over the phone.

Ideas?

[The trick]

https://www.cyberforum.ru/visual-bas...l#post10062837

[VanGoghGaming]

I think 12-digit long numbers (info for 3 computer elements) are fine to dictate over the phone. Ideas?

There are no hard and fast rules here but you've got the basic gist of it. The ProcessorId and Motherboard Info are not unique for each component but for an entire family of components from the same generation. MAC addresses are not so great (except for virtual machines) because some users may have disabled Network adapters, others may use removable USB WiFi adapters and so on.

The phone dictation is a really bad idea though, but up to you I guess. An online database would allow you to invalidate licenses and validate them again in case of legitimate hardware changes.

Browse through the WMI classes and see what tickles your fancy or use TheTrick's magic code!

[Eduardo-]

https://www.cyberforum.ru/visual-bas...l#post10062837

Thanks The tick, I'll check it.

There are no hard and fast rules here but you've got the basic gist of it. The ProcessorId and Motherboard Info are not unique for each component but for an entire family of components from the same generation

I'm not sure what is ProcessorId. At some point Intel wanted to introduce a "serial number" for the processor and that cause big concern about privacy and IDK if they finally did or not. What is that ProcessorId that you say, a serial number of a model number?

I need serial numbers, not model numbers.

. MAC addresses are not so great (except for virtual machines) because some users may have disabled Network adapters, others may use removable USB WiFi adapters and so on.

Nahhh, what users disable network adapters? Not these ones, because they are normal users that will have in most cases a laptops.

The phone dictation is a really bad idea though

Why? Do you have a better idea that does not involve the program to connect to a web site? That would be also "a bad idea".

More advanced users will copy and paste the number in a messenger program, but this must be possible to any user, also older people. Some user could send an email and continue entering the license later, but I want the infor to be easy numbers to be able for them to pass the info by phone.

, but up to you I guess.

I already presented several options and they opted for one without the program connecting to a web site. Not up to me now.

An online database would allow you to invalidate licenses and validate them again in case of legitimate hardware changes.

That was another option but they don't want to have a web site for this.

Also the program could not connect die to firewall issues. That's asking for troubles.

[VanGoghGaming]

Hey, the customer is always right, yes? This guy knows best:



On a more serious note though here's what Dave had to say about his work on Windows Activation:

[baka]

what about GetVolumeInformation?

Private Declare Function GetVolumeInformation Lib "kernel32.dll" Alias "GetVolumeInformationA" (ByVal lpRootPathName As String, ByVal lpVolumeNameBuffer As String, ByVal nVolumeNameSize As Long, lpVolumeSerialNumber As Long, lpMaximumComponentLength As Long, lpFileSystemFlags As Long, ByVal lpFileSystemNameBuffer As String, ByVal nFileSystemNameSize As Long) As Long
Private Declare Function SHGetPathFromIDListW Lib "shell32.dll" (ByVal pidl As Long, ByVal pszPath As Long) As Long
Private Declare Function SHGetSpecialFolderLocation Lib "shell32" (ByVal hWnd As Long, ByVal nFolder As Long, pidl As Long) As Long
Private Declare Sub ILFree Lib "shell32" (ByVal pidl As Long)

Private Function GetVolumeSerialNumber() As Long
    Const CSIDL_WINDOWS = &H24
    Const MAX_PATH = 260&
    
    Dim pszPath                 As String
    Dim pidl                    As Long
    Dim buffer                  As String * 256
    Dim volumeSerialNumber      As Long
      
    Call SHGetSpecialFolderLocation(0, CSIDL_WINDOWS, pidl)
    pszPath = String(MAX_PATH, 0)
    
    If SHGetPathFromIDListW(pidl, StrPtr(pszPath)) Then pszPath = Left$(pszPath, 3)
    Call ILFree(pidl)
    Call GetVolumeInformation(pszPath, buffer, 256, GetVolumeSerialNumber, 0, 0, buffer, 256)
End Function


Private Sub Form_Load()
    MsgBox GetVolumeSerialNumber
End Sub

[Eduardo-]

what about GetVolumeInformation?

