well cracking the time server thing is verry easy... just chage the lmhost file for the time server as the local system and run a local time server which sends out a different date as required....
so when ever your application requests for time it is got from the local time server controlled by the user.... what ever encryption you use to save time will not matter....
If someone really wants to break it, they will. I cannot think of an encryption scheme that does not have some hole in it somehwere along the way for this particular application. You can at least make it difficult (i.e. don't write the date straight to the registry with no form of scrambling).
Store the date by breaking up each digit into two digits, maybe by making each nibble its own byte. Then you could use various scrambling methods by rearanging them and storing it as hex or something.
What is C++?
Originally Posted by Vicious
...............in different parts of the system
>>That's one way to defeat any attempts to bypass your security -- require that all steps must be completed in initializing it.
Oh. Thought you were talking about requiring a time check on every startup.
>>I'm just suggesting that you have some value like 10-30 seconds to blow up on.
That's a very long time; depending on the program, someone might close and reopen it within 5.
>>but it does severely cut down on the number of times you can use the "set clock back" trick to use the program.
Not if you set the delay to a reasonable time interval - for example 2 or 3. Then the advantage would be marginal. In any case, assuming the user has internet access, the time re-checks would kill most clock set-back attempts.
>>Plus you have to remember exactly when you used it last, no errors.
As is the case without it as well
If you want foolproof though, install a separate monitoring program that runs on startup in the background and keeps track of the time, and require that the process be running before you open the desired application. And require a password before the process can be started, so the user can't fake that the process was running all along. There may be an ethics issue here, but if you're really determined not to let them bypass your security then anything goes
[edit]True, that can be bypassed too. But we're getting closer[/edit]
**EDIT**
About the local time server, wouldn't that only work if you use some API call? Otherwise, you could set up your own internet time server and use sockets to get the time.
Last edited by Hunter2; 10-02-2004 at 06:16 PM.
Just Google It. √
(\ /)
( . .)
c(")(") This is bunny. Copy and paste bunny into your signature to help him gain world domination.
You can crack anything. If it's made with code, it can be hacked with code. But about 85% of your users are not going to even try to hack into it. Just do what WinZip does and continue to pop up some annoying dialog telling you to register. I'm not a real big fan of crippleware myself.
Heh - a recent piece of software I evaluated used to crash in its own nagware screen.
Personally, I think you should be making sure your program does all that it should do and not waste excessive amounts of time creating all sorts of bizarre (and therefore more likely to be buggy) licence enforcement code. As Bubba says, the vast majority wont even bother to attempt to bypass it, and it only takes ONE determined hacker to figure out how to do it and post it to the net for everyone else to know how to do it.
> I'm making a program for a company
You're on much safer ground here, copyright and licencing is much easier to enforce against companies than random members of Joe Public.
You have one user, and you know where they live.
Also, what sort of licence did you agree to - per seat, per site or per company?
I assume that the software is very specialised for what that company wants, and is otherwise pretty useless to anyone outside the company.
Just remember, if you implement something which changes the functionality of your program in a way which you do not document (say your calculation barfs crossing daylight saving, and even registered copies stop working), then the company could well have legitimate claims against you.
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
If at first you don't succeed, try writing your phone number on the exam paper.
Ok, its time to answer your questions now I think...
The deal is that this program is indeed VERY specialised to a special company and their needs.
It is for a company dealing with freezers and similar and they need it to calculate pipe size and stuff.
BUT for one company we are doing it for free (as a project in school) and that company has contact with ~22 other companies in the same bransch and it is for them we need an evaluation trigger. Sure it is easy with copyright and stuff. But still we wan't to do this so they can test the program and then decide wether to buy it or not.
And I'm pretty sure there ain't no crackers in those companies, so it only has to be a basic counter (and not through internet as someone said as the program is gonna be used on offline PC's too).
Of course the program will not be buggy or something...
But we will make 2 versions of it we think... One that is limited and one that is fully enabled and they will have to pay for it.
But still we don't wan't the program to have some things and that can be used forever...
I hope that will clarifie some things.
Well, thanks for all the replies anyway I think I will be able to make something out of it.
This is not a programming answer, but more a philosophy consideration--amount of time you've had the program is not the fairest cutoff for when to cutoff trial usage. If you download something, use it once or twice for a couple minutes, forget about it for a while, and then try to start it again after the cutoff date, you may not have had a chance to really test it out to see if you want to get it.
I think a fairer way to measure whether the user has had a chance to try the program out adequately is # of times he's used it, or length of time he's had it open. So give him like 30 tries, or 30 hours of usage, or something like that.
But, the thing with the trial is that these companies will use the program almost everyday as they do a lot of calculations everyday!
So no use for "30 times start" or so....
