Need to supply purchasers with a software unlocking code

http://www.chosenbytes.com/

http://www.peterssoftware.com/ka.htm

http://www.copyminder.com/

an algorithm for generating your own unlock key
http://www.thescripts.com/forum/thread189218.html

installer that generates serial #'s
http://www.indigorose.com/suf/features.php

Hello,

If you want a serious key, look into MD5 encryption. It is often used to generate and check licence keys. The good thing  is  that it's available for any language you might fancy.

MD5 Homepage (unofficial) http://userpages.umbc.edu/~mabzug1/cs/md5/md5.html
MD5 @ Wikipedia http://en.wikipedia.org/wiki/MD5

The downside is that's is very far from a ready-made solution. It will requite some research.

Basic idea: implement MD5 in your application, and use it to compute a "checksum" of some binary data & the "Licensed to:" field. The license key is simply that checksum. Additional security can be obtained by adding the hard-drive's serial number, or other workstation-specific information, to the encrypted data.

In other words, the "licensing" page must contain at least one field "Licensed to:" and perhaps another field "Workstation ID string", which your software provides in demo mode. These, together with the binary data that you have provided Regsoft, allows them to calculate the identical checksum.

You can be 99% certain that they already have MD5 software, so that they should be happy with minimal instructions.

Hope this helps!

Cheers!
(°v°)

Hello,

Looked a bit more into it. Regsoft writes:

   We can support the following methods to generate a key for your product.
   1) [...]
   2) Logic to create a key that we can write in our web scripting language PHP.

And,  by looking at a PHP manual {http://www.php.net/manual/en/function.md5.php} we find that MD5 is indeed a built-in command.

In other words, if you can incorporate MD5 into your application, you are ready to go.

Cheers!
(°v°)

Hi puppydogbuddy,
thanks for the great links, it appears       http://www.chosenbytes.com/ in the future will support Access,
I found a website that says there software works with Access http://www.ionworx.com/SerialShield.html,
I emailed them and they responded quite quickly,


It is kind of of interesting the way all this licensing scheme works, it appears that ionworx will generate a list of  keys (if I purchase there product) that will unlock/register my application and turn the demo/trial into a licensed full version.  

I believe that they have to modes manual and Automatically using option SerialShield Internet Activation (14.95 Euros / Monhth) which I have no intention on purchasing,
If I have a single static number as my unlock key I will not need to supply regsoft with a list of keys, but if I do supply regsoft with a list of unlock keys each key will need to be placed into the programs code upon registration/purchasing which will require ??? I think as harfang mentioned php where is if I have a single unlock key there will be no need for any changes in my program per purchase.

After downloading the serial shield Licensing protection trial/demo called (DemoAccess.mdb) and using it, trying to figure out how I can use it in my program.
I believe the way serialshield works is they place code in the (registartion) form onclick procedure that calls a .dll called (serialshield.dll) which must be placed in windows/system32 folder, the registration form gets opened via a macro called (autoexec), they also have a module called (module1) but I don't know where it gets called from it constantly refers to the (serialshield.dll)

Ok, now I execute the serialshieldmanager.exe which will generate the unlock license keys/serial numbers or Key/serial number if I intend to use just 1 key, and it also makes a profile for my program and in the profile the application name and application key will need to be copied into the code in the register form. Refer to there viewvideo.html file.

My question,
Now how do I get all this to work with my program? And implement it into my packing program called msi wizard by sagekey that turns my .mdb file into a runtime .exe file for downloading/purchasing.
Do I copy all the objects in the demoaccess.mdb: register form with the code in the on open event procedure. Module1, and  the serialshield.dll? and have the register form open when my program opens, If I have the register form open when my program opens then how do I have my already existing mainmenu/switchboard form open 1st?  Maybe I could disable the register form once the unlock key has been entered into the register form and the program has been licensed. How would I copy the serialshield.dll to the purchasers windows/system32 folder?


