Time Limiting Software

You could not make a regular counter, but one with a seemingly random path. Where a normal counter counts as 1, 2, 3, 4, 5; yours could count as 9, 2, 1, 6, 3; Just make an algorithm and check against that. Whenever something is wrong (have a lot of redundancy build in, so you can check for modifications / use it to verify), you shut down the license.

You could do internet verification, where an essential file is retrieved from the server (different every day). But if the license has expired, you don't give it.

You could also just make a registry entry (Windows) or something else very simple. It might be simple to crack, but 99% of the users don't know, unless your application is widely popular (in which case you can afford quality security).

Really, make it simple. Although obscurity != security, it keeps away most kids.

PS: 30-day license is not a very good marketing strategy.

We have this debate fairly often around here actually [smile]

Personally I'm not a fan of attempts at limiting my usage of software. People will either be honest and buy it, or they'll find a way to steal it; plain and simple. I generally find myself far more likely to buy software that trusts me to be honest and do the right thing, than software that tries to force my hand. That's just my opinion, though.


As for your actual question: there's any number of methods you could try, ranging from trivial and easy to crack, to arcane and easy to crack. It really depends on how much effort you're willing to put into your DRM system, and how disappointed/frustrated you'll be when someone inevitably breaks past it. Again this is just my own biased opinion, but it seems to me to be a much better tradeoff to not mess with DRM in the first place, than to invest a lot of time in it and see it fail and watch pirated software proliferate all over the internet.

Quote:

Original post by ApochPiQ We have this debate fairly often around here actually [smile] Personally I'm not a fan of attempts at limiting my usage of software. People will either be honest and buy it, or they'll find a way to steal it; plain and simple. I generally find myself far more likely to buy software that trusts me to be honest and do the right thing, than software that tries to force my hand. That's just my opinion, though. As for your actual question: there's any number of methods you could try, ranging from trivial and easy to crack, to arcane and easy to crack. It really depends on how much effort you're willing to put into your DRM system, and how disappointed/frustrated you'll be when someone inevitably breaks past it. Again this is just my own biased opinion, but it seems to me to be a much better tradeoff to not mess with DRM in the first place, than to invest a lot of time in it and see it fail and watch pirated software proliferate all over the internet.

There is also the insanely annoying for end users but quite difficult/timeconsuming to crack, such as what UBI did for AC2 and Settlers.

That crap was/is supposedly insanely annoying (having to be online to play singleplayer, game kicking you out losing your progress if your connection went down even for just a few seconds(I think they've changed this though), and their DRM servers not being able to handle the load locking legitimate players out from the game(IIRC They blamed this on ddos attacks)), it did take quite some time before a fully working crack was out though so they might have benefited from it.

(That DRM caused me not to buy Settlers though, and since the bad press starforce got(I don't know how much of that was warranted since i never bought any starforce games) it was the first time a DRM solution has kept me from buying a game i wanted to play and still has me boycoting Ubitosft. (When they let me buy Settlers without that insane DRM i'll start looking at their other games aswell(R.U.S.E looks interesting and supposedly "only" uses steam)).

In general i believe DRM can help to keep the honest people honest by making the step to piracy bigger, but it really doesn't have to be hard to crack, the average pirate will just download a crack (or get a pre-cracked version directly) and trying to delay the crack isn't that important for independant developers since we generally don't have the resources to do so effectivly and our sales tend to be far less concentrated in the first few weeks after launch than AAA games.

Is there *any* popular software out there that people haven't managed to crack? All these elaborate methods (e.g. DRM) seem like a waste of time to me.
Just record the installation date in the registry and check if it's expired each time the program runs. If you want to prevent the user from turning their clock back, you can record the dates the program is run and automatically expire if it moves backwards. But there's always the chance an innocent user has their clock settings wrong, and your program locks them out when they try to correct them.

Quote:

Original post by taz0010 Is there *any* popular software out there that people haven't managed to crack? All these elaborate methods (e.g. DRM) seem like a waste of time to me. Just record the installation date in the registry and check if it's expired each time the program runs. If you want to prevent the user from turning their clock back, you can record the dates the program is run and automatically expire if it moves backwards. But there's always the chance an innocent user has their clock settings wrong, and your program locks them out when they try to correct them.

Steinberg's Cubase 4 I think it was went years without being cracked, yet 5 was cracked within days

Yes, recording the date in the registry sounds like a good idea. Editing the registry is beyond your casual user. When my software is more succesful and the big time cracking crews have turned their attention to it I'll think up something cleverer.