That one doesn't return the serial number of the formatting? (that can change after a new formatting)

[baka]

yeah. its not that everlasting.
my latest is just a GetUserName to protect the "save-file", since its not anything special about that except to not share around the save to others (as theres pay-members with bonus-stuff in their save)
a user can lock/unlock the protection and even type a password himself (default is the username)

using GetUserName + VolumeSerialNumber would be even stronger. since I just want the protection to be at this moment, not years ahead.

MAC is good until u change mothercard or (if its a PCI card) and how often it happens? most likely when u buy a new computer.

most product don't allow this, most of the time its kind of a registry or a file in the system. when u format or make a clean windows its gone.

[VanGoghGaming]

yeah. its not that everlasting.

Probably Eduardo would want to avoid taking the night shift as a call-center operator every time someone decides to reinstall their Windows!

Dim objDiskPartition As Object
    For Each objDiskPartition In GetObject("winmgmts:").InstancesOf("Win32_DiskPartition")
        If objDiskPartition.BootPartition Then Debug.Print objDiskPartition.Associators_("Win32_DiskDriveToDiskPartition").ItemIndex(0).SerialNumber
    Next objDiskPartition

This will output the hardware serial number for the hard drive that contains the boot partition. A similar approach works for any other hardware components you wish to hash together if you don't want to rely on a single component.

And if you insist on using MAC addresses (it WILL come back to bite you later):

Dim objNetworkAdapter As Object
    For Each objNetworkAdapter In GetObject("winmgmts:").ExecQuery("SELECT ProductName, MACAddress FROM Win32_NetworkAdapter WHERE (MACAddress IS NOT Null) AND (Manufacturer <> 'Microsoft') AND NOT(PNPDeviceID LIKE 'ROOT\\%')")
        Debug.Print objNetworkAdapter.ProductName, objNetworkAdapter.MACAddress
    Next objNetworkAdapter

[wqweto]

You can retrieve SMBIOS machine UUID like this

c:> wmic csproduct get UUID

Here is all API impl of the WMI code above:

Option Explicit

Private Declare Function GetSystemFirmwareTable Lib "kernel32" (ByVal FirmwareTableProviderSignature As Long, ByVal FirmwareTableID As Long, FirmwareTableBuffer As Any, ByVal BufferSize As Long) As Long
Private Declare Function StringFromGUID2 Lib "ole32" (uGUID As Any, ByVal lpSz As Long, ByVal cchMax As Long) As Long

Private Sub Form_Click()
    Print "GetMachineUUID=" & GetMachineUUID()
End Sub

Private Function GetMachineUUID(Optional Error As String) As String
    Const LNG_RSMB      As Long = &H52534D42 '-- "RSMB"
    Dim lSize           As Long
    Dim baBuffer()      As Byte
    Dim lIdx            As Long
    Dim lOffset         As Long
    
    lSize = GetSystemFirmwareTable(LNG_RSMB, 0, ByVal 0, 0)
    ReDim baBuffer(0 To lSize) As Byte
    If GetSystemFirmwareTable(LNG_RSMB, 0, baBuffer(0), lSize) <> lSize Then
        Error = "Failed GetSystemFirmwareTable"
        GoTo QH
    End If
    lIdx = 8
    Do While lIdx < lSize - 16
        If baBuffer(lIdx) = 1 Then
            lOffset = lIdx + 8
            Exit Do
        End If
        lIdx = lIdx + baBuffer(lIdx + 1)
        Do While baBuffer(lIdx) <> 0 Or baBuffer(lIdx + 1) <> 0
            lIdx = lIdx + 1
        Loop
        lIdx = lIdx + 2
    Loop
    If lOffset = 0 Then
        Error = "Cannot find UUID in raw data"
        GoTo QH
    End If
    GetMachineUUID = Space$(38)
    Call StringFromGUID2(baBuffer(lOffset), StrPtr(GetMachineUUID), Len(GetMachineUUID) + 1)
QH:
End Function

GetSystemFirmwareTable API function is available on Win7+ so this will not work on XP and below.

