Who has implemented a licensing API/SDK

Started by
24 comments, last by codingo 10 years, 6 months ago


If you do not require online validation the program itself needs to validate the key and any decent hacker can extract whatever counts as the private key from the executable.

The private key can't be extracted from the executable, because it's not stored there.

The developer signs a message with the private key which they keep secure and don't distribute. The application which contains the public key can then verify that the message is signed by the developer.

See http://en.wikipedia.org/wiki/Public-key_cryptography

Advertisement

My experience was that it was an utter waste of time and trivially cracked by an amateur reverse engineer (me) in a matter of a few minutes for the simpler solutions, and a couple of days of hardcore reversing for the more sophisticated options out there. (I won't name them, for legal reasons.)

Can you tell me what tools you used to crack your app? I've implemented a very basic scheme so far and would like to see what is visible to the potential hacker.

Tools aren't really important - understanding the machine code and how to modify it are what really matters. Even the debugger shipped with Visual Studio is plenty to reverse most apps, combined with a hex editor and careful fingers. If you're really industrious you might learn and love WinDbg. OllyDbg is also pretty good and has some handy tools.

There are of course other high-caliber options out there, but they're generally expensive and don't offer much if you don't already know what you're doing.

Wielder of the Sacred Wands
[Work - ArenaNet] [Epoch Language] [Scribblings]

Thanks Apoch, just youtubed it and saw how easy it is to crack a serial key. sigh

My $0.02: don't put much time into it. As others have said, all it will do is end up annoying your legitimate customers.

If you really feel you must do something like this, favour unobtrusiveness and simplicity over security. No matter what you do (short of hosting all the content remotely) it will be cracked, so look at your DRM as something to inconvenience amateurs rather than something that will stop determined hackers.

if you think programming is like sex, you probably haven't done much of either.-------------- - capn_midnight

@ChaosEngine - I think you are right. That is how I am approaching it. I just wish it wasn't SO easy. It is easier than registering the product! No wonder so many companies are gravitating towards cloud SAAS solutions.

This topic is closed to new replies.

Advertisement