Once you have your "demo" version ready.
Then you can hire/pay people to check warez sites regularly and they will request rapidshare etc etc to remove it.
I've heard it works very well and it's not that expensive.

Quote:

Original post by Litheon Once you have your "demo" version ready. Then you can hire/pay people to check warez sites regularly and they will request rapidshare etc etc to remove it. I've heard it works very well and it's not that expensive.

Not sure where you "heard" this from but it sounds fishy to me.

The vast majority of sites that are willing to host pirated software will simply laugh at you if you request them to remove your software - even if you are a large company with a lot of money and lawyers to throw around. Of particular note are sites located in countries like Russia with terribly bad attitudes about IP law.

Quote:

Original post by ApochPiQ Quote: Original post by Litheon Once you have your "demo" version ready. Then you can hire/pay people to check warez sites regularly and they will request rapidshare etc etc to remove it. I've heard it works very well and it's not that expensive. Not sure where you "heard" this from but it sounds fishy to me. The vast majority of sites that are willing to host pirated software will simply laugh at you if you request them to remove your software - even if you are a large company with a lot of money and lawyers to throw around. Of particular note are sites located in countries like Russia with terribly bad attitudes about IP law.

Oh, for clarity, I'm talking about hosts like rapidshare, megaupload, hotfile and so on, they will remove it.
I'm not talking about torrents etc. (you know what I mean :))
But the company where I work at uses such a service, and we haven't seen a working link to such hosts anymore.
And in this way you already eliminate a lot of n00b illegal downloaders that just click on links on releaselog sites.

And I think, but I'm really not sure, but it costs like a dollar a day (not sure). But probably someone on this forum has more experience with this.

I have a couple of ideas I might one day try if I ever start selling software I create outside of work:

Release the full version free of charge, but include a *very unintrusive* watermark in the corner of screen, or when each level loads, or whatever. It would say something like "Donate at www.xyz.com. When $5000 is reached I'll release a free version without this stupid message".

Once enough people have donated -- in other words once you feel you've made "enough" out of it -- release a new build without the messages.

Perhaps the game could try to connect to the internet and find out how much needs to be donated for the message to be removed. So perhaps the message might say "$2732/$5000 donated. This message will be removed once the target is reached" and eventually "Donation target met. Download version without these annoying messages from www.xyz.com".

The idea is that, providing the messages aren't annoying, nobody will bother to "crack" the software and there's still potential for revenue. Actually, my preferred text editor does something similar -- it displays a message about helping children in Uganda every time I open it -- and it's never bothered me.

Go for something simple, a registry value with the installation date, or a file in their system directory or something like that. Time limiting can sometimes (I've encountered this) be circumvented in as simple a manner as turning your clock back a bit, so don't rely on it. You could keep track of how many times the software is opened, this is a bit easier to rely on, but also kind of annoying for the user if something crashes and their counter ticks up as a result.

Finally, you could produce two different versions, one public demo, one unrestricted full version. This is the safest way really, because it means you're not shipping the whole thing for someone to simply "unlock".

If requiring an Internet connection is okay for this application, then contacting a Network Time Protocol server to get the time & date could be one option.

Considering that you want to sell the application on the Internet then requiring an Internet connection to use the trial version should not be too much to ask.

You would not have to operate a server and people who would want to go around the limitation would have to do much more work than turn back the local clock.

You could have a list of NTP servers so that if one disappears then there are more to try. I would not implement this idea to rely on only one server. In fact it could be a good idea to have it ask the time & date from several servers, and maybe try to prevent the use of local servers if possible (the user could try to set up his own servers).

Probably encryption of the network traffic would be useful. And you need to hide the server addresses so that the user can't replace them too easily.

The reference point of the time & date should be moderately-well hidden though somewhere in your application.

Perhaps obfuscated and/or encrypted and maybe using several checking points in the application code so that modifying one location of application memory would not be enough. Basically littering the application with the checks and maybe even having the reference point of the time & date stored differently many times in the application so if a black-hat hacker by-passes one of the checks or figures out one reference point then there are tens still to be found! Okay maybe this goes too far...


Too much trouble? I don't know. Maybe someone has tried something like this.

Also, if the "DRM" is only active in the trial version you can go much further than you could in the full version since the negative effects (such as having to be connected to the internet) won't affect paying customers.