Registration based on machine name

[garriew]

I am wanting to require a registration code for my program to run and the code would be unqiue/locked to the machine name. Like:

Program loads, looks in INI for reg code, if there it checks to see if that code "matches" the machine name. If it does, it unlocks a feature/runs fully. If it doesn't match, registration box will show where the user can enter a code I give them to register. It will also display a unique ID that they give me so I can generate their code.

The user should also be allowed to bypass this form X times before registration is equired. I was thinking a countdown in the registry but not sure.

I don't need anything state of the art and prefer not buying a program to do it.

Any suggestions on how to do this?

 

[Herman]

You can take some unique hardware identifiers, like motherboard, cpu and hard disk serial numbers, mac address, possibly also a time element (if you want to give the license a limited time without having to maintain a licensing server for example), hash it all in a way only you know about, enclose everything in a self contained class taking care to use SecureStrings to hold the data in memory, use DotFuscator community edition to obfuscate the code, and compile everything to native code with NGEN. Call on the resulting DLL often throughout your code. The main problem is securely passing authorization between the calling app and the DLL. You can't just return True, anyone could hack it to always return True. You need to use a key exchange algorithm like Diffie-Hellman, or even an SSL certificate. Call the DLL with a cryptographic challenge, and check the resulting control word. As long as you keep your private key private it's almost bulletproof.

 

[Herman]

There are also free licensing packages out there like Rhino, or Software Protector.

Probably time better spent than trying to put it all together yourself.

 

[IanRyder]

Hi,

It sounds like Herman knows a lot more about security and cryptography than I do and he makes some valid points when it comes to creating any sort of hash value for registration, but as a quick demonstration of what could be done, I put this together from this example of creating an MD5 Hash of a String from MSDN. Have a look here:-

MD5 Class (System.Security.Cryptography)

In this example, the user generates a hash value based on the name of their computer and sends it to you. You then generate a New Hash value (being the Registration Key) based on the Hash value sent from your user and then send it back to them. The user then enters the Registration Key and the product gets Registered or Not based on the entry of a Correct Registration Key.

The sample output from the code is:-


The code:-

Imports System
Imports System.Security.Cryptography
Imports System.Text
 
Public Class Form1
 
  'The user generates this Hash value based on the computer name that the software is installed on
  'This is then passed / emailed to you to generate a Registration key
  Private Sub btnHashFromUser_Click(sender As System.Object, e As System.EventArgs) Handles btnHashFromUser.Click
    Dim hashDataSource As String = My.Computer.Name
 
    Using md5Hash As MD5 = MD5.Create()
      txtHashFromUser.Text = GetMd5Hash(md5Hash, hashDataSource)
    End Using
  End Sub
 
  'You generate another Hash value based on the Hash Value emailed to you from the user.
  'You then email this New Hash Value back to the user as a Registration Key
  Private Sub btnHashFromYou_Click(sender As System.Object, e As System.EventArgs) Handles btnHashFromYou.Click
    Using md5Hash As MD5 = MD5.Create()
      txtHashFromYou.Text = GetMd5Hash(md5Hash, txtHashFromUser.Text)
    End Using
  End Sub
 
  'Once the user enters the Registration Key this key is then checked for comparision against 
  'the Hash of the Hash of the Users Computer Name
  Private Sub btnRegisterProduct_Click(sender As System.Object, e As System.EventArgs) Handles btnRegisterProduct.Click
    Dim myComparer As StringComparer = StringComparer.OrdinalIgnoreCase
    Dim hashDataSource As String = My.Computer.Name
 
    Using md5Hash As MD5 = MD5.Create()
      If myComparer.Compare(txtRegistrationKey.Text, GetMd5Hash(md5Hash, GetMd5Hash(md5Hash, hashDataSource))) = 0 Then
        txtRegistrationResult.Text = "Registered"
      Else
        txtRegistrationResult.Text = "Invalid Key"
      End If
    End Using
  End Sub
 
  Private Function GetMd5Hash(ByVal md5Hash As MD5, ByVal input As String) As String
    ' Convert the input string to a byte array and compute the hash. 
    Dim data As Byte() = md5Hash.ComputeHash(Encoding.UTF8.GetBytes(input))
 
    ' Create a new Stringbuilder to collect the bytes and create a string. 
    Dim sBuilder As New StringBuilder()
 
    ' Loop through each byte of the hashed data and format each one as a hexadecimal string. 
    Dim i As Integer
    For i = 0 To data.Length - 1
      sBuilder.Append(data(i).ToString("x2"))
    Next i
 
    ' Return the hexadecimal string in Registration Key Blocks
    Dim myKeyBlocks As New List(Of String)
    For Counter As Integer = 0 To sBuilder.ToString.Length - 1 Step 4
      myKeyBlocks.Add(String.Concat(sBuilder.ToString.Skip(Counter).Take(4).ToArray))
    Next
 
    Return String.Join("-", myKeyBlocks.ToArray).ToUpper
  End Function
End Class

Hope that helps.

Cheers,

Ian

 

[garriew]

Herman, Thanks for the pointers.

Ian, thanks for the example! It will help out greatly for making a simple security license. It's mainly to keep honest people honest.

Thanks again guys!