Copy Protection...

[DeepBlueCode]

If I was to burn my new Visual Basic 6 program to a CD-R and distribute it with packaging and all, how could I stop people from simply copying the CD and giving it to their friends (I don't have the money to let them do this). Is there any kind of program that prevents people from ripping me off or anything?

[Nucleus]

Read and write an encrypted code to the registry, and add a checksum to ensure your exe has not been tampered with. Megatron has an example of simple xor encryption, or see www.kedaman.com (when site is available that is) for more secure encryption algorithm.

[DeepBlueCode]

Can you please explain that out a little more, how I can go about finding out exactly how to do it, etc.

[Nucleus]

Assuming you know how to read and write to the registry, here is an encryption algorithm from Kedaman: Just pass it the string (code in this case) you want to encrypt, the key (any length string), and a seed for the random number e.g. 100)

To decrpyt the string just call the function again and pass it the encrytped string, and the same key and seed, and it will decypt the string.

Function KKRSE(text As String, Optional Key, Optional Seed) As String
Dim ab1() As Byte, ab2() As Byte, keylen%, aa$
    ab1 = StrConv(text, vbFromUnicode)
    If IsMissing(Key) Then
        For n = 0 To UBound(ab1)
            ab1(n) = 256 - ab1(n)
        Next n
    Else
        aa = Key
        ab2 = StrConv(aa, vbFromUnicode)
        If IsMissing(Seed) Then
            For n = 0 To UBound(ab1)
                ab1(n) = ab1(n) Xor ab2(n Mod Len(aa))
            Next n
        Else
            Rnd -1
            Randomize Seed
            For n = 0 To UBound(ab1)
                ab1(n) = ab1(n) Xor ab2(n Mod Len(Key)) Xor Int(Rnd * 256)
            Next n
        End If
    End If
    KKRSE = StrConv(ab1, vbUnicode)
End Function

[Krushstone]

How would an encrypted code in the registery prevent people from making a copy of the original CD?

If you want to prevent this, you need to use a software that will make the copied CD useless. (such as Safedisc, Securom, Laserlock...)

I think that the way to do that is to make a exe that will read the true exe located in hidden sectors on the CD.
In consequence, the CD will be needed to use the program.

How do you do that?
In my opinion, don't do it!

Some CD burner software are able to copy CD protected with these methods.
Even if your burner isn't supported with this software, you can still find patched exe of the program that you're copying. That will allow run the program by using the patched exe instead of the one that came with the installation.

Don't you think that microsoft would prevent the copy of Windows, VS and Office if it could?


Krushstone

[Michael Woolsey]

To be honest, I don't think you can stop people. If they are that determined to get your program nothing you do will stop them.

In my opinion it comes down to how hard do you want to make it on them? If you make it hard enough, that will stop a lot of people from bothering because it isn't worth the hassle... but it will not stop everyone.

Now I could be wrong, but I don't think there are any programs out there that can't be copied (that are availabe to be purchased).

(I don't have the money to let them do this.)

If you can't afford to have your program copied, you may want to put some serious thought into if it is a) worth being stolen (no insult is intended, just some programs aren't worth it), and b) how much you potentially stand to lose. If it is too much, you may want to reconsider distribution.

Just some random thoughts.
Michael

[Zevlag]

Well just to add,

I have not found ANY application or game that CANNOT be copied. All the new games with SecureROM 2 and SafeDisk2 I have been able to copy just fine and dandy. Yes most people cannot/don't know how to do it but it is done quite easily if you have a quality CD-R drive and a nice piece of software. (which I won't give brands for security purposes(but certainly EasyCD Creator won't do it, neither will Nero do most of them)

Zevlag

[Nucleus]

You can't stop someone copying a cd, however, through the use of encryption and checksums you can make it very difficult for would be crackers. Instead of giving up, I prefer to fight back a little

[lord_dude]

Have you heard of what ms are appearently doing with office xp? You install it and it give the user a unique key generated by a sum from their hardware. They then have to get in touch with ms with a certain amount of time and give that code to ms who will then give them a key back. If they dont, office will stop working.

[Chris]

How about to prompt for registration key upon setup the program?

