   License Key Generation (again?)
I found this thread: http://www.gamedev.net/community/forums/topic.asp?topic_id=268257 while I was looking for some solutions for DRM. This thread actually got me all crazy! It's like EVERYTHING is a bad solution! I found this: "http://www.gamedev.net/community/forums/topic.asp?topic_id=268257&whichpage=1&# 1649923" to be the easiest one. And this: "http://www.gamedev.net/community/forums/topic.asp?topic_id=268257&whichpage=1&# 1648920" to be a better aproach of the above one. What I thought was something like: - Having a specific hash for that software; - Having the costumer's name/fullname; - Do some awful things with those 2 and get something to use as a key; So it good to do like the first solution? (MD5 on the name + hash, AES for generation/validation) Keep in mind that I don't want the most effective super hard solution, cuz it's an 1 dolar game and it's already much of a pain to undestand how AES works. Thanks guys!
Quote:Original post by wagner_fsoaresMD5 on the name + hashSounds good.Quote:AES for generation/validationDon't bother. There will be plenty of weaker links in the chain than that. MD5 alone will guarantee that 99.9% of your userbase will need to visit skeevy cr4ckZ0R webpages and/or download pre-cracked torrents to get around giving you a buck, and that's really the best you can hope for. If you want to steganograph a customer's ID into the EXE so you know who to glare at you can, but there's not much reason to tangle that up with your key stuff.   ;  I see.But wouldn't adding AES encryption decrease chances for the game to be creacked?And the costumer's name is just for key generation.The costumer will put his name, email and key on the game, and the game will generate a key with his name and email and finally compare the generated key with the one he typed.   ;Simple licensing system:Client downloads an installer.Installer asks client for valid username and password. If username/password fails stop.Installer notifies server of an install attempt.The authentication server marks the user account as having attempted an install and logs the IP Address and MAC Address of the computer the game is being installed on; then it allows the download of the software In the case of installation failing, one can simply compare the values of the computer the software is being installed on versus that on the server and deny/allow the downloading of the files.Upon starting up the game, simply send the current MAC address to the authentication server. If they don't match then instruct the software to close with a message box.Allow the user to play the game and periodically send the MAC address to the server for verification.Advantages:It's easy to code and most users will not be aware of how to bypass the system.Authentication occurs on a centralized machine and can be integrated into systems such as forums, CMS, etc..Disadvantages:Easy to crack, simply NOP the checks to the server and the game is free to play.  This can be overcome by a variety of techniques, one is to compute a CRC hash of the code responsible for sending the MAC address to the server and exit if the precomputed hash on the server and the one sent don't match. If user replaces his NIC, gets a new computer, or has more than one then the system can fail. This could be remedied by implementing a web based interface that allows users to modify their only MAC address. ;  drm is a tricky thing, personally i don't like drm, it inconvenience the people who buy my software, and only hinders the ones who steal it for a very short time.;Quote:Original post by wagner_fsoaresI see.But wouldn't adding AES encryption decrease chances for the game to be creacked?Not necessarily. Chances are the crackers are just going to do as rofseek suggests and bypassed your check all together, so the additional level of obfuscation isn't going add much of value. However, you might consider a carrot to go with the stick, some small token as a further enticement to buy rather than pirate; doesn't have to be much. Even if you don't, the people who pirate it at a dollar probably wouldn't buy at any price and therefore aren't customers and probably not worth too much concern.   ;  Yeah, you got the point.As I suck at implementing hash algorithms I was looking for one.I found openssl, and it has some nice hash algorithms.2 questions:- Is HSA256 better for my purpose?- Should I use openssl just to use the HSA256 Digest? If not, is there any header I could use for this thing in particular?Thanks!   ;  As has been mentioned before, preventing someone unlocking the game by modifying code to take out your checks isn't possible. You can just try and make it difficult.However it is possible to stop someone making a keygen. The trick is to use public key cryptography. The game ships with the public key built in. You keep the private key, and use it to encrypt registration data. That means you're the only person that can make valid registration keys.   ;Quote:Original post by prh99Not necessarily. Chances are the crackers are just going to do as rofseek suggests and bypassed your check all together...the people who pirate it at a dollar probably wouldn't buy at any price and therefore aren't customers and probably not worth too much concern.Exactly. So anything beyond the bare minimum (simple hash) is just wasting your time, particularly with the code/data hurdles that modern operating systems will throw at your attempts to encrypt a code segment (possibly leading to false virus warnings and crashes on your REAL customers' computers). Remember, only one guy needs to crack your software. Once he does, do you really want the pirated version to be more stable and convenient than the legitimate version?   ;Quote:Original post by Sneftelanything beyond the bare minimum (simple hash) is just wasting your time, particularly with the code/data hurdles that modern operating systems will throw at your attempts to encrypt a code segment (possibly leading to false virus warnings and crashes on your REAL customers' computers). Remember, only one guy needs to crack your software. Once he does, do you really want the pirated version to be more stable and convenient than the legitimate version?This should be a sticky.- Sherief   