Best way to check for license [closed]

Closed. This question needs to be more focused. It is not currently accepting answers.

---

Want to improve this question? Update the question so it focuses on one problem only by editing this post.

Closed 7 years ago.

开发者_高级运维 Improve this question

We have a custom license check method, which is very simple, we just check a registry key(a string, set by another process based on different parameters) and grant license or reject.

I came to know that, anybody can simply crack this, once they get to know which regkey we are looking for. Or by searching for cmp instruction in assembly code. I just wanted to know better solution for this license check problem. I may not need very complex procedure or any such. But if it should be little better than current one.

I use C++\VC++ with windows 7.

Thanks & Rgds, calvin

---

The only way to totally prevent cracking is to use a pay as you go based hosted application accessed by users remotely. That way someone without a valid paid account can not use the application, and anyone handing his account credentials to other will pay for their use as well as his own.

No code (except possibly a stub to allow logging in) is ever sent to the client, let alone stored there, so the client can't ever operate without connecting to your server (which will hopefully not get compromised, but that's a sysop problem, not a coding problem).

Any other system you may adopt will essentially have to rely on the legal clout behind your license to deter people from cracking it.

---

You need to somehow protect your code against reverse engineering; there are many so-called executable file protectors and I will not name it here. Regardless of what you calculate, just two NOP instructions will push the flow of the protection check in undesired direction.

Of course, it really matters what kind of code you are protecting; for interpreted languages it is almost impossible to protect yourself.

Ah, sorry, I can name one, non-commercial: infamous Yoda's PE Protector.

---

You could calculate a hash from a hardware-specific value and check for that value in the registry. This way it wouldn't be enough to find which value you are looking for, but also the algorithm.

A mathematically sound way of doing this is would be to turn the computer-specific value (e.g. MAC address) into a prime number, multiply it with your own magic prime number and store the product.

Edit: Note, though, that it usually is not worth bothering with any protection scheme except very simple ones. Even large corporations are struggling with this problem.

---

Any logic running locally will always be prone to circumvention. With regard to the actual storage of a license depending on your application I would write a web service and run your own server. Get the app to check with your service each time it starts that the license is still valid.

This also gives you much more flexibility for example you could revoke a licence if payment doesn't clear.

---

You can accomplish this using public/private key encryption. Have local signed file instead of the registry that contains information about the license and having a web server to check the license is valid once in while. This should give you enough protection.

This can be done with LicenseSpot. On the site there's sample code, although only in c#.