Another caveat is that if a VM is cloned this will return the same machine UUID but probably all other h/w based options suffer the same problem too.

cheers,
</wqw>

[fafalone]

People replace hard drives too often to use them as an identifier IMO. If you're not supporting XP the best option is getting smbios info from GetSystemFirmwareTable.

[Eduardo-]

People replace hard drives too often to use them as an identifier IMO. If you're not supporting XP the best option is getting smbios info from GetSystemFirmwareTable.

The identifiers will be, in my current intend (my current idea), three.

One for mother/micro. Another for a hard drive, and the third could be a memory stick, or another hard drive.

Nowadays, in general, the network adapter is embedded in the motherboard, so I would consider the mac address as an alternative to the motherboard identification.

And, also in general, nobody change motherboards, or micros. The could add another disk, it is unlikely that they will remove one, but they can be replaced if the fail.

So, the idea, is to identify any of the original elements, not all.

If they change everything, yes, they will have to ask for a new unlock key (license key).
I think they will give it (I'm not doing it for a program that I own, it is for an organization that I made a program for them), but they want to have control about to whom, when, how many times, etc. the licenses are issued.

GetSystemFirmwareTable API function is available on Win7+ so this will not work on XP and below.

I think now it is OK to state Window7+ as a requirement.

Another caveat is that if a VM is cloned this will return the same machine UUID but probably all other h/w based options suffer the same problem too.

cheers,
</wqw>

Are you saying that if someone with the program installed make a VM of that Windows and programs installation, that VM can be used in any other hardware but it will return the serial numbers of the original machine?

[Dry Bone]

If someone re-installs Windows, he will have to re-install all programs as well, so it stands to reason to require a new license.
This is why I use Windows' drive serial number (hardware, but even software will do, since you can't change that without consequences...) with a clean conscience...

[Eduardo-]

If someone re-installs Windows, he will have to re-install all programs as well, so it stands to reason to require a new license.
This is why I use Windows' drive serial number (hardware, but even software will do, since you can't change that without consequences...) with a clean conscience...

This can be an approach.
This option is more work for the organization and for the user also because she/he will have to contact the organization after every Windows reinstall.

Windows reinstalls are far more often than buying new computers.

Still, in the hardware based licenses, I don't know if the users will write down the licenses to be used the next time or will call the organization every time they reinstall Windows (usually that is done by a third party). In the second case, it would be the same as using a software identifier (disk serial number after formatting), because they would be calling every time.

I will ask about this option, they could be interested because it is more restrictive. Licenses only would work until the next Windows full reinstall. Thanks for making me think.

[Eduardo-]

BTW, I wonder if the serial number of a partition after formatting can be set to any number that you want (in some way)?

If I use that number, someone could use the software in any computer if that is possible (he needs to be a hacker anyway... or more or less).

[Zann]

Volume serial number can be changed very easy.

https://www.codeproject.com/Articles...-serial-number

[Eduardo-]

Volume serial number can be changed very easy.

https://www.codeproject.com/Articles...-serial-number

Ok, thanks.
I could use hard serial + volume serial (in case that they are interested in this option).

[Dry Bone]

I read somewhere, that changing Window's drive SN will make it crash, so good luck with that...

[Eduardo-]

I read somewhere, that changing Window's drive SN will make it crash, so good luck with that...

Even if Windows crashes, you could reinstall it in the same partition without formatting (after you changed the volume serial number).

[OptionBase1]

Are you saying that if someone with the program installed make a VM of that Windows and programs installation, that VM can be used in any other hardware but it will return the serial numbers of the original machine?

