Click here to Skip to main content
Click here to Skip to main content

Protecting an Application's Unauthorized Copy

, 2 Aug 2013 CPOL
Rate this:
Please Sign up or sign in to vote.
To protect your application's unauthorized copy by using image integrity functions (Platform SDK's ImageHlp APIs) and to manage certificates in a portable executable (PE) image file.

Introduction

At the time of installation most software asks for a product key or a serial number; this is to prevent software piracy, but how is this done? In this article, I'll try to cover one basic idea to achieve this. It is advised not to use this in professional software as someone can easily break it.

In each Windows portable executable (PE image file) we can add some certificate (some sort of data) using the image integrity functions (Platform SDK's ImageHlp APIs). The certificate data can be generated using a combination of product keys and some unique IDs for the desktop where the user is installing the software. These unique IDs can be CPU ID, primary volume ID, network card ID etc. To increase the security we can do some encryptions on the certificate data. Writing certificate data in the executable should be done only once, i.e. at the time of installation. At the time of the application startup we can again generate the certificate data using the local machine (where the user is executing the application) unique IDs and compare it with the certificate data which is present in the executable. If there is any mismatch, stop the execution.

In the above approach there is a problem, what if the user changes some hardware component (for e.g. graphics card) and what if that component's unique ID was used to generate the certificate data? Certainly now our application will stop execution because of the mismatch in certificate data. But we do not want this to happen. To avoid this we can use 4-5 unique IDs to generate the certificate data. At application startup, we can make a rule; if any two IDs are matching go ahead otherwise show error for unauthorized copy.

In the demo application, to generate the certificate data, I am using the primary volume ID without any encryption. At the time of application startup, I'll check if there is any certificates present in Sample.dll, if no certificate is present, add a certificate to Sample.dll (actually this task should be done through the installation script) and only the certificate verification code should be present in the executable.

Using the Code

To integrate the certificate manager in your application you need to do the following:

  1. Include "CertificateMgr.h", and imagehlp.lib in your project's additional libraries.
  2. Create an object of CertificateMgr.
  3. Call the Init() method with a portable executable (PE) image file name in which you want to manage the certificate.
  4. Call SignDLL() to add a signed certificate (only inhouse job) so that later at the time of adding an actual client machine certificate it can be verified that we are adding certificate to right DLL. It will be better if you make a command line utility do this. Ofcourse you will not ship this with your actual application.
  5. Call IsValidCopy() to check if the application has a valid certificate or not.
    CertificateMgr certificateMgr;
    
    // Specify dll or exe where you are adding certificate.
    
    if (!certificateMgr.Init("Sample.dll"))
    {
        cout <<"Initilization errors, some files are missing.\n\n";
        MessageBox(NULL, "Initilization errors, 
                      some files are missing", "MyApp", MB_OK);
        return 1;
    }
    if (!certificateMgr.IsValidCopy())
    {
        cout << "Running unauthorized copy :(\n\n";
        MessageBox(NULL, "Running unauthorized copy", 
                                         "MyApp", MB_OK);
        return 1;
    }

Certificate Manager Class

In this class, I am using ImageAddCertificate and ImageGetCertificateData Win32 SDK APIs.

GetUniqueData() method generates unique data to be put in the PE certificate. While adding a certificate using AddCertificate(), I am keeping the last modified time, and after adding the certificate, the executable is maintained with the previous modified time to simulate an impression of no changes. For the sake of simplicity, I first check if there is any certificate added, if no certificate is found, add it. From the next execution onwards, verify the PE certificate data with the data returned from GetUniqueData(). In real applications, AddCertificate() should be called at the time of application installation before executing the application.

I could not find any good documentation on image integrity functions (Platform SDK's ImageHlp APIs). If you know about any good URL/book for ImageHlp APIs, please add a comment. Discuss more on this at Activation code.

History

  • 27th November, 2005: Initial revision.
  • 21st August, 2008: Now a simple ImageRemoveCertificate will not break the copy protection, yes one can write something to copy certificate data. Thank you Daienl for pointing this.
  • 21st February 2013: Fixed small leak and a bug.
  • 2nd August 2013: Added C# sample application.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Manish K. Agarwal
Software Developer (Senior) Oracle
India India
Working with Oracle. Using C/C++, VC++, MFC, STL, C#, Java etc. on various platform like Windows, Unix, Macintosh etc. from last 13+ years to convert various type of requirements into running software components. My core expertise is multithreaded desktop product and large scale enterprises software development.
Follow on   LinkedIn

Comments and Discussions

 
GeneralMy vote 5 Pinmemberjaganmohan2066-May-13 21:55 
GeneralMy vote of 3 PinmvpMichael Haephrati13-Mar-13 3:23 
The word "Protecting" is misleading. You are demonstrating some kind of a licensing scheme. Licensing must be enforced before you can claim a software is protected. Enforcing licensing is done by hiding the scheme and making it very hard to bypass it. Your DLL can be simply replaced with another DLL with the same name and exported functions.
GeneralMy vote of 2 Pinmemberlavrentiy.s25-Feb-13 16:35 
QuestionSame old story over and over PinmemberObiWan_MCC25-Feb-13 3:51 
AnswerRe: Same old story over and over PinmemberErik Burd25-Feb-13 10:03 
QuestionAssuming certificate index is always 0 Pinmemberubivetz7-Apr-09 4:20 
AnswerRe: Assuming certificate index is always 0 PinmemberManish K. Agarwal7-Apr-09 22:35 
Generalnice, But it's an simple & hot........ PinmemberMember 423560118-Feb-09 11:30 
Generalif hacker jump out your if statement Pinmembermike101821-Aug-08 23:26 
GeneralRe: if hacker jump out your if statement PinmemberManish K. Agarwal22-Aug-08 3:18 
GeneralGreat and simple idea, but dangerous... PinmemberDaniel Schade16-Aug-07 4:29 
GeneralUnique Information PinmemberJeffrey Walton24-Jun-07 8:25 
GeneralCopy protecting a Video DVD PinmemberGodwin Sam Josh15-Jul-06 20:54 
GeneralRe: Copy protecting a Video DVD PinmemberManish K. Agarwal16-Jul-06 22:50 
GeneralRe: Copy protecting a Video DVD Pinmembervmihalj18-Sep-06 2:24 
GeneralRe: Copy protecting a Video DVD PinmemberGodwin Sam Josh18-Sep-06 9:19 
GeneralRe: Copy protecting a Video DVD Pinmembervmihalj18-Sep-06 23:11 
GeneralRe: Copy protecting a Video DVD Pinmemberdusty_dex22-Feb-13 8:27 
QuestionConfused??!!?? PinmemberAnorexic Tribble3-Dec-05 7:36 
AnswerRe: Confused??!!?? PinmemberManish K. Agarwal3-Dec-05 18:04 
GeneralRe: Confused??!!?? Pinmemberdusty_dex22-Feb-13 8:32 
GeneralRe: Confused??!!?? PinmemberManish K. Agarwal25-Feb-13 22:35 
GeneralRe: Confused??!!?? Pinmemberdusty_dex26-Feb-13 2:43 
GeneralRe: Confused??!!?? PinmemberManish K. Agarwal27-Feb-13 3:29 
GeneralGood Idea PinmemberSumit Kapoor28-Nov-05 19:38 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.1411023.1 | Last Updated 2 Aug 2013
Article Copyright 2005 by Manish K. Agarwal
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid