C# Licensing System
- Thread starter ilPatrino
- Start date
accelerator_dd
Elite Member
- May 14, 2010
- 2,447
- 1,022
I've heard some people use http://installkey.codeplex.com/ but I haven't used it myself yet. Take a look and see if it fits your needs.
Blackberry_11
Regular Member
- Apr 17, 2011
- 266
- 19
I am not sure about this. But if you really need that urgently then you should contact with an expert he might give you some solution about this.
-=hollyuser86=-
Newbie
- Jul 22, 2010
- 28
- 2
there are so many options for integrating licensing to you application.. right now, all licensing can be crackable but depending on the licensing that you have integrated, you can make difficulties for the cracker. and more difficulties the better system. get some idea over the encryption, n-bit technology and also try the online verification system with wcf if you are .NET professional.
metra
Junior Member
- Jun 6, 2012
- 156
- 50
If you're looking for an open source licensing system you could potentially modify, I found this after a quick search:
Link: github.com/ayende/rhino-licensing
It can create license codes, enable/disable certain features in your application based on certain license codes, subscriptions, time-based licenses etc.
When it comes to protecting my own applications, I usually write up my own simple licensing system that takes some 'ID' information from the person's computer, stores it in a database,
and eventually only allow say 2 licenses per user or something of the sort.
Remember: .NET Applications can be reversed extremely easily by anyone with a brain; don't forget to look up some nice .NET Obfuscators for your code, since this is what will truly determine whether or not your software gets 'cracked' in the future. I recommend confuser v1.9 for an obfuscator (on codeplex, open source project - confuser.codeplex.com/releases/view/90044t) - it is a very effective code obfuscator currently, and will prevent your code from being reversed fairly well.
Hope I was of help,
- Metra
RottenYellow
BANNED
- Sep 10, 2010
- 68
- 16
Online authorization with a custom encryption, preferably use TCP and custom server intead of HTTP + obfuscation as Metra mentioned.
metra
Junior Member
- Jun 6, 2012
- 156
- 50
Yeah that was the idea. I would agree with using TCP as it won't show up on any web debuggers such as Fiddler which is nice
You said, "instead of obfuscation"? That I don't understand, because if anyone were to disassemble your application they could easily reverse your 'custom encryption' and find out exactly how your TCP requests are sent, rendering it useless either way.
Chris22
Regular Member
- Sep 29, 2010
- 400
- 1,069
Sexy plugins
ThePacketeer
Regular Member
- Sep 19, 2010
- 373
- 354
I setup an object which has a rsa key encrypted with a public key.
The object also includes the rsa encrypted serialized license object
The license object has the licensetype, and valid dates.
This is all serialized again into base64
So:
LicenseObject -> Serialized -> RSA Encrypted -> Add RSA Key and encrypt with public key -> Serialize -> Base64
The app retrieves this from a WCF service with via https.
Furthermore the app also needs the correct client cert to identify itself (each client has its own cert)
Decodes the rsa key with its private key decodes the rsa string with the rsa key.
Then it deserialized the object and has its license info.
Generally I leave the license valid for 30 days and each time the app starts it gets a new key from the WCF server
The object also includes the rsa encrypted serialized license object
The license object has the licensetype, and valid dates.
This is all serialized again into base64
So:
LicenseObject -> Serialized -> RSA Encrypted -> Add RSA Key and encrypt with public key -> Serialize -> Base64
The app retrieves this from a WCF service with via https.
Furthermore the app also needs the correct client cert to identify itself (each client has its own cert)
Decodes the rsa key with its private key decodes the rsa string with the rsa key.
Then it deserialized the object and has its license info.
Generally I leave the license valid for 30 days and each time the app starts it gets a new key from the WCF server
jazzc
Elite Member
- Jan 27, 2009
- 2,964
- 14,717
Nice. Here 's how to crack it:
Start the program, hook into it and inject custom code, gain full access to the codebase, modify the validation routine to say yes.
ThePacketeer
Regular Member
- Sep 19, 2010
- 373
- 354
Aha! Got you! The validation routine has to return null!
I know, but every application can be hacked like this.
In the end there is always a 1 or 0 to check if your license is valid. There can't be another state...
This license scheme is more meant to force users to connect to the internet every 30 days, so i can invoice them for their usage.
And also to synchronize to the backend servers, otherwise the app becomes useless after a month or two
I know, but every application can be hacked like this.
In the end there is always a 1 or 0 to check if your license is valid. There can't be another state...
This license scheme is more meant to force users to connect to the internet every 30 days, so i can invoice them for their usage.
And also to synchronize to the backend servers, otherwise the app becomes useless after a month or two
jazzc
Elite Member
- Jan 27, 2009
- 2,964
- 14,717
Indeed, you 're absolutely right.
My big disappointment with .net and java is that it 's too easy not only to crack by (much worse) re-brand the software.
It 's a design flaw and there 's no robust solution and that 's why I 'm not doing any programs on either language any more.
RottenYellow
BANNED
- Sep 10, 2010
- 68
- 16
Most people have no idea what wireshark is or how to use it and even if they do they got custom encrypted auth protocol to deal with.
RottenYellow
BANNED
- Sep 10, 2010
- 68
- 16
There are so many ways to protect the app, as long as it cannot be decompiled, you can make it very very difficult to reverse engineer the protocol.
For example:
client connects to server
server sends a random challenge (client accepts only unique challenges)
client solves the challenge sends the answer to the server
server sends another challenge which client will calculate and decide ether to authorize or no
And that's just basic idea, you can take it to the next level with multiple challenge algorithms and mix in bunch of crazy math etc..
For example:
client connects to server
server sends a random challenge (client accepts only unique challenges)
client solves the challenge sends the answer to the server
server sends another challenge which client will calculate and decide ether to authorize or no
And that's just basic idea, you can take it to the next level with multiple challenge algorithms and mix in bunch of crazy math etc..
jazzc
Elite Member
- Jan 27, 2009
- 2,964
- 14,717
jazzc
Elite Member
- Jan 27, 2009
- 2,964
- 14,717
No. See one of my previous responses. You don't even need to decompile or de-obfuscate it, you can inject code while it 's running (when it 's running, it 's de-obfuscated).
RottenYellow
BANNED
- Sep 10, 2010
- 68
- 16
You're right. What about if you add a method that checks for any of these code injection apps and app simply shuts down if it detects any suspicious apps running?
Also, what about signing binaries? it wouldn't make any difference since the 'loaded' code can still be accessed in memory and they could just make an application that disables security through memory?
Last edited: