implement licensing system

[adamm83]

Hi guys,

I was wondering if anyone had any suggestions for me. I wanted to implement some sort of licensing system in my vb6 application.

Basically, I want to use a serial number or something similar, and the serial will only work on the computer it is installed on. So I would have to retrieve some sort of unique computer identifier (i.e. unique MAC address, CPU serial number, GUID, etc) to generate a serial number for the system that the application is installed on.

Also, i would not want the user to be able to use the application AT ALL until they enter the correct serial number. (i.e. no time trial, or features disabled)

Any suggestions or additions to this would be appreciated as well.

[shirazamod]

I suggest taking the hard drive's serial number & encrypting it and using that for identification.
I've also been thinking of using something like this in my apps, maybe use an online SQL database to store IDs of people using the application, and make the app check if it's ID is in a 'banlist' which will contain IDs that are illegal (have been openly distributed)

[BrailleSchool]

www.pscode.com has many that you might want to check out.

Hi guys,

I was wondering if anyone had any suggestions for me. I wanted to implement some sort of licensing system in my vb6 application.

Basically, I want to use a serial number or something similar, and the serial will only work on the computer it is installed on. So I would have to retrieve some sort of unique computer identifier (i.e. unique MAC address, CPU serial number, GUID, etc) to generate a serial number for the system that the application is installed on.

Also, i would not want the user to be able to use the application AT ALL until they enter the correct serial number. (i.e. no time trial, or features disabled)

Any suggestions or additions to this would be appreciated as well.

[adamm83]

I suggest taking the hard drive's serial number & encrypting it and using that for identification.
I've also been thinking of using something like this in my apps, maybe use an online SQL database to store IDs of people using the application, and make the app check if it's ID is in a 'banlist' which will contain IDs that are illegal (have been openly distributed)

Any idea on how to integrate a serial number system with the hdd serial number? Also what would happen if the user switches out their hdd somewhere down the line? what happens then? Could you explain a little further? Also, how would you suggest I encode the hdd serial number?

www.pscode.com has many that you might want to check out.

Hey BrailleSchool, What would I search for on pscode.com?

[smUX]

The obvious problem with system-locking a program to a computer is the exact same thing you asked about in your second post, adamm...what *if* the owner changes their hard drive...processor...etc...if you want to system lock the program it would obviously have to *allow* for minor changes and modify its internal security to match.

There's many different methods you could use, taking info like processor speed, windows cd key (IIRC it is stored somewhere), hard drive IDs, graphics card type, BIOS type, network settings etc...the more different pieces of data you collect to build the security database, the more you have to allow to fail and still let the program run.

G'luck with it :-p

[adamm83]

The obvious problem with system-locking a program to a computer is the exact same thing you asked about in your second post, adamm...what *if* the owner changes their hard drive...processor...etc...if you want to system lock the program it would obviously have to *allow* for minor changes and modify its internal security to match.

There's many different methods you could use, taking info like processor speed, windows cd key (IIRC it is stored somewhere), hard drive IDs, graphics card type, BIOS type, network settings etc...the more different pieces of data you collect to build the security database, the more you have to allow to fail and still let the program run.

G'luck with it :-p

currently i have figured out a system that uses the windows ProductId from the registry and a user name to create a serial number using RSA, should I encode the product id first, then create a serial number using the encoded string?

When it registers the application, it stores the serial number (encoded of course) in a registry value, and every time the program starts, it rferences the encoded value from the registry... so it decodes it, references the product id from the registry and checks if the serial number, prductid and username all validate.

Would anyone have any suggestons to better my system?

[smUX]

What you would want to do is encode different methods (product ID, hard drive serial, etc) separately and then encrypt them together in such a way that the program can decrypt and split them so it can check them individually...of course, that's if you want to secure against problems if the user does make minor changes to their computer (and you would then need to also write in code to modify stored data and re-encrypt it all)

What you could do is store serial numbers of the different methods and encrypt them then on startup the program collects the serial numbers and compares them to the encrypted ones (decrypt first, obviously)

It's all up to you, really...I'm more an ideas person; I know these things can be done and I am good at working out how to do them (theoretically) but in practice I'm about as useful as a chocolate teapot if I have to actually code them :-)

[adamm83]

haha chocolate teacup ... ahhahahaah

Well it's good that you're an ideas person, because I am pretty good at figuring out the programming part, but I just had a couple questions about your post, it was a little confusing.

