SM SerialKey Generator 1.0 RC

infuzion · 26 Sept 2011

CoreStyler wrote: ...so it makes difficult for Crackers to release your commercial softwares.

Have you given a protected VST to crackers to verify this?

trogluddite · 26 Sept 2011

infuzion wrote: Have you given a protected VST to crackers to verify this?

Wow, doesn't time fly?! - the 'how secure can I make my SM plugin?' debate seems to come around quicker every year! 😈

CoreStyler · 26 Sept 2011

Is not totally secure obiviously. But garant's quite security because instead using custom serials list or password serial is generated using MAC address and other data. The way is more secure while no information on "how to find challenge response" are included in the registration file of the client. Last but not less important, this solution need to be implemented not only into the plugin but requires a website with an "Access control" to make available authentication only on paying users. Can also be set by sending e-mails directly from the plugins, and collecting data needed. (cracker will not find nothing to use in the output in any case).

I have no ability to create a revolutionary system... I just built an OSM from and idea of solution. 😉

You two are masters of SM. Maybe you can join the project?

infuzion · 26 Sept 2011

Some great ideas, but what happens if a cracker pays for a copy to make more copies? I used to think CUDA etc would make cracking faster, but I guess the newest craze is to upload to Amazon EC2 & make a brute force crack at 400,000 attempts/second. http://www.reuters.com/article/2011/01/ ... 1M20110107 http://diydrones.com/profiles/blogs/wif ... th-a-radio

So to make protection worth it, we have to make it uncrackable. Anything else is frustrating to users IMHO. I don't use Reason anymore due to having use a key/internet just to open it.

CoreStyler · 26 Sept 2011

Yes is frustrating for user, frustrating for companies i think when millions of dollars disappear! (it's not our case 🙂 ) http://news.softpedia.com/news/WGA-Iden ... 0608.shtml

We have to make the best security system with best user-friendly experience. Now it's easy my system. i will work more on it! I'll implement it for my new synth coming soon "Dominus VSTi". I will see how it is secure! my Hardcore Kicks VSTi has been easily cracked (serial key protection on installer) by team air. Hope they can't or find it hard 😮

trogluddite · 27 Sept 2011

CoreStyler wrote: MAC address and other data.

Remember to consider your users with more than one PC (i.e. Home workstation + Laptop for live performance), and that many people upgrade their hardware pretty regularly. Besides an automatic system, you will need to provide the customer service to enable legitimate users to obtain a new key - they will be very annoyed to have to pay twice for your plugin just because of replacing a broken NIC/HDD etc.

stw · 27 Sept 2011

Personally i don't know any PlugIn with Challenge/Response or whatever hardware realated protection which has not been cracked. In fact i think this is one of the easiest things to do nowadays. IMHO it bothers your customers more than it brings a plus on protection against cracking. And it's way more complicated to maintain on the verfication side. In my upcoming PlugIn i'm just using a simple serial key validation routine which will be cracked within a few days as soon as it's on the market. However it's a minimal solution for distinguishing between freeware and commercial software and letting honest customers know that they use a legit selled PlugIn

infuzion · 27 Sept 2011

stw wrote: In my upcoming PlugIn i'm just using a simple serial key validation routine which will be cracked within a few hours as soon as the crackers find it on the market. However it's a minimal solution for distinguishing between freeware and commercial software and letting honest customers know that they use a legit sold PlugIn.

Good point! I did have to make a correction or 2 😉.

CoreStyler · 27 Sept 2011

There's no any problems about multi-licensing per PC. Just by using two kind of subscription! for only on pc you pay less, for many pcs more and at any request you give the code. What is really important is to make simple to access the client store data. Yesterday i tried to work to a .php form. (but i'm not a php devloper and it is hard for me). I used a component for make forms in jooma (chrono forms). is easy to set new database for the clients but i can't find on how display a record (the key) after user submit of for example "transaction id". (precedently stored in database). On my new site i have a subscription system that allow to restrict downloads, pages etc. If i manage to create a form, i can set like that: user go to plugin registration page and enter some data "email, transaction id, plugin (selector)" then send the form to the database. Into the table we set another field "serial key" and we add the challenge-reponse/key code manually. [That i've done.] 😀 after we need a page that display the user data and the admin side field "serial key", like an account page. This can be secure by using CMS like joomla or others. Another idea, more good for me is that. For the registration page the same... but for accessing key user have to put "Transaction id" and "email" to verify identity.

As configured on my site is impossible (without brecking site) to send any form to the database if user has not payed. Access restriction of paypal subscription not allow not paying member. Try for example to click download button on this page http://www.thecorestylerz.net/downloads ... rator.html So no unlegit downloader can't insert their data into database.

In any case, a cracker could reverse engenieering the serial key generator. recreating the entire generator or suggest downloaders to "mac address masking"

Someone has ability in php forms and can help me?

infuzion · 27 Sept 2011

CoreStyler wrote: Someone has ability in php forms and can help me?

I would think that websites with forms are even easier to crack; SQL injection, floods, etc. Make sure you get an expert in security, not someone like me how can McGiver PHP.

CoreStyler · 28 Sept 2011

You are rigth. but my site is not Native istruments 😉 Mac giver are you here? wee need your php scripting! ok ok.. it says that will arrive with walker texas ranger. He garants on secuirity 😈

infuzion · 28 Sept 2011

Chuck Norris can create a perfectly secure website in 10 minutes with one hand. 😉

Tzarls · 28 Sept 2011

infuzion wrote: Chuck Norris can create a perfectly secure website in 10 minutes with one hand. 😉

Nope, he doesn´t even need one hand, just his beard.... but then it won´t be secure, because Chuck Norris himself can hack it´s way into that site... 😉

exonerate · 28 Sept 2011

CoreStyler wrote: Hi synthmakerz! I will show my project for serial key protection for Plugins or standalone. Features:

Generate unique codes by using MAC ADDRESS of client Challenge-response system for validating serial keys No sound or Shareware timers until validation Seller/Developer easy validation by using exe application Fully editable serial key generator algorithm Easy to implement in VST plugins or Standalone executables Optional server side authentication request

By the looks of your picture this would be very easy to crack. It doesn't matter how complex and fancy your serial algorithm is, if the output is a just a boolean that changes a selector all a cracker would have to do is find the boolean and set it to true.

Cheers

Exo

adamszabo · 28 Sept 2011

exonerate wrote: By the looks of your picture this would be very easy to crack. It doesn't matter how complex and fancy your serial algorithm is, if the output is a just a boolean that changes a selector all a cracker would have to do is find the boolean and set it to true.

Cheers

Exo

any suggestions on how to make it harder for them?

infuzion · 28 Sept 2011

adamszabo wrote: exonerate wrote: By the looks of your picture this would be very easy to crack. It doesn't matter how complex and fancy your serial algorithm is, if the output is a just a boolean that changes a selector all a cracker would have to do is find the boolean and set it to true.

any suggestions on how to make it harder for them?

I don't know if a cracker would know to look for a bool (unless you labeled it). But I would make more than one point of shutdown/noise.

Related thread for Reaktor: http://www.native-instruments.com/forum ... p?t=137468

adamszabo · 28 Sept 2011

infuzion wrote: I don't know if a cracker would know to look for a bool (unless you labeled it). But I would make more than one point of shutdown/noise.

but a bool is pretty easy to crack no? it has to be some complex routing so its not as simple if its true then there is signal, and if its false the signal stops.

Mo · 28 Sept 2011

adamszabo wrote: but a bool is pretty easy to crack no?

No, not in an SM VST. But a unlock mechanism can be cracked easily.

adamszabo · 29 Sept 2011

Can we get a bool example from someone so i can visualize what we are talking about?

exonerate · 29 Sept 2011

adamszabo wrote: exonerate wrote: By the looks of your picture this would be very easy to crack. It doesn't matter how complex and fancy your serial algorithm is, if the output is a just a boolean that changes a selector all a cracker would have to do is find the boolean and set it to true.

Cheers

Exo

any suggestions on how to make it harder for them?

Well the end result of the proposed protection is to shut off the sound and only allow it to pass if the serial is correct. So a better idea could be to incorporate the protection into a master volume knob (could keep the original selector as well ). Set the knobs value to zero and do something else to break the knob so it can't be used. Then use a trigger from that to do something else, for example you could use the trigger to break all knobs on the gui so they can't be turned ect..

An idea as well would be to break the serial up into sections, so lets say you had a serial for example wer8gh3b2 the first bit "wer" could break the knobs, then "8gh" could remove the preset manager and "3b2" could trigger a time bomb. By time bomb i mean you could start checking against a date and time in the future, say in 3 months time a pop up could be displayed saying that the user is using a cracked version asking them to please buy it and give a link to your website. Breaking the serial up like this would offer better protection against keygens.

Cheers 😉

Exo

CoreStyler · 30 Sept 2011

How we can set an algorithm like that?

Now i'm working on the project, so if someone would join is welcomed! I'm happy for the community interest on this topic. I would make it better, and i will see how time pass for my Dominus VSTi synth (not currently released) would be cracked.

Is there another thing. What i think is that a cracker would never spend a large amount of time for a synth that come out from SM. Maybe they become crazy for cracking cubase 6 now.. they will not lose time on ours, also if our plugs are excellent.

My Hardcore Kicks VSTi was cracked (it used serial key on installation software). But the new version (1.6) not! (and has more features and bug fix) This version use a different installer / different serial key... i found everywhere the HKVST 1.5 ASsIGn.. 😠

mayo · 3 Oct 2011

Hello CoreStyler,

as far as I understand correctly, you protect only the installer and not the plug itself. So after the installation you'll get unprotected .dll which is easily shared.

This has nothing to do with cracking as every one buyer could eventually share the unprotected library without any crack method needed.

So now you are looking for something more solid...

1. any C/R protection will just kill your sales; in combination with HW generated serial numbers = suicide 2. serial protection with integrated algorithm will be cracked sooner or later as our plugs were (BTW by ASSiGN group too 😉 ) 3. serial protection with valid serial numbers included directly in the plug is the same as previous 2. but crackable even easier

So we're getting to 4. the best anti-crack protection ever:

make your plugs unique, easy-to-use, with frequently updates + new features and pack it to user-friendly GUI with low price and flexible custom support -> just my 2 cents

CoreStyler · 5 Oct 2011

Is true what you are saying. But i have lost very much when AssiGn releases my HKVST. 🙁 Maybe i will work on a very fast and easy to manage Serial Validation Starting and Expanding this RC. This example of course is not over the installation but inside the synth. So, using MAC ADD.., is pretty impossibile to create a keygen because any key run only if the pc in use has this mac. But all i need to protect is the case of cracker disassemble and find boolean or swithc then change value. 😇 In this case the plugin will not prevent possible unauthorized copies

CoreStyler · 16 Oct 2011

Give me 2 cent how to trigger, without boolean values, i a way hard to crack

MichaelBenjamin · 16 Oct 2011

CoreStyler wrote: But i have lost very much when AssiGn releases my HKVST. 🙁

you may have lost a Billion in your fantasy world full of ifs, potentials and vague assumptions, but in reality - you lost nothing.

infuzion · 17 Oct 2011

MichaelBenjamin wrote: CoreStyler wrote: But i have lost very much when AssiGn releases my HKVST. 🙁

you may have lost a Billion in your fantasy world full of ifs, potentials and vague assumptions, but in reality - you lost nothing.

Reality is 90% of the software being used is cracked versions. From Cubase, to

MichaelBenjamin · 17 Oct 2011

infuzion wrote: Reality is 90% of the software being used is cracked versions.

thats not reality - its a vague assumption by you packaged with the loosely term of "being used". how do you define "being used"? how do you know that 90% of software being used by your definition is cracked? did you visit all those people and made a big list? or do you just recycle stuff you read on the internet written by people and companys whose fantasy world doesnt translate to reality?

i hope that vision you expressed with the copyprotected rom nonsense does not happen.

infuzion · 17 Oct 2011

MichaelBenjamin wrote: infuzion wrote: Reality is 90% of the software being used is cracked versions.

thats not reality - its a vague assumption by you packaged with the loosely term of "being used". how do you define "being used"? how do you know that 90% of software being used by your definition is cracked?

I don't have time to dig up the link (might have before here anyhow), but there is a blog by a mid-size iOS app maker. Most of their apps are for 3rd parties, but they decided to brand their own online app-game. They were excited to see many people online using their game server, until they did some math & found only 10% of those who were playing their game actually bought it. So silly stealing a

adamszabo · 17 Oct 2011

infuzion wrote: BTW, doesn't matter if someone stole a piece of fruit from a grocery store & does not intend to eat it. They still stole it.

These physical analogies are not really identical. When someone steals something physical, the store "loses it", and that apple can never be sold to another person again, because the guy who stole it already has it. But with virtual products you can copy an infinite amount, so thats why people who use cracks and warez shit think that the author does not "lose" anything. And trust me, they do. I have been affected by this multiple times, and as soon as something of mine gets on the net, my sales drop drastically. But its just my own statistics, if you are microsoft, no matter if half the world uses cracked windows, they will still be rich. But when you are a small independent person doing this on your free time...its not the case.

CoreStyler · 17 Oct 2011

We are here not only for releasing softwares. we are learning. So, even if it is not the case, i'd like to find these solution for my own satisfaction. 😉

Returning from the OT, you say boolean values are easy to crack. So i thinked... If a cracker would de-assembly the code of the SM plug. It find the boolean value and set the value to true instead of false. So for example. Default value is "false", they turn to "true", so at any plug open the value return to "true". But if i use a ticker, something that trigger verification any X minutes, the value set a "true" return to "false" or maybe cause crash. It is rigth?

If you would like to see a new project in this way, download my String Encryption example... is an easy way for masking files. (had a lot to work on it, is now just an example). http://www.thecorestylerz.net/tools/syn ... ption.html

MichaelBenjamin · 19 Oct 2011

infuzion wrote: there is a blog by a mid-size iOS app maker.

ok, maybe thats true. but the reason is probably not that they didnt copyprotect it well enough. if anything i also want small and mid sized developers being able to survive, but any form of copy protection will not work in the longterm, is not sustainable, is against basic principles of life, unnatural and therefore doomed for extinction.

and im sorry for side topic. keep on burning brain cycles to develop protections like you want to.

CoreStyler · 19 Oct 2011

So.. protection is against the human or nature rule... Why you close the door of your home?

Tzarls · 19 Oct 2011

Not "protection"..... "copy protection".

CoreStyler · 19 Oct 2011

I mean that any if a file is digital, is an object. I use my car for going work.. I use my CD for listening Music... I use my VSTi for producing... Any kind of object has a "to do".. does not matter if is physical or not....

Everything we use, we name or think... is a "for doing".. also a girlfriend 🙂

So, why software is just "copied" and not stolen?

trogluddite · 19 Oct 2011

CoreStyler wrote: So, why software is just "copied" and not stolen?

Because you still have the original one.

The problem can only go away when we can invent a better way to turn 'work' into 'life' (food, shelter, etc.). Since the industrial revolutoin we have had a supply and demand economy, and people have gotten too used to it, e.g....

To replace a stolen car, CD etc. some things must be taken from nature - iron ore for the steel, oil for the plastics, trees for wood/paper etc. Demand is greater than supply, therefore the price is high.

To replace a 'stolen' software, press CTRL-C, CTRL-V,. There is enough supply to meet an infinite demand, therefore the cost is low.

I do not mean that your work has no value ('cost' and 'value' are not the same thing), and it is fair to be compensated for your effort. But we need a new way to make business work that is more modern, the 'industrial era' way of doing is out of date, and software makers will continue to suffer until we find a different sort of economics.

Also people are confused by the really big software companies. Say your software takes 10 hours to make, and you sell it for 10 dollars. If you sell one copy, you are paid 1 dollar per hour. If you sell a million copies, you get paid 100,000 dollars per hour. To a minimum wage factory worker, this seems unfair - he always gets paid the same lousy wage - and the media make out that software developers are all like Bill Gates. Folks are ignorant - they think that software development is a licence to print money. - so we need to make sure they get educated.

tor · 20 Oct 2011

So actually the only real solution for copy protection is to make a embed hardware system ala Receptor and cast the inventory on some material that will destroy all components and data if tried to open for inspection/ industrial spyin.

😉

infuzion · 20 Oct 2011

tor wrote: So actually the only real solution for copy protection is to make a embed hardware system ala Receptor and cast the inventory on some material that will destroy all components and data if tried to open for inspection/ industrial spyin.

You forgot the embedded chip inside the people owning the software. Might seem I'm joking, but I'm not; it will come before we die.