Not exactly. I think what wqw is saying is, imagine a scenario where I am a customer of yours, and I purchase and install your software inside of some VM that I am running. I then would have the ability to clone that VM and distribute copies of it to others, and your "license check" would see all of these cloned instances as valid since all of the checking you are planning on doing will show that all of the original "components" haven't changed.

[Eduardo-]

Not exactly. I think what wqw is saying is, imagine a scenario where I am a customer of yours, and I purchase and install your software inside of some VM that I am running. I then would have the ability to clone that VM and distribute copies of it to others, and your "license check" would see all of these cloned instances as valid since all of the checking you are planning on doing will show that all of the original "components" haven't changed.

Ah, yes, I get it.
In this particular case I don't think that any user will do that, but it is something to keep in mind with this approach.
There should be some way to detect whether it is a VM or not.

[VanGoghGaming]

VM can be used in any other hardware but it will return the serial numbers of the original machine?

A virtual machine has its own (fake) serial numbers, it doesn't return anything from its host machine. I've already told you this in the second post but it seems you've brushed over it. The only thing that changes when cloning a virtual machine is the MACAddress of its virtual network adapter.

If the virtual machine runs on a different CPU family (i5 vs i7 for example, or different generation of CPU) then the "ProcessorId" will also change. "ProcessorId" is an attribute of the "Win32_Processor" class since you asked.

A virtual HDD will not have a hardware serial number (only a volume serial number however useless that is).

Private Function IsVirtualMachine() As Boolean
    IsVirtualMachine = GetObject("winmgmts:").InstancesOf("Win32_TemperatureProbe").Count = 0
End Function

The real question is how deep do you want to go into the rabbit hole for this "organization" that you mentioned...

[VanGoghGaming]

People replace hard drives too often to use them as an identifier IMO. If you're not supporting XP the best option is getting smbios info from GetSystemFirmwareTable.

It is unlikely the boot drive will ever change except when buying a new computer altogether. Also this SMBIOS UUID doesn't seem all that it's cracked up to be.

Bottom line is that without an online database there will always be dishonest users claiming they got a new computer and bothering you for a new license.

[VanGoghGaming]

That was another option but they don't want to have a web site for this.

Just out of curiosity, how are they distributing this software without a website? Mailing CDs?

Also the program could not connect die to firewall issues. That's asking for troubles.

Normal web requests through the regular browser ports (80, 443) is not subject to Windows firewall issues. Maybe some third party firewalls would complain though.

[Eduardo-]

Just out of curiosity, how are they distributing this software without a website? Mailing CDs?

I think they use third party websites, like Google Drive or Dropbox.

[Eduardo-]

The real question is how deep do you want to go into the rabbit hole for this "organization" that you mentioned...

Not much, but I would like to know whether the program is running in a VM, in order to not to issue licenses for that.

I know, I'm being a bit lazy, but perhaps someone already know hot to detect that.

[VanGoghGaming]

I gave you a function for that above, not sure how you missed it...

[Eduardo-]

i gave you a function for that above, not sure how you missed it...

ok, ty

[baka]

one thing that I do not understand fully is the "procedure" to register the software on a computer.
I understand that u want the software to be locked to a computer, no matter if the user reinstall/update windows, format/change a drive. so u look into something that last preferable until they discard the whole computer.

u will need a database that will store those "key", how do u get it the first time? the user need to do something? run a tool? send email?

I mean, this is also important to understand how strong the "protection" is and if the user need to register it again u (the company) need to have that user information.

I mean, if 2-way-communication is needed, u could just create a registration in the registry or a file placed in the users\ folder.
when the user change windows or computer he will need to redo this setup. its not the end of the world. and I think most software do like that.

[Eduardo-]

It will work this way:

The user starts installing the program, at some point, after it was installed, in the first run, it will see that the user needs to enter the license and will ask for a license, presenting a number that she/he will be asked to provide, it will be like number like 1234-5678 (or it might be 12 digits like 1234-5678-9012).
That number will be a shortened version of the mother serial+volume serial (perhaps, I'll ask tomorrow if they want to volume serial or just the number of the hardware).

How to send the number? By WhatsApp, by phone, or if there is no rush maybe by email.

The registration key the user will receive will be like: 1234-5678-9012-3456-7890
The user will have to enter that key, that in some way it will correspond to the 1234-5678 that she/he supplied.
If if doesn't correspond, it will say "Invalid key".

Then I'll store somewhere to what Mother and/or Disk the licensed was issued, and every time the program starts I'll check that.
This step maybe a bit redundant, but not difficult to perform so, I think I'll do it.

And for virtual machines it will say "impossible to run this program on this environment" or something like that.

[Elroy]

This makes me think of the way Vicon's (motion capture) software handles this.

They let anyone download their software, but it's severely crippled unless you have a USB dongle from them inserted into the computer. I've got one of their dongles, and it apparently just has some kind of EPROM chip in it, but I've really got no idea.

Some of the advantages of their approach are that clients can upgrade their hardware without the hassle of having to deal with Vicon to move the mocap software. Also, Vicon does require (at least occasional) web access, as there software is also prescription. Apparently, when you run it, it digs some serial number out of the dongle and validates that it's all paid up against their database. It will run offline, but not permanently.

-----------

Anyway, probably not the solution you were looking for, but I suspect there are companies out there that'll make these dongles for you.

[baka]

I think a good way is to have a

programname.exe
programname.reg

this .reg file is created in the root-folder of the program,
that way, the user can copy the folder anywhere, reinstall windows. if format, they will need to copy it to a usb or something.

basically the .reg file have that key that only works with the computer-id-key
so in a way u will need to create a key that include the computer-id-key, the program will a way to decrypt it and compare.

if u instead place the .reg file in the registry or in the users\ folder it will be more difficult for the user to move it around and make backups.
since the key only works with a specific computer-id-key they can not just copy it to another computer.

[Eduardo-]

Dongles: Yes, I know about them and saw some. No, we don't want dongles.

Reg file: It may seem very easy to you and maybe for game players, but I think it is something that can bring problems for normal users.

BTW: They already answered: they prefer the key to be usable at any time with that computer, so the Volume label is ruled out.
Thanks for the options.

Now that I have all the information I'll have to work

[Eduardo-]

I thought that the Mac addresses were quasi unique, how can it be that my mac address is: 88-88-88-88-87-88?

Description = Intel(R) Ethernet Connection (7) I219-V
AdapterIndex = 5
Name = {260665AA-1478-4698-8DBB-E1172F4B4C68}
Type = 6
Address = 88-88-88-88-87-88

[wqweto]

Try c:> ipconfig /all | findstr /i physical

cheers,
</wqw>

[Eduardo-]

Try c:> ipconfig /all | findstr /i physical

cheers,
</wqw>

It returns nothing.

[VanGoghGaming]

I gave you the code to return physical MAC addresses above. Have you tried it?

[Eduardo-]

And if you insist on using MAC addresses (it WILL come back to bite you later):

Dim objNetworkAdapter As Object
    For Each objNetworkAdapter In GetObject("winmgmts:").ExecQuery("SELECT ProductName, MACAddress FROM Win32_NetworkAdapter WHERE (MACAddress IS NOT Null) AND (Manufacturer <> 'Microsoft') AND NOT(PNPDeviceID LIKE 'ROOT\\%')")
        Debug.Print objNetworkAdapter.ProductName, objNetworkAdapter.MACAddress
    Next objNetworkAdapter

It produces:

Intel(R) Ethernet Connection (7) I219-V   88:88:88:88:87:88

it WILL come back to bite you later

What do you mean, exactly?