I know this might be a stupid question, but I just want to make sure. When you say "encode", do you mean the same as when you say "encrypt".

What you would want to do is encode different methods (product ID, hard drive serial, etc) separately and then encrypt them together in such a way that the program can decrypt and split them so it can check them individually...of course, that's if you want to secure against problems if the user does make minor changes to their computer (and you would then need to also write in code to modify stored data and re-encrypt it all)

How would that secure against if they make changes. I mean I understand that it has multiple methods to validate, but what would it do if it finds that one of the serial numbers dont match up.

What you could do is store serial numbers of the different methods and encrypt them then on startup the program collects the serial numbers and compares them to the encrypted ones (decrypt first, obviously)

So you mean to store the encrypted serial numbers which were acquired when my app was first installed (or rather first registered), and compare them to the original source of the serial numbers, correct?

thanks for the ideas smUX!!

This next question is for the rest of you:
Do you have any code to encrypt string values in vb6??



.

[smUX]

I know this might be a stupid question, but I just want to make sure. When you say "encode", do you mean the same as when you say "encrypt".

Yup...sorry...basically, I mean to filter the data in such a way that the user can't extract it easily but you can

How would that secure against if they make changes. I mean I understand that it has multiple methods to validate, but what would it do if it finds that one of the serial numbers dont match up.

I think you understood it below, but just in case consider this possibility:

Your program stored these (encrypted) pieces of info:-

*Vendor ID
*C: drive serial
*Graphics card type
*processor speed

Now assume the user upgrades their processor to a better one...in an unprepared system the program would refuse to run...however, in yours you would have the vendor ID, drive serial and graphics card type confirmed as still the same so it would take the info on the upgraded processor speed and encrypt and add it to the security database...next time the program is run, all 4 match and all is well until the user upgrades the hard drive or something. It would be best if you had more items to check so you could allow for 2 or 3 changes with the rest being the same (just in case they get a whole load of upgrades or something) but that's up to you...more checks could take more time or be more programming.

So you mean to store the encrypted serial numbers which were acquired when my app was first installed (or rather first registered), and compare them to the original source of the serial numbers, correct?

Pretty much. You could either program it so that it did this *or* you could have a special password system where the program collects this information and generates a hash or something that they have to email to you (or that is sent directly to you by the program)...you then encrypt a "keyword" at your end USING this hash and send the encrypted keyword to the user as their passcode which they put into the program or which is automatically stored...every time the program is run, it regenerates this hash which can decrypt the passcode you sent and if it matches the stored passcode that is hard-coded into the program it continues.

If you want to use the failsafe system, you would be sent individual hashes for each piece of information and would send passkeys for them all.

There is however a major flaw in this new idea...many crackers use this logical bit section to crack this sort of security...they write it so you can put any passcode in and it'll let you in (basically swapping an "if then" for an "if not then" and vice versa...if you put the RIGHT passcode in it won't work :-))...if you were to go with this method I would suggest that the passcode you use is strongly linked into the actual program code. I personally encrypted certain aspects of the program using my own custom encryption and made it so that it decrypts on runtime using the passcode (although I haven't actually written a commercially secure security system, it was just written to keep the program secure from being misused outside of where I wanted it to be used...it was fairly effective too :-))

thanks for the ideas smUX!!

This next question is for the rest of you:
Do you have any code to encrypt string values in vb6??

No problem...and i would suggest you try writing your own...something that basically turns a password into a filter string which modifies the data within the string you're trying to encrypt. If you find a good prng (check out http://en.wikipedia.org/wiki/Pseudor...mber_generator) you could convert the password into a number and use that number as a seed for the prng then generate numbers to encrypt (and decrypt) the data...for instance, if it gave out "123456" and your string was "aaaaaa" it would become "bcdefg" because you add 1 to the chr value of the first, 2 to the second etc :-)

Or just google for "encryption +VB" :-)

You would want something custom to make it harder for them to crack...again, up to you how much you actually want to do :-)

[BrailleSchool]

Any idea on how to integrate a serial number system with the hdd serial number? Also what would happen if the user switches out their hdd somewhere down the line? what happens then? Could you explain a little further? Also, how would you suggest I encode the hdd serial number?




Hey BrailleSchool, What would I search for on pscode.com?

ill send you what i have used in the past to your private messages

[rory]

creates a serial key based on the users actual HDD serial number .. i also used this in a program, i encrypted it back and forth .. but anyway will give you an idea. I used it within an activation. I grabbed this out of an older existing program so excuse the code and lack of comments ... I cant remember the original author but i edited it so i could use the HDD to work as a serial number.

[adamm83]

does anyone know code I can use to retrieve the following:

CPU Vendor
CPU Speed
CPU Brand

and if possible, other unique identifiers similar to the above.

And thanks for you app rory, I'm sure it will help me!

[Al42]

Adam, search the forums for that information. It was discussed here within the past few weeks.

[shirazamod]

To get some system info, you could use parts of the code found here (from pscode):
http://www.pscode.com/vb/scripts/Sho...59801&lngWId=1
http://www.pscode.com/vb/scripts/Sho...31520&lngWId=1
http://www.pscode.com/vb/scripts/Sho...44616&lngWId=1

[adamm83]

ok I'm back. I've done a bit of research and I've compiled a bit of code.

I'm just wondering if it's possible to get the HDD serial number... NOT the the volume serial number, which is what I have been finding all over the net.

The difference is this:

hdd serial number is the serial number given by the manufacturer for the hard disk.

volume serial number is a randomly generated number given to a partition by the system when a hdd is formatted, which would be changed if the user formatted his/her hdd, and also is not quite unique.

If anyone can supply some code, or direct me to code that retrieves the HDD serial number (not volume serial number), I would greatly appreciate this.

thanks.

[rory]

yes,its in the attachment i posted ..

[mutenroid]

creates a serial key based on the users actual HDD serial number .. i also used this in a program, i encrypted it back and forth .. but anyway will give you an idea. I used it within an activation. I grabbed this out of an older existing program so excuse the code and lack of comments ... I cant remember the original author but i edited it so i could use the HDD to work as a serial number.

Wonderful code rory, works great!

Now, another question about this code:
How to determine which IDE_DRIVE_NUMBER its a specified logical drive?.

I think an example explains better

-Two different hard disks with two partitions each one
-Drive A (serial hddaaa) contains partitions C: and D:
-Drive B (serial hddbbb) contains only one partition with assigned letter E: and another partiton unformatted.

If my app.path start with d:\ how to determine that it's in drive A?
Which value of IDE_DRIVE_NUMBER type belongs?

King regards & sorry for my english

[mutenroid]

Wonderful code rory, works great!

Now, another question about this code:
How to determine which IDE_DRIVE_NUMBER its a specified logical drive?.

I think an example explains better

-Two different hard disks with two partitions each one
-Drive A (serial hddaaa) contains partitions C: and D:
-Drive B (serial hddbbb) contains only one partition with assigned letter E: and another partiton unformatted.

If my app.path start with d:\ how to determine that it's in drive A?
Which value of IDE_DRIVE_NUMBER type belongs?

King regards & sorry for my english

It's possible to obtain this info using WMI but i need an API solution . I'm stuck (VC++) with this descriptive solution finded in google groups:

1. Open a handle to the volume
2. Send down IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS which should return the device numbers of all the disks that that volume spans

3. Enumerate all the disk device interfaces via the SetupDi APIs
4. For each disk
a. Obtain the corresponding device path and open a handle to the disk
b. Send down IOCTL_STORAGE_GET_DEVICE_NUMBER which should get you the disk device number
c. Determine whether the device number matches one of those in (2)

...but no example code

Anyone can help me?

[KProvance]

I looked at your code, just to see if it was something that had not been done before. Imagine my surprise to see the HDD portion was an exact replica of Randy Birch's (http://vbnet.mvps.org/code/disk/smartide.htm), who admitted he picked it up somewhere else. At least he had the decency to give credit where credit is due. Shame on you, sir.

[Doogle]

I looked at your code, just to see if it was something that had not been done before. Imagine my surprise to see the HDD portion was an exact replica of Randy Birch's (http://vbnet.mvps.org/code/disk/smartide.htm), who admitted he picked it up somewhere else. At least he had the decency to give credit where credit is due. Shame on you, sir.

Why are you digging up a Thread that is nearly 6 years old and not contributing to it ?

[rory]

I looked at your code, just to see if it was something that had not been done before. Imagine my surprise to see the HDD portion was an exact replica of Randy Birch's (http://vbnet.mvps.org/code/disk/smartide.htm), who admitted he picked it up somewhere else. At least he had the decency to give credit where credit is due. Shame on you, sir.

I guess you missed this part:

I cant remember the original author but i edited it so i could use the HDD to work as a serial number.

Imagine my surprise when I received this annoying email telling me some clown posted on this old thread.
Shame on YOU, boy.