Question

Software Registration Process

Asked by: Marius0188

Hi Experts,

I have software application that the user must activate with a serial number that we will give him.
This serial number will be valid for X Days. For example 1 x year (365 days) etc.

Following are the steps of our registration process:
1. User download software
2. We email user software registration number based on whether he bought a 1/2/3 year license.
3. User enters this serial number in the software.
4. The software will determine if its valid by checking with our online MySQL database that this serial number has not been registered previously and then allow the further use of the software according to the license period.
5. After the serial number "online checking" has completed the software needs to sent this serial number to our online MySQL database with a request to flag it as been "USED" or "RESERVED" or whatever......  :)

Ok I know this sound quite hectic but I have layout the process in bit detail just incase someone else has got a better idea than this which does not involves too much work.

My solution to this:
For checking and flagging a serial number I have thought to sent the variables via a URL and then have a PHP script doing the work for me on the other side.
***But the problem is how can I determine the result from the script on the Delphi side***

For example:
To flag a serial number it should be quite easy:
I can use ShellExecute() with an url for example: "http://www.signgenius.com/phpscript.php?serial=1234456343" as parameter and on the PHP site I simply GET the variables from the url and insert it into the MySQL database.

***BUT***

To check whether a serial number has been used prior to flag it I need to receive a response from the script.
I where thinking maybe to fake a page not found (404) error when the serial has been used else a page found (200) if the serialnumber is OK.

------------Questions------------
1) So how can I from the PHP scripts side fake a page not found (404) or found (200) and
2) then in Delphi how can I receive these responses?
3) What would be a good implemention of a serialnumber which has a expiry date encoded? Any examples welcome.
4) And please feel free if you have any better suggestions.

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2006-05-03 at 08:43:40ID21836606
Tags

delphi

Topic

Delphi Programming

Participating Experts
5
Points
500
Comments
11

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. ShellExecute function in Delphi 1
    Hi... I'm using ShellExecute to get the user's web browser to automatically come up and display my online registration web page whenever he selects the appropriate menu item. This works fine in Delphi 3 in my 32 bit version. But when I use the same code in Delphi 1 for my 1...
  2. Waiting for shellexecute
    How do I persuade Delphi to wait until the program I have just shellexecuted finishes. I am currently cheating by shellexecuting a batch file which runs the program, then creates a small text file as a tag to say finished. Surely there's a better way!
  3. ShellExecute window...
    I open files using ShellExecute command. The command opens application, according to file type. Can I get window handle of starting application? For example, I open txt file. Notepad started. Now I want get window handle of notepad (to change size, location etc. of the w...
  4. Shellexecute
    How can is retrieve the ERRORLEVEL when running an external program using Shellexecute. (in VB)
  5. ShellExecute
    I want to get the handle of the application I open with ShellExecute. I DO NOT want to use FindWindow. I'd like to somehow get the window handle from shellexecute. Cheers. Fidel.
  6. shellexecute ()
    Hi. Here is my problem. i call with shellexecute() my.exe with some parameters its ok i know how to do that. Problem is is it posible to get answer wich is gived from my.exe. exsample: i call my.exe with parameter -hellow my.exe writes "hellow world" and close...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: DragonSlayerPosted on 2006-05-03 at 09:40:39ID: 16597846

1. At the server end, the PHP script can return a result (not necessarily a response code, it can be plain text), which would be encrypted. You can specify the responses that your app react to, e.g. if the PHP script returns code 100, it can mean that everything is OK. (Of course, again, the code will be *encrypted*).

2. I would recommend that you use an HTTP component such as Indy's TIdHttp. That way, when you issue a GET, you can just check the resulting response that you got.

e.g.

var
  Reply: string;

Reply := DecryptCode(IdHttp1.Get('http://www.signgenius.com/phpscript.php?serial=1234456343'));
// assume that DecryptCode is a function which decrypts the reply into something that your programme will understand

I would also suggest that instead of sending the serial in plain sight, it will be a good idea to encrypt it as well, because anyone with a proxy tool will be able to sniff out the GET.

 

by: JDSkinnerPosted on 2006-05-03 at 12:46:18ID: 16599557

Questions:
1.  Have you handled re-installation of the software on the same PC by the user?
2.  Have you handled re-installation of the software on another PC when the first PC became obsolete?

Have a look at the link below it has some usefull tips.
http://www.inner-smile.com/nocrack.phtml

 

by: sakuya_suPosted on 2006-05-03 at 14:07:55ID: 16600434

there is also another flaw in that security design, anyone with a custom made proxy can also fake whatever your server send as a OK Serial number. so the proxy will return a OK Code to the program and your server will never actually see the request.

 

by: jpedefPosted on 2006-05-03 at 22:11:11ID: 16602869

One solution is to use TDownloadUrl action (in ExtActns unit) and make your php script return somekind of ini-file so you can easily have additional information, witch you can
show to your user. Actual response should be crypted someway.

  fDownload := TDownLoadURL.Create(self);
  try
    fDownload.Filename := 'C:\Temp\Result.ini';
    fDownload.URL := 'http://myserver.com/myscript.php?code=1234567890';
    fDownload.ExecuteTarget(nil);
    ParseResultIni('C:\Temp\Result.ini');
  finally
    FreeAndNil(fDownload);
  end;

Your software is time limited, hopefully you have considered what if user turns computer clock back?

 

by: JDSkinnerPosted on 2006-05-03 at 23:46:03ID: 16603174

Have a look at the last comment block in the thread indicated below, it may give you some ideas on serial number implementation.

http://www.experts-exchange.com/Programming/Programming_Languages/Delphi/Q_21733559.html

 

by: Marius0188Posted on 2006-05-04 at 06:32:57ID: 16605298

>>Questions:
>>1.  Have you handled re-installation of the software on the same PC by the user?
>>2.  Have you handled re-installation of the software on another PC when the first PC became obsolete?

In regards to this comment we have thought about it but we have decided not to REALLY block the user.
We would though just like to enable us to identify serial numbers that have been mis-used.
For example:
If we see in the MySQL database (online) that a certain key has been used 5000 in a single month then its quite likely been posted on some serial crack website. So we can now 1) identify this serial number, 2) disable it and 3) issue the original user a new serial should we think he is innocent.

 

by: Marius0188Posted on 2006-05-04 at 06:40:42ID: 16605376

My I ask to all,

In general our goal is not to try and fight piracy 100% which will result in a very lengthy process.

We are aiming for the following:
1) Implement a simple hazzle free (for end user) security system just to stop the rookies from copying our software
2) Track the use (qty) of serial numbers.
3) Yes and then we would like to make it secure on the simplest level. As long as the user is not able to just make a raw copy and distribute to all his friends, we are happy. Because he need to distribute his serial number as well and then we will be able to identify these mis-uses of serial numbers and we can track down the user.

Do you believe that the process I have explained in the very first comment will provide the best solution to this?
Does anyone else have a better solution?

 

by: Marius0188Posted on 2006-05-04 at 06:42:55ID: 16605399

And sorry I fogot to add.

I would like more specifics to the creation of a time limited serial.
I have read through the article listed on http://www.inner-smile.com/nocrack.phtml
and it was really helpfull.

But some ideas of creating a serial number with expiry date embedded would also be appreciated.


Thanks in advance!

 

by: mwbowmanPosted on 2006-05-04 at 08:51:03ID: 16606886


Another option would be to use a 3rd party registration service such as Software DNA.  They provide the necessary SDK for connecting to their site and manage the registration issues for you.

Have a look at https://www.softworkz.com for more info...

 

by: JDSkinnerPosted on 2006-05-04 at 14:00:18ID: 16609791

Ok

First you need an serial number encryption system that allows you to encode not only the user's serial number but also the fact that it is time limited.

Have a database table with customers name, serial number, date allocated, current time limit and encrypted registration string (If issued).

You could issue software with a tempory activation key as standard.

The software when run for the first time checks the registry for a valid registration, as none has yet been entered, a registration key is requested. A default Registration key with 30 day timer is entered.

Once the user has entered this, then the encrypted data can be stored in several points within the registry, along with the encrypted installation or issue date. The format of the encrypted acivation key should be modified prior to storeage in case the user tries to find it with a registry search using the activation key you supplied
Example:
Date encrypted as StrDate
procedure TfrmRegistration.InsertDateInstalled(strDate: string);
var Reg: TRegistry;
begin
    Reg:= TRegistry.Create;
    try
        Reg.RootKey:= HKEY_CURRENT_USER;
        if Reg.Openkey('<AnyFolderName>', true) then
            Reg.WriteString('<dateIssued>', strDate);
    finally
        Reg.CloseKey;
        Reg.Free;
    end;
end;

Thereafter when the software is run, a number of different routines from various points within your software should extract the data from the registry and decrypt it, Only the decryption routine should be in your supplied software).
Then run calc against current date to see if software authorisation has expired. If the software is out of time then set a number of booleans to flag the fact and take some sort of action.  Set another registry value to record that the software has expired. This registry reading should be checked ever time the software is run and acted upon.

To help prevent the user from resetting the date encrypt within the registry the number of times
that the software has been run should also be encrypted and stored in the registry, if the number of runs is checked and if it exceeds a preset number then action can again be taken.

Increment the number of times the software has been run after each check and re encrypt the result.

The Activation code needs to look different for every new serial number that you issue, so that certain
characteristics such as the time limit or lack of time limit are not identifiable,
otherwise this may allow the user to change part of their serial number to affect the time limit.

Having embedded a time limit, you can either prefix it with an encrypted marker to indicate its start point or place it at a fixed point, although the latter is not adviseable.

ie Variable length dummy prefix + Serial no xxx + Time Limit or No Limit + dummy suffix to pad string out

Below are two simple examples with a key code run up for this example only.

Dummy prefix variable Length + Serial Number 1234567890 + Time Limit 30+ Dummy suffix
NERK94wV9|5/Djd1X8KnALOJ-ejpEBelza0uXYz@tyoXKX8GbGUg0I2AQcG.YSGkLN:npMC/QrhcMSUE41@4W

Then the same serial and time limit with slightly different prefix to give an entirely
different activation key string

Another prefix of variable Length + Serial Number 1234567890 + Time Limit  30+ different suffix
:0Dwn:F5g4IEaETZ9uYmxtHECBsQYqQ.21bzgNLdTQbsboSliCz1hWbWvhSO:TG3LNLTBavcquipjtU4P1@lHX2oNpXPa|0

The two encrypted strings contain the same base information but look entirely different.

When the user runs the software the registry details should be  looked up from a number of different points within your application and action taken according to the results returned.

Good luck


 

by: JDSkinnerPosted on 2006-05-07 at 05:39:56ID: 16624998

Another 3rd party piece of software can be downloaded from the link below.
This is supplied as Freeware and is quite comprehensive.

http://www.wakproductions.com/regware/

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...