software protection componetent 2

[sfunk]

Hello,

Does anyone know of a software protection component (shareware licensing) for VB6 that is free?

AND

Are there any suggestions on creating one? I am considering writing a simple component that can offer a little protection. I am very unconcerned with whether someone can crack it or not. I am looking for something that a new programmer can write and that is the most basic of protection. How would one go about this?

Thanks,
Steve

 

[Lightseeker]

Have your proggy generate about 10-12 random numbers, throw in some alpha values and create some form of a seed code, like: "54E8001QA74". This value will always be formatted with 2 numbers, 1 alpha, 4 numbers, 2 alphas, and 2 numbers. Next, you need to create a program that will analyze this value following the rules mentioned above and generate an authorization code that will always synchronize with this value. Have the auth code maker read the 2nd, 3rd, 5th, 7th, 8th, and 10th positions in the seed code...or whichever values you want it to. Then, from the values that are in these positions, make an auth code formatted maybe something like this "A523-J6GLLY-25881-ZF" or whatever. The 2nd position in the seed value is a "4", make the 4th position be some value like "3". The 3rd position in the seed value is an "E", which is some ASCII value and stick it in the auth code somewhere. The 5th position in the seed value is a "0" zero so make the 1st position the letter "A" or "Z" (zero index of the alphabet either forward or reversed). The 7th and 8th are both alphas, so get their ASCII values and stick em in the auth code somewhere...get the general idea?

 

[Lightseeker]

Ok, now that you've digested that.

Upon installation, generate the seed code and stick it in the registry somewhere...it doesn't have to be hidden though. Next, determine the start date of your installation and also write that to the registry and hide this one, either that or encrypt the date value so it can't be decyphered. Have your program look for the installation date each time it starts up and compare it with the current date so you can find out if they've gone past the evaluation period. Then if they have, don't allow the program to function and ask them to register it.

When they make their purchase, ask them for their seed code and you generate their auth code. That auth code will only work for that installation.

When they enter their authorization code, your algorithm within the software analyzes the auth code to see if it fits the seed code. If it does, the software is enabled or unlocked. Write to the registry or ini file that the software has been registered and record the auth code so your program can check it each time it starts up. If they change the value, then it will ask them to either re-install or re-enter the auth code.

Simple as calculus, clear as mud!

Lightseeker

 

[sfunk]

Thank you. That gives me a great foundation.

Sincerely,
Steve

 

[Lightseeker]

A good way to keep the program secure and allow users to evaluate your application is to have two-way communication between your distributed program and you. Your software should actually have the security algorithm within it so it can analyze the generated seed code and authorization code to check for consistency. If you try to have a distributed set of pre-determined authorization codes within a database or ini file, someone will crack that pretty quickly. But if it's dynamic, they can still crack it but it's a little harder and the guys who buy your program probably won't be the ones who do it. If your application is more valuable than this, you probably should be looking into purchasing some 3rd party encryption DLL. I know this the method I've suggested is cheezy, but the true encryption processes don't even deal with silly stuff like this, they deal with patterns, 128 bit encryption standards, numerous security DLLs, etc. Don't miss your target market by making it too secure though. If your application sells for $25.99 USD and you spend 2 months dreaming up security measures, you're probably missing the point.

I've spent many man-hours dealing with these issues myself and sought professional opinions from higher level programmers while coming up with my security standards. It's hard to find good advice without paying a lot for it, so I hope my advice has been helpful to you.

Lightseeker