Thanks harfang for the help, unfortunately I don’t know php, but if I have to I can hopefully figure it out, of course with help.

Any suggestions or explanation on how this works will be greatly appreciated.

Thanks—Experts, I apologize for such a late response,
but I’m having a hard time figuring all this out, and did not want to respond before thinking it all over and trying to actually implement it into my program.

Hi patentinv,
Good to see you making progress on marketing your application.  Of the above links, the only one I've used is   http://www.indigorose.com/suf/features.php, which is an installer that generates serial #'s using MD5 encryption that Harfang referred.  

I can tell you this.  No matter which way you go, you should have an auto run installer program that installs your program based on info entered by the purchaser in response to prompts from the installer program.  The license#(encrypted) is one of the items that should be contained within the installer, and matched against the license entered by the purchaser when prompted by the installer software.

You don't mention anything about the installer aspects.  Is RegSoft supplying the installer or are you supplying your own?  Compatibility is critical here. And if the installer generates and tracks encrypted license#'s, I really don't know how much more you would need....

Hope this helps.

Hi harfang,

Wow, you are the best!! I really appreciate all your help. Thanks

I think I understand how all this works. I’m going to start at the very beginning to make sure. Please correct me if I’m wrong. If you will? Thanks!!

The purchaser clicks buy on my website, he is brought to the regsoft ordering process forms. He fills them out and his credit card gets approved. (Does he need the key before he can download the program)
He now downloads my program, and starts to installs it.
Will he be able to install my program wit out the unlocking key or will he need this to install it? I believe he will need to get the unlocking key before he can install it.
I’m not sure if your demo database gets ran separately from my program and acts as an install program or if I add all your objects to my program? (I don't believe I do)
Or
Is it as easy as you say, I just give regsoft your secret code, of course which I will need to make up (how long would you make the secret code) and this line
Key = Left( MD5( Secret + UserName + MachineTag ), 10 )
Or
is this part of the demo/trial database he downloads for free with an evaluations period and once this evolutions period ends (say he gets to open it 5 times) he gets prompted to register it to get the full version?
Which opens a web browser with a form in it asking for the Username and Machine Tag?
After he fills in these fields he clicks submit which sends the web browser forms where?
To Regsoft?
I’m guessing to who ever will provide the unlocking key.
Will he need to show proof he is registered as a purchaser of my software.

When is the Machine Tag created when he first try’s to install the program?  

Your sample Unlocking Demo is really a great way to explain and illustrate this process, thanks. With out it I would not have been able to come up with all the questions mentioned above, I believe this will really help your client,  It sure helped me. And you are right it is fun.

Hi puppydogbuddy,
Thanks for all the suggestions, I looked into Indigorose Setp factory 7.0, It appears to be the most complete installer that I've seen so far and has lots options for support, there are alot of high up there company's that use it. It is kinda of expensive but I'm sure it's worth it. I like harfangs suggestions better, now to see if I can get his suggestions to work.

I appologize for not quite understanding all this, I never new the marketing and generating the unlocking keys was so involved, but I should of known better.

Thanks--experts I don't know what I would do with out all your help, you guys are the best.

patentinv

Hi,

Thanks for the compliments. From your questions, I see that the actual presentation is just as important as the "slide show". Let me mimic it here... 'Foobar' application from 'UbicSA'...

Welcome,

Foobar is distributed through internet, CD handouts, and mailings to our target audience. The software initiates in DEMO mode. As you know, it's limited to 10 kloinks and 20 blams -- just enough for testing -- without any time limit. Furthermore, the reports cannot be customized and will print with our UbicSA logo and the words DEMO VERSION in various places.

[Meanwhile, I 'download' the sample, unzip and run -- show the header DEMO MODE]

The user can test Foobar within the limitations, but some features can be disabled.

[I show the *disabled* message and click on the link n° 3 "instructions..."]

When ready to register Foobar, the user will open the registration dialog box [clicking on first link], which in turn links to our page on the registration company server, e.g. Reg$oft.

[Opening the "fake browser", explaining it's a fake, and setup the "browsing experience", showing the registration form and the "browser" window side-by-side]

Assume that this is a real page. At that point the user is instructed about the machine tag (my real speech differs here), which uniquely identifies a computer. The registration will be for one client, working on one computer. For example...

[Typing: Toys'R'dults as the company name, copy-pasting the machine tag]

These two items are all that is needed [continue through the "buying" process, reach the last screen] to generate the unlocking code. This code can be made visible on the page, or sent through e-mail, naturally.

[Copy-paste the key back into the form, click OK]

And Foobar is now unlocked. It will now allow the customization of the reports and remove all restrictions [show that *disabled* is gone...]

The entries in the registration form are saved [show the name Toys'R'dults under the title] and are checked each time the program is run.

[Close the program and reopen it.]

The method is in fact quite simple [click on "instructions" which now works...] ...



You get the idea, I'm stopping the "speech" here ;)

In my real-life case, the "machine tag" is something different, let's call it a "license tag" containing various options. However, in both cases, the user need Foobar to generate or obtain that "tag". So that this method is suitable for software distributed as demo verions, morphing into full versions once a valid key is provided.

For my "license tag", I could compute it on a web page (but we don't want that). For the "machine tag" it's not possible, the user will need to download at least a tiny "machine tag sniffer" to read the hard drive.

Anyway, we have four strings and four actors. How does it work?
* Secret: "xyz"
* User Name: "ABC"
* Tag: "123"
* Key: "6e-db-f5-d9-e3"

These are linked like this (try in VB's immediate pane):

    ? GenKey.MD5("xyzABC123")
    6edbf5d9e3dba6ec03926d71b97a76e6  ' the MD5 digest
    6e-db-f5-d9-e3     ' I used the first 10 chars in this demo

Now MD5 has become very common. Anybody with MySQL, Perl5, PHP, Delphi, etc can compute this digest in seconds.... But not without "xyz", and not without the "recipe".

Foobar has both the secret and the recipe, you provide Run$oft with the same:

    Secret: "xyz"
    get 'User' and 'Tag' on the registration page.
    digest: MD5( Secret + User + Tag )
    Key: "00-00-00-00-00" formatted, leading 10 characters of digest

Both Foobar and Run$oft have all needed information, can compute the key and compare notes.
- Foobar's code: see claLicense
- Run$oft's code: fpopRegistration (read the code, the core is one line)

The user has neither. The only cheap way to obtain a key is to ask someone with both.

In short:
* UbicSA: hides the secret in Foobar, gives the secret to Run$oft
* Toys'R'dults: gets Tag from Foobar, sends User and Tag to Run$oft, gets Key in return
* Run$oft: has everything, can compute Key
* Foobar: has everything, can see if provided Key is valid.


I was hoping to avoid this post by sending out the sample ;)


Let's see if I answered all your questions...

 * The user needs to download the demo fist, unless you drop the machine tag idea
 * Reg$oft need only two things: the secret and the one-line formula.
 * Foobar needs a VB implementation of MD5
 * You need to program:
    - storing and retrieving user name and key
    - validation by using the same formula and comparing

That's it.

- claMD5: a version of MD5 I found on the internet, used as is

- claLicense: a wrapper class to handle the "recipe", and to store User and Key to the registry
  [use it as a sample if you like]

- basSystemInfo: generates the "machine tag"
  [only useful for machine-dependant keys]

- basGlobal: to create static class instances

- fmodUnlock: how to use claLicense from the GUI

The rest was for the sow only (fake browser, etc.)


Wow, that's a long post. This project seems important to me :)

Cheers!
(°v°)

Hi Harfang,

Thanks for your time and help, I really appreciate it, I've been trying to figure this out for close to a month now, I've down loaded most likely 20 different unlock key programs and ran there demo's and they all appeared faulty, leaving me in the same predicament, wondering what to do. Now with your help I feel like I'm starting to understand this process more clearly and can hopefully get my product up for sell with regsoft.


Getting the Demo program setup properly:
claLicense: a wrapper class to handle the "recipe", and to store User and Key to the registry
 
My Demo program needs to generate the machine tag by using the module (basSystemInfo)
 
My Demo program needs to send regsoft the User Name and the Machine Tag,
Isn’t this accomplished by the user typing this info. Into a browser window? Do I make a link to regsoft, I wonder if regsoft can create a custom made form that will have the required fields to allow the user to type in the needed info. Customer and Machine Tag.

My Demo program needs to unlock the full version by accepting the key.
I believe by comparing using a VB version of MD5.


I got the regsoft account activated, I also talked to regsoft and asked them what they would need in order to pass out the unlocking key, they said;

The key generator file? Is that your formula?
Key = Left( MD5( Secret + UserName + MachineTag ), 10 )  “Secret” how long should the secret be? Should the characters be numbers or letters? Or does it matter?

Regsoft needs to know what fields are passed, I believe it will be the (customer name) and (machine tag) I will need to create a custom field on the regsoft order page called (machine tag).  

Questions??

Q- How are the two modules (basSystemInfo)  and (claLicense) called/ran? I can’t find any references to them in your Unlocking Demo database. Do they run automatically?

Q- You mention UbicSA hides the secret in Foobar, I’m guessing its only included in Foobar and that is why I can’t find it in your Unlocking Demo database?

Q- Does a different unlocking key get generated per customer based on the formula we provide to regsoft? I have to make sure, I believe it does.

Q- Can I use the modules (basSystemInfo, claLicense, claMD5) that are in the Demo Unlock database you sent me  in my demo database? And would I import them into my demo program?

You mention the following:  
You need to program:

    - storing and retrieving user name and key  
Q- Where should I store these, in a table in Access?

    - validation by using the same formula and comparing,
Q- OK, Once the key gets copied into the Registration form it will need to be compared/checked to make sure it is correct by using the same formula regsoft used
to generated it, will MD5 work in Access or will I need a VB Implementation of MD5 as you mention Foobar does? And if so do you have any suggestions of where to get one?

I’m not sure if I’m capable of being able to get all these pieces together to accomplish this task. My programming skills are 0-Null.

Maybe it would be easier to have 1 static key that would unlock the demo database.
Unless I was to out source my project to Rent-a-Coder, I hate to keep asking you for help.

I appologize if I'm repeating my self in this post, I'm struggling with all this info. trying to figure it out.

Thanks harfang, I sincerely appreciate all your help, you experts are best.

patentinv

Hello,


> The key generator file? Is that your formula?
> Key = Left( MD5( Secret + UserName + MachineTag ), 10 )

Yes, that is it. Regsoft will have to request two strings from the user. The first can be the company name, the second will need a special field in their ordering form.


> “Secret” how long should the secret be? Should the characters be numbers or letters? Or does it matter?

Nobody will try to crack it, so a dozen characters would seem safe to me, but you will probably use something longer. Any text, number, binary data will do.


> Q- How are the two modules (basSystemInfo)  and (claLicense) called/ran? I can’t find any references to them in your Unlocking Demo database. Do they run automatically?

claLicense is initiated automatically in basGlobals: "Global MyApp As New claLicense". After that all calls to that module go through the global "MyApp" object variable.

basSytemInfo has a single useable function: MachineTag(), returning the digest derived from the hard disk's volume name and serial number.


> Q- You mention UbicSA hides the secret in Foobar, I’m guessing its only included in Foobar and that is why I can’t find it in your Unlocking Demo database?

The secret is "This is a Very Secret String". You will find it in three places: in the fake browser (meaning Regsoft will need to know it), in claLicense (so that the application can perform the same computations) and in the "information form", just scroll down.


> Q- Does a different unlocking key get generated per customer based on the formula we provide to regsoft? I have to make sure, I believe it does.

The key will be different for every customer and for every computer.


> Q- Can I use the modules (basSystemInfo, claLicense, claMD5) that are in the Demo Unlock database you sent me  in my demo database? And would I import them into my demo program?

You can use freely my modules. Read claMD5, the author explains what you can do with it.

To import the functions into your application, you will need these three, along with basGlobals and perhaps the unlocking form fmodUnlock as template to build those functions into your own interface.


> Q- Where should I store these, in a table in Access?

Typical choices: a table, the registry, an INI file, a separate text file, as database properties.
This demo uses the registry.


> Q- [...] need a VB Implementation of MD5 [...]

Yes. claMD5 is such a VB implementation. Check the links provided before {http:#16570836} for more information. Regsoft, however, already has MD5 as a built-in command in PHP.


> I’m not sure if I’m capable of being able to get all these pieces together to accomplish this task. My programming skills are 0-Null.

My mistake. From your profile page, I assumed you were a programmer and also the author of the Access application you intend to sell. Surely your programmer should be able to understand my sample database and my explanations?


> Unless I was to out source my project to Rent-a-Coder.

I'm open to suggestions. My e-mail is on my profile page.

Else, start with just importing the four modules into a new blank database. In the immediate pane, start playing with MD5:

    ? GenKey.MD5("test")
    098f6bcd4621d373cade4e832627b4f6

And go from there.

Good luck!
(°v°)

Hi,
My programming skills are 0-Null. Sorry I meant my VBA skills, I know acccess fairly well, I don't know code.
So all the modules that need to be implemented into my program kinda throws me for a loop.

I developed my own program with a whole lot of help from you experts.
I could never of developed it the way it out your guys help.

My own program only has 2-3 modules in it and I've been developing it for close to 1 year now.

So you can kinda understand my confusion. Here I'am thinking I'm done with my program and all of a sudden my greatest
hurtle hits me, (I had no idea selling my program would be so involved) that requires multiple configurations, web (Regsoft), 4-5 different modules some that write to the registry,
Php (pearl), etc. I think it is really interesting, and enjoy trying to figure it out, but I may have met my limits.

Any ways I had to explain my situation,
Now Back to trying to figure out how to get my demo program to work with regsoft to provide an unlock key based on the customer and the machine tag so it can be turn into the pro or lite version.

My program is available in 2 different versions Pro and Lite. So I believe I will need to also make two different  demo programs Pro and Lite? Or does it not matter as long as they user knows that what ever version they are testing will be the one that they will purchase, when they decide to buy it buy getting the unlock key.

So lets say the user has down loaded the pro version and it can only get excuted 5 times before expiring and its capabilities are also limited as you mentioned foobar was also, so they register it and get the unlock key, upon entering the unlock key it must run some code that activates the code or objects that were removed in the demo version so it can be turned into the real pro version.

Thanks--for your help.

patentinv

p.s. I sent you a test email,

OK where do I start?  

Hello,

The programming skills involved in setting up unlocking software are not too high, in terms of the algorythm used, but the implementation needs to be seemless and bug free.

At EE, we provide -- or attempt to provide -- answers to specific questions. In this case, the question is: "how to supply purchasers with a software unlocking code". One answer is:

Use an MD5 digest of relevant pieces of information to generate a key, for example using a secret string, the user name and a machine tag. The registration company can compute the "key", your software can also compute it. If they match, the registration is accepted.

We can also supply additional code samples, give pointers to various internet sources, find commercial sites proposing this kind of services, etc.

We do not, however, develop, debug, and maintain full solutions.

You now have one possible solution -- the one I exposed -- broken down into:

* adding MD5 capability to my software.
* create a way for the user to store relevant strings and the key
* automatically check the license at start-up.
* lock/unlock features based on the validity of the license.

It was probably a mistake to publish my little demo "slide show" application. It was meant as an example only -- feel free to use any part of it however -- to convice you that:
- you can create convincing unlocking schemes in Access (that was the original point of the demo)
- it's relatively easy to implement and still quite safe

I guess you should not either get started and rebuild the idea brick by brick, use a commercial solution, or find a more experienced VB programmer to do it for you.

If you develop it your self, do as before, ask questions here for every step that you can't get working. You have the overall picture of what you need to acheive.

For example: "How do I use class modules?" - I have downloaded a class module {link here} and need to use it in my application. How do I proceed?

For example: "How to store user security information" - I need to store some short strings (user name, licence key, etc. What is the best way: a table, the registry, something else? Please provide complete and simple examples...

etc.

One last thing. You basically have three versions: demo, lite, and pro. You will have to choose between:
* light and pro versions both available in demo mode, can be unlocked
* all three versions downloadable. "lite" and "pro" request an unlocking code at startup
* single version. the user chooses which key he purchases, morphing the demo into "lite" or "pro".

Cheers!
(°v°)

Hello,

I'm starting realize more and more how involved this is going to be.

I believe my options are real simple.
- Post a project on rent-a-coder describing my needs in detail. And decide if I can afford to have it done for me.

- User down loads my demo program uses it, it expires and he either decides to buy it by going back to the website he got the demo from, in this case there would not even be a need for a key.

- Provide 1 static key that will unlock the the demo and turn it into a full program, that regsoft could hand out per invoice.
  This would require more programming because I would need to enable all pieces that were not enabled in the demo                               version, unless I don't disable any parts in the demo.

As I think this over more and more, If the user really likes my software he will buy it, and by having to go back to the website he got the demo from to purchase it doesn't  seem that big of a deal.
 
Here I'am developing my 1st software with a marketing scheme more advanced than any other software I have ever used.
All the software I have purchased 1,000's of dollars worth, and not once have I had any problem with not being able to load it on as many computer as I want. And here I'am trying to prevent this with my little program, boy I have alot of nerve. LOL  But why not if I can.

I also need to concern my self with making the demo program more secure right now I have a table that increments 1 every time the user opens the program untill desired number # then it expires, but any access programmer could figure this out and would have a free working program. Plus a few other security trick will only run in runtime mode, antishiftbypass disabled unless you know the password.

I need to have it write to the registry, in an unobvious manner instead of having a table increment 1, That would require some serious hacking to undo. Unless there is a better way.

Thanks--harfang I really appreciate your help, and can't thank you enough.

patentinv

Hello,

I think this is a good thread to have in the PAQ for future users: we covered all the bases.

We have the "how". Remains the question of "why". If your target customer is an individual, pirating is a real risk. So a key makes sense. To limit the license to a single computer is an overkill, in my opinion, but a key based on the customer name is still a reasonable protection:
- cool program, can you give me a copy?
- sure, here you go.
[...]
- can you give me the key?
- ahem, you would need to use my name, too.
- ah, well, I just want to test it fully

At that point, the "pirate" will probably either stop using the software, or get his own key. If he keeps on using it, he would probably never have purchased a license anyway.

If you now want to learn about techniques to disable some features, or to create a well-hidden time-based protection or sessions counter, I believe it's time for a new question... ;)

Good luck with your project,
(°v°)

Hello harfang,

I just wanted to sincerly thank you for all your help!! I have learned so muxh in the past week, all beacause of your help.

I have made a flow chart of this process and broken it up into seperate pieces and then went into detail how each piece will
work, asking (what if ?) through all details, trying not to over look some thing.

With out your help I would of never been able to make this flow chart, thank you.

I posted a response at RAC waiting for your response.

Now to implement it into my application.

Thank you again,
patentinv

Thanks for points and grade! Good luck with the implementation!
(°v°)