Procedure
1. Modified the Setup1.EXE that come along with VB.
   a. Setup1.EXE should be able to generate a system key/reference key
      base on:-
        i. Remaining Free diskspace.
       ii. Current system Date/Time.
      iii. User input like Name, org or email.
           sample system key: HG24G JK2SK C2HS2 HQLQU GFDKA
       iv. Save this into registry (posible encrypt it)
   b. Include a new product key input form.
   c. User should get the Product key base on the generated system key
      through phone call/email.
   d. Product key generator should be able to mesh up the 25 
      character in the system key and reformat a new product key.
2. ReCreate a P&D with the new Setup1.EXE

[DeepBlueCode]

I do not have the time right now to implement this, but thank you very much, that should be helpful. I know I can't stop a lot of people from copying it, but I want to stop some lamer parents who don't give a care about my profit or anything. I want them to not be able to copy it with the common CD-RW and copy of Easy CD-Creator, basically I want to stop as many copy attempts as possible.

[Juan Carlos Rey]

NSLock is freeware. It lets you set a code to enable the program.
It works this way: when the program is first installed in the user machine, it generates a random code. The user phones/mails to you this code, and you process it and a password of your own in a little .exe that will return a validation code for your user. Then the program will work OK.
You can enable/disable certain portions of your programs (print, save, etc) to let the user evaluate the program, and when they are sure, they can pay you and get the validation code.
Surfe the net for details.

[reivaJ]

Well if it is such a pain in the ass you might want to distribute your program inside floppy disks and put some code inside your setup file that checks for the floppy serial number and if it doesnt match then the setup file doesnt work and wipes out the other files inside the disk

The only problem with this is that floppies might not be able to store your app without using a lot of them

But the big problem i think are the runtime files they are big so why dont you distribute a CD and a floppy the CD contains all runtime files and stuff not vital for the app (This usually takes a lot of space) and inside the floppy just attach the app EXE file and well it wont matter if you copy the CD because then the app wouldnt work without the files inside the floppy.

Just remember that anyway everything is crackeable and that for doing this you will have to make your own setup program.

But this might help you i hope it does

[Nucleus]

reivaJ, that is not a bad idea reivaJ, how so you extract a SN for a floopy?

Also is it possible to get an equivalent to a floppy SN for a CD?

[reivaJ]

You think its a good idea
well i dont know how to get the SN in VB but i do remember that if you go to DOS and type Dir or format at some point it displays the SN, i dont know about getting a CD SN but it might be a good thing to do.

[reivaJ]

i found this code on the net it works great i think the only need for this is to display the serial number as Hex(Just add the function)

Option Explicit


Private Declare Function GetVolumeInformation& Lib "kernel32" _
Alias "GetVolumeInformationA" (ByVal lpRootPathName _
As String, ByVal pVolumeNameBuffer As String, ByVal _
nVolumeNameSize As Long, lpVolumeSerialNumber As Long, _
lpMaximumComponentLength As Long, lpFileSystemFlags As _
Long, ByVal lpFileSystemNameBuffer As String, ByVal _
nFileSystemNameSize As Long)
Const MAX_FILENAME_LEN = 256


Private Sub Command1_Click()
Label1.Caption = SerNum("C") 'C is the standard harddisk
End Sub


Public Function SerNum(Drive$) As Long
Dim No&, s As String * MAX_FILENAME_LEN
Call GetVolumeInformation(Drive + ":\", s, MAX_FILENAME_LEN, _
No, 0&, 0&, s, MAX_FILENAME_LEN)
SerNum = No
End Function


well i dont know but i am starting to think that the serial number comes from the files inside the CD or floppy and not from the disk itself so maybe 2 cds with the same info might have the same serial number and that would suck i hope im wrong

[Nucleus]

You might have cracked it reivaJ (no pun intended). Well done.

Cheers and kudos to you!

[reivaJ]

I tried making a program that read the serial number from its own floppy and if the serial number was different from the programmed one it would display something saying the app was not in its original diskette but the thing is

if i copy only the file im interested on then the it works because the serial number in the other disk is different

But if i copy the entire original floppy using disk copy the Serial Number of the original floppy becomes the serial of the copied one

Please someone else give this a try i think this may help us a lot
if you wanna see the code of the program just ask for it

[reivaJ]

Does anyone know if the same thing happens when you copy a CD?

[reivaJ]

Well maybe the best but most complex solution is to use a dongle for your app

[Megatron]

Originally posted by Nucleus
Megatron has an example of simple xor encryption

Here it is:

Sub EncryptFile(ByVal sName As String)

    Dim b() As Byte
    Dim nb() As Byte
    n = FileLen(sName)
    ReDim b(n - 1)
    ReDim nb(n - 1)
    
    Open sName For Binary Access Read As #1
    Get #1, , b()
    Close #1
    
    Kill sName
    
    For i = LBound(b) To UBound(b)
        nb(i) = b(i) Xor 5
    Next i

    Open sName For Binary Access Write As #1
    Put #1, , nb()
    Close #1

End Sub

[Nucleus]

reivaJ, unfortunately same problem with cds. Nice try though.

[reivaJ]

I once saw an example of a copy protection thing with some disks apparently the disks intercepted the copying attemps from the OS and made them bounce around the thing was that it looked like you were copying the files but when you checked the other disk it was empty
cool isnt it well the bad side of this is that this was designed for DOS hehehehe.

[Yash_Kumar]

Well, I thought of it overnight. I got 2 new radical ideas on how to prevent the copying of a CD.

1) Whenever you copy files in Windows, it changes the last date of modification (BANG!!!!). So whenever your installation program runs, you can run a boostrap that make sures that a file on the cd has the same date of modification when you actually copied the cd.

2) This idea will make sure that your software will not run on more then one PC!!! It involves selling your CD ROM with a floppy as a writable media. Whenever your setup shield runs, you can run a boostrap that checks to see if the software has been installed (from a file on the floppy), if not, it will go ahead with the installation. On going ahead with the installation, it will make a file in the windows directory and also write to a sector of the floppy saying that it has been instaled or something like that. If the floopy indicates that the program has been installed, it will check for that file in the windows directory. If it's there, it will know the software has been installed on that PC before and will go on installing it again. If not, it will know the software is being installed on a new PC. It's as simple as that.

[reivaJ]

Check out my theory please make some suggestions its kinda like Yash_Kumar said but please make some suggestions so we can make a good protection scheme.

[Krushstone]

Well, what if the guy knows your protection and format a brand new floppy which allow to choose the serial number that will be given to the floppy disk (yes, that's possible).

He just has to copy the floppy BEFORE installing the software .

And what if I'm totaly legal and that i format my hard drive and that his serial number changes? my floppy will be erased?

The serial number of a disk is only a random number give to it right after it is formated. If you know where this number is located on the disk then you can change it.

I just looked at a test CD that I have. it as 13 sessions on it, and I can choose the session that I want to access (maybe because I have EZ CD installed)

The point is that I tried 2 different sessions and they didn't have the same serial number! Which is normal in my opinion, but makes me doubt that it is a good idea to include a disk's serial number within a protection.

Krushstone

[RoyceWindsor1]

Reivaj,

If you want to use the floppy method, there are some tricks that old DOS programs used to use. Peter Norton talks about them in The PC Programmer's Bible if you're interested.

It involves renumbering the sectors on the floppy disk and using BIOS disk services to read from them. This will (he claims) keep apps using DOS file services from reading all the data on the disk (ie. from copying it). I'm not sure what complications you would run into, but I'm sure you'd need routines in assembly to (1) create the disk and (2) to read from it during install.

Again not fool-proof, but likely to fool almost everyone...

John

[RoyceWindsor1]

One other thing Reivaj,

When you create the floppy originally, add an encrypted file that uses the serial # of the floppy itself.

When someone tries to copy the disk "out-of-the-box", the new disk will have a different serial number but the same encrypted file. Your install routine can decrypt the file, check if the serial number matches the one in the file, and then proceed with installation.

John

[DeepBlueCode]

I never thought my question would spark such an interest in copy protection. I think these are all great ideas, what we need to all do is form one theory to stop cd copy and use it and/or present it to companies or something. I just think we have something going here.

[DeepBlueCode]

Originally posted by Yash_Kumar
Whenever you copy files in Windows, it changes the last date of modification (BANG!!!!). So whenever your installation program runs, you can run a boostrap that make sures that a file on the cd has the same date of modification when you actually copied the cd.

This is a good idea, am I missing something as to why it wouldn't work?

[navarchy]

I think that if the pirater just changed the date on there computer to the date the file was modified and then copied it, it would still run.

[scoutt]

I don't know about you guys, but if I spent 25-40 bucks on a program and found out I bought a floppy, I would be pi$$ed. Aslo you have to take in the fact that floppies are not reliable. good one second and bed the next, heck, bad right out of the box.

