Protect Standalone Distribution - Need help!

[alex298]

Hi,

RR version: RR 4.0

I have an RR standalone application that will be distributed to some people for use very soon. I don't want them to re-distribute the application to other people. Therefore I decide to protect the application. After I searched and read all related posts on the Internet, I am thinking to use the following procedures:

1. Each application will be built according to the email address of the users. Since the number of users are very limit, this process will not be a problem.

2. When a user open the application for the first time, the user's computer hardware information will be taken. It seems that the following hardware information can be taken:

• - MAC Address

• - Hard Disk Serial Number

• - Computer Name

I cannot decide which hardware information listed above should be taken. I have some questions here:

MAC Address
There is a very nice function to get the MAC Address at:
http://www.sonsothunder.com/devres/revo ... env001.htm

However, some people may using two Network Cards on their computer. Will the above function works in this situation? Or the function may get the MAC Address of either Network Card? Or error may appear? Since I don't have computer with two Network Cards so I cannot test it.

Hard Disk Serial Number
It seems that all people are getting the Serial Number of Drive C.

Are one of the Hard Drives of Windows must be "C"?

Is it possible that the drives of a Windows computer do not assign to "C"?

Computer Name
I learned that:
If the platform is "Win32", use $COMPUTERNAME to get the Computer Name
For other platform, use shell("echo $HOSTNAME") to get the Computer Name

How about Win 64? Also use $COMPUTERNAME to get the Computer Name?

3. The email address and one or two of user's computer hardware will then be saved to an hosting server.

4. Every time the application open, it will compare with the data saved in the hosting server. If it passes, the application will allow to use, otherwise, the application will be closed.

This is the procedures that I am thinking to use.

Please help!

Best regards

Alex

[Mark]

Hi Alex,

I have been doing these things for quite some time now. Usually, I use the MAC address, but have come to the conclusion that using the hard disk number might be a better way. However, keep in mind that everything, both MAC addresses and hard disk serial numbers, can be faked. Naturally, you should be able to retrieve the serial number of any media, not just the C drive.

Of course, if you apply relatively strong safety measures like these, you will get much more support requests than with a simple license code. If you use the computer name, you will get many support requests, because the computer name can be changed easily.

Please, make sure to keep your system really simple. Just check if the combination of hardware information and a secret code is correct. Deal with everything else at the administrative level (meaning e.g. if you want to check whether someone should be allowed to download an update, check the date of the license in a separate system, don't make it part of the built-in registration system). Make sure to check that the code entered is correct before checking with the server.

With Economy-x-Talk's Installer Maker Plugin for LiveCode, you can create an installer with a password. The installer will only continue if the user enters the correct password. This may prevent illegible users from installing and trying to circumvent other safety measures. Btw, I think that the Installer Maker licensing scheme is one of my most elegant registration and updating systems.

Btw you can automate the process of building standalones by catching the savingStandalone message in your stack. Part of the code would be:

Code: Select all

send "revSaveAsStandalone" && quote & the short name of the topStack & quote to stack "revSaveAsStandalone"

This worked in 3.0; I think it should still work. There are other solutions to automate the creation of standalones. You can contact me if you need a consultant.

Kind regards,

Mark

[alex298]

Hi Mark,

Thanks for your help and suggestions.

## come to the conclusion that using the hard disk number might be a better way.

So I decide to use the hard disk number then.

It seems that all people are getting the Serial Number of Drive C. I have some questions:
Is one of the Hard Drives of Windows platform must be "C"?
Is it possible that none of the drives of a Windows computer not assign to "C"?

Thanks and best regards

[Mark]

Hi,

Yes, it is possible that a PC has no drive C. It is also possible that the system drive is not C and it is possible that a PC does have a drive C while the system drive is not drive C.

Kind regards,

Mark

[mwieder]

Yes, it is possible that a PC has no drive C. It is also possible that the system drive is not C and it is possible that a PC does have a drive C while the system drive is not drive C.

All these, however, are highly unlikely.

More to the point, I think, is the question of what happens when a user upgrades to a bigger hard disk? Or switches to a new computer? Or their old hard drive dies and they need to switch to a new one? Are you planning on announcing these restrictions to your users ("Don't ever get a new computer")? You're probably going to be stuck with issuing new licenses every time a user's hardware situation changes.

Is your hosting server always on line and 100% reliable? I would never get into a situation where software I was running (or worse, depending on) was dependent on a server run by a third party being always available. What happens if the vendor goes out of business? What happens if I'm not connected to the internet? What happens if the vendor's domain host is having network problems?

[Mark]

Hi,

Assuming that you have a valid reason to require strong safety measures, I wouldn't worry too much about the points mwieder raises. Yes, you will have to issue new licenses once in a while, but that doesn't need to be a problem. After all, people have paid for those licenses and may expect at least a limited service, besides the software, in return for their money.

Nowadays, most hosting services are 99% reliable. You just needs to include in the license conditions that one needs an internet connection to use the software and that one will be able to use the software 99% of the time, the exception being when the server is off-line.

Be clear about the limitations. That will solve most problems.

Kind regards,

Mark

[alex298]

Hi,

Yes, there will be some limitation on using the application, include only allow to use on one computer, Internet connection is required, etc...

Yes, my hosting accounts have an average of 99.97+% up-time in the past 10 years. Moreover I have a few hosting accounts in different states. Therefore this issue should not be a problem.

I have finalize the process in getting the Drive's serial number after reading many posts in the past. Here's some of the codes of the procedures:

Code: Select all

// Let's test if "C:" Drive exists or not
// If "C:" Drive is found in the volumes
if "C:" is among the lines of the volumes then

   put shell("vol c:") into tData
   -- the following steps are simply to extract the Serial Number from the tData string
  .....................................
  .....................................

// "C:" Drive is not found.
// Need a compromise solution
// Let's get the computer name instead
else

   // Get the computer name
   getComputerName

end if

on getComputerName
   if (the platform is "Win32") or (the platform is "Win64") then
      put $COMPUTERNAME into tComputerName
   else
      put shell("echo $HOSTNAME") into tComputerName
   end if
   
   // Write the Computer Name into file
   ..............................
  .................................

end getComputerName

Any advise on this procedures?

Thanks and best regards

Alex

[Mark]

Hi Alex,

Use the drives function to retrieve a list of drives. You can modify your current script to check all these drives to see if you can retrieve a serial number from the drive. Just use the first drive serial number. Ignore a and b. Be aware of virtual drives.

Kind regards,

Mark

[mwieder]

If you're really going through with this, then

Code: Select all

put $systemdrive

will give you the system drive letter ("C:" in almost every case). Type "set" from a windows dos prompt window to see a selection of various interesting system variable that are all accessible from LC using the "$" prefix.

[alex298]

Hi all,

Wonderful! I really learn a lot:) It also save me many lines of codes:)

Type "set" from a windows dos prompt window to see a selection of various interesting system variable that are all accessible from LC using the "$" prefix.

By the way. Where can I learn more about this interesting stuff? It seems that this information is not included in the Dictionary and online tutorials on runrev.

Best regards

[mwieder]

Good questions. The "set" command is part of Windows and not a LiveCode thing of itself, so looking into command prompt documentation online (do a Google search and don't try to wade through Microsoft's online dreck) will help.

The $ command is documented in the LiveCode dictionary (it's the second line in the list), and that's the third-best place to search for information like this. But this website is definitely the second-best place to come for information - there are a lot of helpful folks here who have been down these paths before.