William Stacey [MVP] wrote:
> Thanks Rinze. Was not trying to be flippant with response. I assume your
> talking license management here. If something else, please expand. To have
> context here, lets assume we are talking license check as that is what site
> mainly talks about. And your right, we probably can't crack the device or
> internal structures. However, I still don't need to. Pretend we call an
> IsValid() method in the hardlock. It does and does its thing with checking
> keys, decrypting, xyz, etc. That is fine and good. But now, my main code
> at some point need to check some reply from the hardlock to see if that was
> valid or license failure. So my code my look like this (could be anything)
> :
>
> private void MainForm_Load(object sender, System.EventArgs e)
> {
> bool valid = HardLock.IsValid(); // HardLock goes and does its
> magic.
> if ( ! valid )
> MessageBox.Show("Thank you for using our software. Please
> obtain a valid license at xyz.com.");
> }
>
> So I can still bypass your HardLock all together with a mod to the code. I
> don't need to break the hardlock, I just need to change your code. The
> return value my not be a bool but something else. You can still do the same
> thing. Now if all your code is in the hardlock, then that is probably a
> different issue - but not sure we are talking about that. Truly interested
> in this, so please post some other example if I am in error. I did look at
> the site. The idea is good, but in the end it is a fancy dongle that people
> will not buy sw that requires a dongle/smartcard/smart usb device (at least
> a lot of people will not.) A good obfuscator and PKI would probably work as
> well to make it very difficult to crack your code without requiring the
> dongle. Now if we could load the whole program in the dongle and run it
> from there, that may be a little more interesting. Instead of distributing
> CDs or exe, you send out USB device with sw on it. Still a dongle however,
> and you still have the perception issue. Is your software that great that
> people will carry around this dongle with them. What if everyone did this,
> I would have 20 dongles sticking out of my machine (If I could even get that
> many usb ports.) As a user, chances are a non-dongle SW alternative starts
> looking more attractive as the dongle feels like one more thing to keep
> track of that I don't need. That said, for some high security applications,
> this may be the right choice.
>

"C-Services Holland b.v." <csh@REMOVEcsh4u.nl> wrote in message
news:dZWdnZrCotbOGDDcRVnyig@zeelandnet.nl...
> You don't seem to understand the crypting process.
>
> quote: "Pretend we call an IsValid() method in the hardlock."
>
> That is where you go wrong, in my code I don't even have to check for
> the presence of the hardlock. The entire executable/dll is crypted with
> a 128bit encryption method. It needs the hardlock to first decrypt the
> code then run it. Code similar to what you showed is nowhere to be found
> in my software. I'll describe the process:
>
> 1. I create and compile program just like any other
> 2. attach the customers hardlock with a specific module address
> 3. attach our company specific crypt lock
> 4. run the compiled program through a crypt program that crypts the
> executable with the customers hardlock
> 5. burn it on CD and ship it and the hardlock to the customer
>
> Now the executable/dll has changed alot. Aside from the encryption, it
> is encapsulated in a software envelope that will automatically decrypt
> it when needed. The envelope doesn't simply check if the hardlock is
> available, it NEEDS it to be there to even be able to decrypt the
> machine code and run it.
>
> Think of PGP. PGP encrypt your program. Can you run it? No. Can you go
> in there, change 1 bit and have you then defeated the PGP encryption?
> No. You need to decrypt the program first before you can use it. The
> hardlock does this on the fly, but all the while it obfuscates it
> behaviour making it very hard for anyone with special software (like
> WinIce) to see what is going on.
>
> You can use it like you described, but that would defeat the purpose of
> having one simply because it can be broken like you showed. But proper
> use of the hardlock makes it very very hard to break.
>
> William Stacey [MVP] wrote:
> > Thanks Rinze. Was not trying to be flippant with response. I assume
your
> > talking license management here. If something else, please expand. To
have
> > context here, lets assume we are talking license check as that is what
site
> > mainly talks about. And your right, we probably can't crack the device
or
> > internal structures. However, I still don't need to. Pretend we call
an
> > IsValid() method in the hardlock. It does and does its thing with
checking
> > keys, decrypting, xyz, etc. That is fine and good. But now, my main
code
> > at some point need to check some reply from the hardlock to see if that
was
> > valid or license failure. So my code my look like this (could be
anything)
> > :
> >
> > private void MainForm_Load(object sender, System.EventArgs e)
> > {
> > bool valid = HardLock.IsValid(); // HardLock goes and does its
> > magic.
> > if ( ! valid )
> > MessageBox.Show("Thank you for using our software. Please
> > obtain a valid license at xyz.com.");
> > }
> >
> > So I can still bypass your HardLock all together with a mod to the code.
I
> > don't need to break the hardlock, I just need to change your code. The
> > return value my not be a bool but something else. You can still do the
same
> > thing. Now if all your code is in the hardlock, then that is probably a
> > different issue - but not sure we are talking about that. Truly
interested
> > in this, so please post some other example if I am in error. I did look
at
> > the site. The idea is good, but in the end it is a fancy dongle that
people
> > will not buy sw that requires a dongle/smartcard/smart usb device (at
least
> > a lot of people will not.) A good obfuscator and PKI would probably
work as
> > well to make it very difficult to crack your code without requiring the
> > dongle. Now if we could load the whole program in the dongle and run
it
> > from there, that may be a little more interesting. Instead of
distributing
> > CDs or exe, you send out USB device with sw on it. Still a dongle
however,
> > and you still have the perception issue. Is your software that great
that
> > people will carry around this dongle with them. What if everyone did
this,
> > I would have 20 dongles sticking out of my machine (If I could even get
that
> > many usb ports.) As a user, chances are a non-dongle SW alternative
starts
> > looking more attractive as the dongle feels like one more thing to keep
> > track of that I don't need. That said, for some high security
applications,
> > this may be the right choice.
> >
>
>
> --
> Rinze van Huizen
> C-Services Holland b.v.