Click here to Skip to main content
Click here to Skip to main content

Protecting an Application's Unauthorized Copy

By , 2 Aug 2013
Rate this:
Please Sign up or sign in to vote.

Introduction

At the time of installation most software asks for a product key or a serial number; this is to prevent software piracy, but how is this done? In this article, I'll try to cover one basic idea to achieve this. It is advised not to use this in professional software as someone can easily break it.

In each Windows portable executable (PE image file) we can add some certificate (some sort of data) using the image integrity functions (Platform SDK's ImageHlp APIs). The certificate data can be generated using a combination of product keys and some unique IDs for the desktop where the user is installing the software. These unique IDs can be CPU ID, primary volume ID, network card ID etc. To increase the security we can do some encryptions on the certificate data. Writing certificate data in the executable should be done only once, i.e. at the time of installation. At the time of the application startup we can again generate the certificate data using the local machine (where the user is executing the application) unique IDs and compare it with the certificate data which is present in the executable. If there is any mismatch, stop the execution.

In the above approach there is a problem, what if the user changes some hardware component (for e.g. graphics card) and what if that component's unique ID was used to generate the certificate data? Certainly now our application will stop execution because of the mismatch in certificate data. But we do not want this to happen. To avoid this we can use 4-5 unique IDs to generate the certificate data. At application startup, we can make a rule; if any two IDs are matching go ahead otherwise show error for unauthorized copy.

In the demo application, to generate the certificate data, I am using the primary volume ID without any encryption. At the time of application startup, I'll check if there is any certificates present in Sample.dll, if no certificate is present, add a certificate to Sample.dll (actually this task should be done through the installation script) and only the certificate verification code should be present in the executable.

Using the Code

To integrate the certificate manager in your application you need to do the following:

  1. Include "CertificateMgr.h", and imagehlp.lib in your project's additional libraries.
  2. Create an object of CertificateMgr.
  3. Call the Init() method with a portable executable (PE) image file name in which you want to manage the certificate.
  4. Call SignDLL() to add a signed certificate (only inhouse job) so that later at the time of adding an actual client machine certificate it can be verified that we are adding certificate to right DLL. It will be better if you make a command line utility do this. Ofcourse you will not ship this with your actual application.
  5. Call IsValidCopy() to check if the application has a valid certificate or not.
    CertificateMgr certificateMgr;
    
    // Specify dll or exe where you are adding certificate.
    
    if (!certificateMgr.Init("Sample.dll"))
    {
        cout <<"Initilization errors, some files are missing.\n\n";
        MessageBox(NULL, "Initilization errors, 
                      some files are missing", "MyApp", MB_OK);
        return 1;
    }
    if (!certificateMgr.IsValidCopy())
    {
        cout << "Running unauthorized copy :(\n\n";
        MessageBox(NULL, "Running unauthorized copy", 
                                         "MyApp", MB_OK);
        return 1;
    }

Certificate Manager Class

In this class, I am using ImageAddCertificate and ImageGetCertificateData Win32 SDK APIs.

GetUniqueData() method generates unique data to be put in the PE certificate. While adding a certificate using AddCertificate(), I am keeping the last modified time, and after adding the certificate, the executable is maintained with the previous modified time to simulate an impression of no changes. For the sake of simplicity, I first check if there is any certificate added, if no certificate is found, add it. From the next execution onwards, verify the PE certificate data with the data returned from GetUniqueData(). In real applications, AddCertificate() should be called at the time of application installation before executing the application.

I could not find any good documentation on image integrity functions (Platform SDK's ImageHlp APIs). If you know about any good URL/book for ImageHlp APIs, please add a comment. Discuss more on this at Activation code.

History

  • 27th November, 2005: Initial revision.
  • 21st August, 2008: Now a simple ImageRemoveCertificate will not break the copy protection, yes one can write something to copy certificate data. Thank you Daienl for pointing this.
  • 21st February 2013: Fixed small leak and a bug.
  • 2nd August 2013: Added C# sample application.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

About the Author

Manish K. Agarwal
Software Developer (Senior) Oracle
India India
Working with Oracle. Using C/C++, VC++, MFC, STL, C#, Java etc. on various platform like Windows, Unix, Macintosh etc. from last 13+ years to convert various type of requirements into running software components. My core expertise is multithreaded desktop product and large scale enterprises software development.
Follow on   LinkedIn

Comments and Discussions

 
GeneralMy vote 5 Pinmemberjaganmohan2066-May-13 20:55 
GeneralMy vote of 3 PinmvpMichael Haephrati13-Mar-13 2:23 
GeneralMy vote of 2 Pinmemberlavrentiy.s25-Feb-13 15:35 
QuestionSame old story over and over PinmemberObiWan_MCC25-Feb-13 2:51 
AnswerRe: Same old story over and over PinmemberErik Burd25-Feb-13 9:03 
QuestionAssuming certificate index is always 0 Pinmemberubivetz7-Apr-09 3:20 
AnswerRe: Assuming certificate index is always 0 PinmemberManish K. Agarwal7-Apr-09 21:35 
for simplicity reasons. If you are not sure on which index your certificate will be you can use ImageEnumerateCertificates() and check every certificate for your data.
 
Manish Agarwal
manish.k.agarwal @ gmail DOT com

Generalnice, But it's an simple & hot........ PinmemberMember 423560118-Feb-09 10:30 
Generalif hacker jump out your if statement Pinmembermike101821-Aug-08 22:26 
GeneralRe: if hacker jump out your if statement PinmemberManish K. Agarwal22-Aug-08 2:18 
GeneralGreat and simple idea, but dangerous... PinmemberDaniel Schade16-Aug-07 3:29 
GeneralUnique Information PinmemberJeffrey Walton24-Jun-07 7:25 
GeneralCopy protecting a Video DVD PinmemberGodwin Sam Josh15-Jul-06 19:54 
GeneralRe: Copy protecting a Video DVD PinmemberManish K. Agarwal16-Jul-06 21:50 
GeneralRe: Copy protecting a Video DVD Pinmembervmihalj18-Sep-06 1:24 
GeneralRe: Copy protecting a Video DVD PinmemberGodwin Sam Josh18-Sep-06 8:19 
GeneralRe: Copy protecting a Video DVD Pinmembervmihalj18-Sep-06 22:11 
GeneralRe: Copy protecting a Video DVD Pinmemberdusty_dex22-Feb-13 7:27 
QuestionConfused??!!?? PinmemberAnorexic Tribble3-Dec-05 6:36 
AnswerRe: Confused??!!?? PinmemberManish K. Agarwal3-Dec-05 17:04 
GeneralRe: Confused??!!?? Pinmemberdusty_dex22-Feb-13 7:32 
GeneralRe: Confused??!!?? PinmemberManish K. Agarwal25-Feb-13 21:35 
GeneralRe: Confused??!!?? Pinmemberdusty_dex26-Feb-13 1:43 
GeneralRe: Confused??!!?? PinmemberManish K. Agarwal27-Feb-13 2:29 
GeneralGood Idea PinmemberSumit Kapoor28-Nov-05 18:38 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web03 | 2.8.140415.2 | Last Updated 2 Aug 2013
Article Copyright 2005 by Manish K. Agarwal
Everything else Copyright © CodeProject, 1999-2014
Terms of Use
Layout: fixed | fluid