And there are programs out there that cannot be copied. When I was in college we had a cd that had a program on it for the electronics class and it was setup on one computer. the thing is, once it was loaded on there the key was no good. I looked all over for that SN in the registry and finally found it. It didn't matter though it didn't work. I was told later that the key for the program was on the cd and everytime it loaded on the computer it added to itself on the cd. Don't ask how it was done but that is what the company told us. I know that sounds strange if not impossible but I was unable to get that program to work without ordering a new key.

I also heard that the Simms Game CD is very hard to copy. Haven't tried it but that is what people are saying. even if you got the patch for the copyright protection.

Just my 2 cents

[Jethro]

Originally posted by lord_dude
Have you heard of what ms are appearently doing with office xp? You install it and it give the user a unique key generated by a sum from their hardware. They then have to get in touch with ms with a certain amount of time and give that code to ms who will then give them a key back. If they dont, office will stop working.

Give me a break. The local MS Office couldn't find their own asses with both hands. This sucks, typical Microsoft.

DeepBlueCode

You have to be careful not to upset legal users while protecting yourself from pirates.

Our software has no copy protection what so ever. Sure it is being used illegally, but we have this big notice on the CD about convicting pirates. Had a copy of extra sales when finding illegal copies. The threat of our lawyers, FunnelWeb WHite Pointer & Associates, is normally enough.

Currently doing a software audit for a majort customer. Ten illegal copies of our software, (getting the cheque MOnday) and hundreds of Windows and Office. Have organised a site licence for em.

[DeepBlueCode]

Thanks for good advice Jethro and and thanks for your two cents. I just don't see why the modified date thing wouldn't work. Sure, it's simple, but it *MIGHT* work. I don't know, I jsut can't afford to have some lazy parents spreading my software like a disease. Since I will be making about 300+ copies of it, I'm thinking that I could ID each one and do something with that. I am a first time ditributor for this app (I've never tried to sell a program before) and I want to make sure that my program that is truly a great idea, does not get spread out of my city and into the internet, where it will become freeware on Chinese FTPs. I am only selling the software in my city you see and I want to make sure it stays here before some major company steals it and copies it.

[Jethro]

Originally posted by DeepBlueCode
Thanks for good advice Jethro and and thanks for your two cents. I just don't see why the modified date thing wouldn't work. Sure, it's simple, but it *MIGHT* work. I don't know, I jsut can't afford to have some lazy parents spreading my software like a disease. Since I will be making about 300+ copies of it, I'm thinking that I could ID each one and do something with that. I am a first time ditributor for this app (I've never tried to sell a program before) and I want to make sure that my program that is truly a great idea, does not get spread out of my city and into the internet, where it will become freeware on Chinese FTPs. I am only selling the software in my city you see and I want to make sure it stays here before some major company steals it and copies it.

So you haven't discussed this with Bill Gates yet then. Bet the guys at netscape are kicking themselves for inviting Bill over to look at the new software.

We distribute a database called mvBase. That uses the current date in its actervation generation. You have to email, the serial number and date of install, they send back a 30 character code to activate it. Yeap, have tried installing the db the next day on the same PC using the code, and it don't work. Still is a major pain in the ass, waiting for the code.

[DeepBlueCode]

I understand that every software company has the same problems, it's just I want to try to do something about it instead of giving in to the a-holes of the internet (hackers, crackers, and slackers). I'm gonna give them hell trying to copy my program, just need to know where to start.

[Jethro]

Originally posted by DeepBlueCode
I understand that every software company has the same problems, it's just I want to try to do something about it instead of giving in to the a-holes of the internet (hackers, crackers, and slackers). I'm gonna give them hell trying to copy my program, just need to know where to start.

Wish you luck.....nearly every product gets hacked and posted on the web. Some one posted a link to getting vb6 a while ago.

[skuzzle]

When you copy a cd using most burning software, there is an option to preserve the original dates and times. This is where the problem lies.
SafeDisc etc are probably the best methods to use, although these are still not entirely impossible to get round.

[rsitogp]

I'm sure my idea is stupid and old but it works!
What I did is created a php script that checks a file which has:
username,password,computername
Then I added a webbrowsercontrol in my app which is invisible, then when the app loads and the user types his username/password it posts to a checkuser.html page on my server the username password and winsock1.localhostname (network computername) and the script prints "OK" or "NO" and the program responds by that.
and I made it build a log file so I can see if people tried to get in or just typed wrong info.

[scoutt]

actually that is pretty smart. but what if the user was not online?

I do like your idea though.