Protecting an Application's Unauthorized Copy

• Download source files - 3.2 KB
• Download MyApp-noexe.zip - 6.6 KB
• Sample project - 33 KB
• Download C# sample application - 21.1 KB

Introduction

At the time of installation most software asks for a product key or a serial number; this is to prevent software piracy, but how is this done? In this article, I'll try to cover one basic idea to achieve this. It is advised not to use this in professional software as someone can easily break it.

In each Windows portable executable (PE image file) we can add some certificate (some sort of data) using the image integrity functions (Platform SDK's ImageHlp APIs). The certificate data can be generated using a combination of product keys and some unique IDs for the desktop where the user is installing the software. These unique IDs can be CPU ID, primary volume ID, network card ID etc. To increase the security we can do some encryptions on the certificate data. Writing certificate data in the executable should be done only once, i.e. at the time of installation. At the time of the application startup we can again generate the certificate data using the local machine (where the user is executing the application) unique IDs and compare it with the certificate data which is present in the executable. If there is any mismatch, stop the execution.

In the above approach there is a problem, what if the user changes some hardware component (for e.g. graphics card) and what if that component's unique ID was used to generate the certificate data? Certainly now our application will stop execution because of the mismatch in certificate data. But we do not want this to happen. To avoid this we can use 4-5 unique IDs to generate the certificate data. At application startup, we can make a rule; if any two IDs are matching go ahead otherwise show error for unauthorized copy.

In the demo application, to generate the certificate data, I am using the primary volume ID without any encryption. At the time of application startup, I'll check if there is any certificates present in Sample.dll, if no certificate is present, add a certificate to Sample.dll (actually this task should be done through the installation script) and only the certificate verification code should be present in the executable.

Using the Code

To integrate the certificate manager in your application you need to do the following:

1. Include "CertificateMgr.h", and imagehlp.lib in your project's additional libraries.
2. Create an object of CertificateMgr.
3. Call the Init() method with a portable executable (PE) image file name in which you want to manage the certificate.
4. Call SignDLL() to add a signed certificate (only inhouse job) so that later at the time of adding an actual client machine certificate it can be verified that we are adding certificate to right DLL. It will be better if you make a command line utility do this. Ofcourse you will not ship this with your actual application.
5. Call IsValidCopy() to check if the application has a valid certificate or not.
   C++

   CertificateMgr certificateMgr;
   
   // Specify dll or exe where you are adding certificate.
   
   if (!certificateMgr.Init("Sample.dll"))
   {
       cout <<"Initilization errors, some files are missing.\n\n";
       MessageBox(NULL, "Initilization errors, 
                     some files are missing", "MyApp", MB_OK);
       return 1;
   }
   if (!certificateMgr.IsValidCopy())
   {
       cout << "Running unauthorized copy :(\n\n";
       MessageBox(NULL, "Running unauthorized copy", 
                                        "MyApp", MB_OK);
       return 1;
   }

Certificate Manager Class

In this class, I am using ImageAddCertificate and ImageGetCertificateData Win32 SDK APIs.

GetUniqueData() method generates unique data to be put in the PE certificate. While adding a certificate using AddCertificate(), I am keeping the last modified time, and after adding the certificate, the executable is maintained with the previous modified time to simulate an impression of no changes. For the sake of simplicity, I first check if there is any certificate added, if no certificate is found, add it. From the next execution onwards, verify the PE certificate data with the data returned from GetUniqueData(). In real applications, AddCertificate() should be called at the time of application installation before executing the application.

I could not find any good documentation on image integrity functions (Platform SDK's ImageHlp APIs). If you know about any good URL/book for ImageHlp APIs, please add a comment. Discuss more on this at Activation code.

History

• 27^th November, 2005: Initial revision.
• 21^st August, 2008: Now a simple ImageRemoveCertificate will not break the copy protection, yes one can write something to copy certificate data. Thank you Daienl for pointing this.
• 21^st February 2013: Fixed small leak and a bug.
• 2^nd August 2013: Added C# sample application.