Applications often have registration keys. It can arguably be placed in a file or in the registry. Sometimes, an application is deactivated by entry of another key, or the passing of a date, etc. Where can one safely store such information about an application be deactivated? A file isn't the answer; a backup copy can be restored to defeat this. The registry is a weak answer, only because most people don't know its there, and don't think to restore it, and if they do they restore the whole thing which usually has other discouraging side effects.
应用程序通常有注册密钥。它可以被置于文件或注册表中。有时,通过输入另一个密钥或传递日期等来停用应用程序。在哪里可以安全地存储关于应用程序的此类信息?文件不是答案;可以恢复备份副本以打败这个。注册表是一个弱的答案,只是因为大多数人不知道它在那里,并且不认为恢复它,如果他们这样做,他们恢复通常有其他令人沮丧的副作用的整个事情。
It seems to me that storing deactivation information is hopelessly unsafe, as old copies can always be restored. At best one can hide this data by obfuscation under cryptically named files or registry keys.
在我看来,存储停用信息是绝对不安全的,因为旧副本总是可以恢复。最多可以通过在加密命名的文件或注册表项下进行模糊处理来隐藏此数据。
Is there a standard trick I don't know, or a standard scheme supported by Windows, that helps with this problem?
是否有一个我不知道的标准技巧,或Windows支持的标准方案,有助于解决这个问题?
Round 2: I've seen a number of answers. None of them specifically say "you can't do this" but several imply that phoning home is the only good choice (for "deactivation").
第二轮:我看到了很多答案。他们都没有具体说“你不能这样做”,但有几个人暗示打电话回家是唯一的好选择(“停用”)。
Let's assume phoning home and dongles are NOT the answer, and one has to leave something on the machine. What do typical licensing schemes actually do in this case?
我们假设打电话回家和加密狗不是答案,而且必须在机器上留下一些东西。在这种情况下,典型的许可方案实际上做了什么?
5 个解决方案
#1
Create and sign a license file on a server. If you use public key cryptography, the license file can't be faked easily. Your application can be of course cracked to not need the license, but that's a different thing.
在服务器上创建并签署许可证文件。如果使用公钥加密,则不能轻易伪造许可证文件。您的应用程序当然可以破解为不需要许可证,但这是另一回事。
#2
In contrast to the IPhone and other closed environments on an open platform like windows/linux you always run a very high risk that the protection is easily circumventable (local serial protection) or will be cracked by reversing and patching your code. Virtually every modern single player game has this problem. Additionally it is very hard to find a solution that does not annoy the user too much. We all remember the Sony-CD-Rootkit disaster and in the game industry its the always the newest DVD-protection that doesn't work on all drives the way its supposed to. But what can you do? You can try the usual serial, call-home option and ban certain serials in newer updates (Adobe, FlashFXP, Windows). If you have a very low consumer base, this probably is enough for you. If - for whatever reason - that is not an option, what about an USB-Dongle that is needed to use your software. Heard of quite some CAD-programs using this. One last thing you can look into, what about watermarking your application? If it shows up on certain p2p networks you will maybe be able to see where the leak is. Basically nothing will give you a 100% guarantee, but there are options to make it more difficult for the average user... Please keep in mind that most of your money should be spend on creating a great product not in buying mostly useless protection!
与Windows和Linux等开放平台上的iPhone和其他封闭环境相比,您总是会面临很高的风险,即保护很容易被绕过(本地串行保护),或者通过反转和修补代码来破解。几乎每个现代单人游戏都有这个问题。此外,很难找到一种不会过多地惹恼用户的解决方案。我们都记得Sony-CD-Rootkit灾难,而在游戏行业中,它始终是最新的DVD保护,不能像所谓的那样在所有驱动器上运行。但你能做什么呢?您可以尝试通常的串行,回拨选项,并在更新的更新中禁止某些连续出版物(Adobe,FlashFXP,Windows)。如果您的消费者群体非常低,这对您来说已经足够了。如果 - 无论出于何种原因 - 这不是一个选项,那么使用您的软件需要USB-Dongle呢?听说过很多使用它的CAD程序。您可以考虑的最后一件事,如何为您的应用添加水印?如果它出现在某些p2p网络上,您可能会看到泄漏的位置。基本上没有什么可以给你100%的保证,但有一些选项可以让普通用户更难......请记住,你的大部分钱应该花在创造一个伟大的产品而不是购买大多无用的保护!
#3
Here is a short but pretty good overview of different options.
以下是对不同选项的简短但非常好的概述。
http://www.developer-resource.com/how-to-protect-software.htm
#4
Ya,you could encrypt things,that's what they do!.Check the net for various licensing schemes.Even microsoft has one...Microsoft Software Licensing and Protection
雅,你可以加密东西,这就是他们的工作!。检查网络的各种许可方案。甚至微软有一个...微软软件许可和保护
You can use the Microsoft Cryptographic API to develop you code.Plus obscure you assemblies or dlls.Force user activation.
您可以使用Microsoft Cryptographic API开发代码.Plus模糊您的程序集或dll。强制用户激活。
#5
All protection schemes are vulnerable to some type of attack. Encryption of information does help prevent attacks because the information is stored in an obfuscated way, but even this isn't unbreakable.
所有保护方案都容易受到某种类型的攻击。信息加密确实有助于防止攻击,因为信息以混淆的方式存储,但即使这样也不是不可破解的。
Another possible option is to store the actual activation state information remotely and leave a reference to this information on the machine, possibly encrypted. There are many ways to do this but one that comes to mind is to store a GUID of some kind that you could then look up in your database
另一种可能的选择是远程存储实际的激活状态信息,并在机器上留下对该信息的引用,可能是加密的。有很多方法可以做到这一点,但想到的一种方法是存储某种类型的GUID,然后您可以在数据库中查找
One downfall of this is the requirement of an internet connection, I don't know if that is prohibitive or not but the general idea is to remove the activation state from a machine you don't control and put it on one that you do
这种情况的一个缺点是需要互联网连接,我不知道这是否过高,但一般的想法是从你不控制的机器中删除激活状态并将其放在你做的那个上
#1
Create and sign a license file on a server. If you use public key cryptography, the license file can't be faked easily. Your application can be of course cracked to not need the license, but that's a different thing.
在服务器上创建并签署许可证文件。如果使用公钥加密,则不能轻易伪造许可证文件。您的应用程序当然可以破解为不需要许可证,但这是另一回事。
#2
In contrast to the IPhone and other closed environments on an open platform like windows/linux you always run a very high risk that the protection is easily circumventable (local serial protection) or will be cracked by reversing and patching your code. Virtually every modern single player game has this problem. Additionally it is very hard to find a solution that does not annoy the user too much. We all remember the Sony-CD-Rootkit disaster and in the game industry its the always the newest DVD-protection that doesn't work on all drives the way its supposed to. But what can you do? You can try the usual serial, call-home option and ban certain serials in newer updates (Adobe, FlashFXP, Windows). If you have a very low consumer base, this probably is enough for you. If - for whatever reason - that is not an option, what about an USB-Dongle that is needed to use your software. Heard of quite some CAD-programs using this. One last thing you can look into, what about watermarking your application? If it shows up on certain p2p networks you will maybe be able to see where the leak is. Basically nothing will give you a 100% guarantee, but there are options to make it more difficult for the average user... Please keep in mind that most of your money should be spend on creating a great product not in buying mostly useless protection!
与Windows和Linux等开放平台上的iPhone和其他封闭环境相比,您总是会面临很高的风险,即保护很容易被绕过(本地串行保护),或者通过反转和修补代码来破解。几乎每个现代单人游戏都有这个问题。此外,很难找到一种不会过多地惹恼用户的解决方案。我们都记得Sony-CD-Rootkit灾难,而在游戏行业中,它始终是最新的DVD保护,不能像所谓的那样在所有驱动器上运行。但你能做什么呢?您可以尝试通常的串行,回拨选项,并在更新的更新中禁止某些连续出版物(Adobe,FlashFXP,Windows)。如果您的消费者群体非常低,这对您来说已经足够了。如果 - 无论出于何种原因 - 这不是一个选项,那么使用您的软件需要USB-Dongle呢?听说过很多使用它的CAD程序。您可以考虑的最后一件事,如何为您的应用添加水印?如果它出现在某些p2p网络上,您可能会看到泄漏的位置。基本上没有什么可以给你100%的保证,但有一些选项可以让普通用户更难......请记住,你的大部分钱应该花在创造一个伟大的产品而不是购买大多无用的保护!
#3
Here is a short but pretty good overview of different options.
以下是对不同选项的简短但非常好的概述。
http://www.developer-resource.com/how-to-protect-software.htm
#4
Ya,you could encrypt things,that's what they do!.Check the net for various licensing schemes.Even microsoft has one...Microsoft Software Licensing and Protection
雅,你可以加密东西,这就是他们的工作!。检查网络的各种许可方案。甚至微软有一个...微软软件许可和保护
You can use the Microsoft Cryptographic API to develop you code.Plus obscure you assemblies or dlls.Force user activation.
您可以使用Microsoft Cryptographic API开发代码.Plus模糊您的程序集或dll。强制用户激活。
#5
All protection schemes are vulnerable to some type of attack. Encryption of information does help prevent attacks because the information is stored in an obfuscated way, but even this isn't unbreakable.
所有保护方案都容易受到某种类型的攻击。信息加密确实有助于防止攻击,因为信息以混淆的方式存储,但即使这样也不是不可破解的。
Another possible option is to store the actual activation state information remotely and leave a reference to this information on the machine, possibly encrypted. There are many ways to do this but one that comes to mind is to store a GUID of some kind that you could then look up in your database
另一种可能的选择是远程存储实际的激活状态信息,并在机器上留下对该信息的引用,可能是加密的。有很多方法可以做到这一点,但想到的一种方法是存储某种类型的GUID,然后您可以在数据库中查找
One downfall of this is the requirement of an internet connection, I don't know if that is prohibitive or not but the general idea is to remove the activation state from a machine you don't control and put it on one that you do
这种情况的一个缺点是需要互联网连接,我不知道这是否过高,但一般的想法是从你不控制的机器中删除激活状态并将其放在你做的那个上