Note that there are some explanatory texts on larger screens.

plurals
  1. PODisable application after expiry date for trial
    primarykey
    data
    text
    <p>I am writing a simple application for a semi-trusted client, and have no say on certain specifics. The client must be given a copy of a binary, <code>myTestApp</code>, which makes use of proprietary code in an external library, <code>libsecrets</code>. It is a Windows application that will run on a few separate Windows 7 laptops. I have been informed that after the application has served its purpose, it will be deleted. I know there is no perfect solution to this, but I would like to implement an expiry date in the program, and hinder efforts to potentially reverse engineer the code, or at least to prevent the contents of <code>libsecrets</code> from being exposed too easily.</p> <p>So, my first step will be to statically link <code>myTestApp</code> against <code>libsecrets</code> so everything is contained in one binary, so only the needed pieces of <code>libsecrets</code> is included in the final binary, and its interfaces are no longer published.</p> <p>Second, I want to implement some sort of <code>getTime</code> mechanism that is not naive. Is there anything in Windows that does a "secure" <code>getTime</code> call, so it can't be tricked by changing the time in the system tray or the BIOS?</p> <p>Thirdly, if there is no "secure" <code>getTime</code> call, I could also modify <code>myTestApp</code> to use NTP to query a trusted time server, and fail if it can't get the time from it or the trial period has elapsed. But this could be fooled by messing with DNS on the gateway, unless there is some sort of certificates mechanism in place to verify the time server. I don't know much about this though, and would need some suggestions on how to implement it.</p> <p>Next, is there some way to alter the binary so that it is impractical for individuals to attempt to reverse engineer it by viewing the assembly code? Maybe some sort of wrapper that encrypts the binary and requires a third-party authentication tool? Or maybe some sort of certificate I create that is required to run it and expires later?</p> <p>Finally, is there any software out there (ie: packaging or publishing software) that can do this for me, either by repacking the final <code>.exe</code> or as some sort of plugin for Microsoft Visual Studio?</p> <p>Thank you all in advance.</p> <hr> <p>Edit: This is NOT meant to be a bullet proof system, and if it fails, that is acceptable. I just want to make it inconvenient for a non-technical person to attempt to crack. The people using it are technical Luddites, and the only way the software would be cracked is if they hired someone to do it. Since the names and company name are watermarked into the application, and only one person could benefit from its use, it's unlikely they would redistribute it.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload