28

I am looking a tool for protect and licensing my commercial software, Ideally must provide an SDK compatible with Delphi 7-2010, support AES encryption, Keys generator and capacity to create trial editions of my application.

I am currently evaluating ICE License. Someone has experience with this software?

Gabriel
  • 20,797
  • 27
  • 159
  • 293
RRUZ
  • 134,889
  • 20
  • 356
  • 483
  • 3
    Very useful question so I am nominating for reopening this question. – Gabriel Jan 20 '17 at 16:35
  • As I see things, there is a huge difference between a licensing system and a anti-crack protection system. They COULD work hand in hand but you can have one without the other. A licensing system would help you integrate 'keys' into your program. Something like: the customer purchases a 365days license, the system helps you generate a key that unlocks the program for 365 days. This can be used without any anti-cracking protection (if you are brave enough :) ). – Gabriel Jan 20 '17 at 16:40
  • The anti-crack protection prevents (hopefully) the cracker for altering the licensing system. You can have a super basic licensing system. The most basic I have ever seen was to deliver to the customer a fully functional EXE signed with customer's name. The anti-crack system would prevent the cracker from altering the name of the customer (and with this the resell of your software). Since any software protection can be EASILY cracked, I think investing too much time in this area is a waste of resources. So: Invest in a decent licensing system. When a key is leaked, simply invalidate the key. – Gabriel Jan 20 '17 at 16:45
  • 2
    There is no DESKTOP software (game, OS, graphics app, business app) on this planet that successfully resisted an attack (this does not stand true for web apps). The reason is super simple: the cracker has access to the protection code. There is nothing in this world that prevents the cracker for modifying the protection code in whatever way he desires. If the cracker wants to make pink hearts out of it, it can. All you need is some ASM knowledge and a dissembler. Period. – Gabriel Jan 20 '17 at 16:54
  • Take a look at this. It is only a licensing system. To protect your EXE you need some extra solution on top of it: http://www.visualbioinformatics.com/Delphi%20VCL%20licensing%20system.html – Gabriel Apr 06 '18 at 11:49

11 Answers11

18

Here's my list of software protection solutions. I'm looking at switching from ASProtect to another protection so I'm also in the process of analyzing most of these programs:

Themida (Oreans) http://www.oreans.com/products.php There are unpacking tutorials for all the versions of Themida. There is however the possibility of requesting "custom" builds which might help avoid this.

Code Virtualizer (Oreans) http://www.oreans.com/products.php Allows to protect specific parts of the application with a Virtual Machine. A cracker on a forum said he "made a CodeUnvirtualizer to fully convert Virtual Opcodes to Assembler Language".

EXECryptor Very difficult to unpack. GUI does not work under Vista. Appears to no longer be developed.

ASProtect Small protection overhead. Appears to no longer be developed.

TTProtect - $179 / $259 13 MB download. Chinese developer. Adds about xxx overhead to the exe. http://www.ttprotect.com/en/index.htm

VMProtect - $159 / $319 (now $199/$399) http://www.vmprotect.ru/ 10 MB download. Russian developer. Seems to be updated frequently. Supports 32 and 64-bit. Uncrackable according with one exetools post, but there seems to be an unpacking tutorial already.

Enigma Protect - $149 http://enigmaprotector.com/en/home.html 7 MB download. Russian developer. Regarded as very difficult to crack. Adds about xxx overhead to the exe.

NoobyProtect - $289 http://www.safengine.com/ 10.5 MB download. Chinese developer. Regarded as very difficult to crack. Adds about 1.5 MB overhead to the exe.

ZProtect - $179 http://www.peguard.com

RLPack http://www.reversinglabs.com/products/RLPack.php KeyGen already available.

One thing to note is that the more protection options you enable on the software protector, the bigger the possibility of the protected file being flagged by an anti-virus as a false-positive. For example, on Themida, checking the option to encrypt the file, will most likely create a few false-positives by a few anti-virus programs. I'll update this answer once I get more replies from a hackers forum where I asked some questions about these tools.

And finally, don't use the build-in serial number/license management of these tools. Although they might be more secure than using your own, you will be tied up to that specific tool. If you decide to change software protection in the future, you will also have to manage all the customer keys transfer to a new system.

Uli Gerhardt
  • 13,748
  • 1
  • 45
  • 83
smartins
  • 3,808
  • 7
  • 42
  • 54
  • Hello, which one did you choose, are you satisfied with it and still in business? – Tom Oct 11 '22 at 04:13
12

Don't bother. It's not worth the hassle. Only a perfect licensing system would actually do you any good, and there's no such thing. And in the age of the Internet, if your system isn't perfect, all it takes is for one person anywhere in the world to produce a crack and upload it somewhere, and anyone who wants a free copy of your program can get it. (And using a pre-existing library just gives them a head start on cracking it.)

If you want people to pay for your software instead of just downloading it, the one and only way to do so is to make your software good enough that people are willing to pay money for it. Anyone who tells you otherwise is lying.

Mason Wheeler
  • 82,511
  • 50
  • 270
  • 477
  • 3
    That last sentence is a little strongly worded. Perhaps they're mistaken? – Argalatyr Feb 18 '10 at 21:59
  • 1
    I disagree, Mason - it depends on the audience. Technical people may download, but they may not be the users of this app. And in any case, I don't think providing a bit of a barrier hurts - if the protection level is right, it may be easier or quicker for people to pay than to find a broken copy, and at that point you've won. – David Feb 18 '10 at 23:03
  • 8
    I also disagree. Simple protection is needed to keep honest people honest. They will not look for cracks. They'll pay for good software if its worth the price. You're goal is to make it that good. And those who take the time to break a simply protected system would not have paid for it anyway. – lkessler Feb 19 '10 at 02:58
  • 6
    @Ikessler: Your argument contradicts itself. If a person's honest and won't look for cracks, then they don't need protection schemes to keep them honest. There is no such thing as "keeping honest people honest." Either a person's honest or they aren't. The only people who I've ever heard use that term with a straight face are the ones selling locks, or their digital equivalent. – Mason Wheeler Feb 19 '10 at 04:04
  • 2
    I dont think this is an answer. Whether people want or can protect the software is out of the scope of the question. What skamradt wanted to know is what mechanisms already existed, not if they were effective or even flawless. – dabito Dec 31 '10 at 21:03
  • Of course it is worth the hassle. Otherwise all software would be free with a donate button. A crack can't be uploaded to a legitimate site and paying a reasonable price is preferable to running the risk of what you could get from an illegal site. – Paul McCarthy Jun 07 '20 at 14:23
11

I have used OnGuard (using the Delphi 2009/2010 source from SongBeamer) along with Lockbox to handle encryption with success. Both are commercial quality libraries and are free to use with full source.

I did once also use IceLicense, but switched to OnGuard/Lockbox which allowed me greater control over the key generation process which we embedded directly into our CRM system.

skamradt
  • 15,366
  • 2
  • 36
  • 53
3

Of course there is no %100 bullet-proof protection suite, but having some type of protection is better than having nothing.

I worked with WinLicense in Delphi 2009 and Delphi 2010 on Windows XP and Vista. It is a good product with lots of protection options, and customizations. It provides a SDK for developers, and has nice documentation and samples. It also provides a license manager for you. They provide trial download too.

As far as I remember, they offer some customer specific versions too; that means they are willing to provide a custom-built product which is customized according to your needs, but of course that will cost more.

Since WinLicense is a well-known and popular protection suit, many crackers are after it. As you know, the more famous a tool is, the more appealing it is to crackers. But the good thing about Oreans is that they actively monitor underground forums, and provide frequent updates to their products.

So IMHO, if you are supposed to buy a prebuilt protection suite, then you'd better go for WinLicense.

vcldeveloper
  • 7,399
  • 2
  • 33
  • 39
  • 2
    There is no DESKTOP software (game, OS, graphics app, business app) on this planet that successfully resisted an attack (this does not stand true for web apps). The reason is super simple: the cracker has access to the protection code. There is nothing in this world that prevents the cracker for modifying the protection code in whatever way he desires. If the cracker wants to make pink hearts out of it, it can. All you need is some ASM knowledge and a dissembler. Period. – Gabriel Jan 20 '17 at 16:54
  • Wow, you make it sound so simple. I have some ASM knowledge and a dis-assembler and I've never cracked anything. A decent application will have over a million lines of high level language code so that's multiple millions of ASM. Good luck finding the code you need to change :-) – Paul McCarthy Jun 07 '20 at 14:32
3

A little late to the post, but check out Marx Software Security (http://www.cryptotech.com) they have a USB device with RSA & AES on chip, with network based license management.

Tom
  • 31
  • 1
2

I bought a license for ICE License in 2007. Unfortunatly (as far as I know) the component haven't been updated since June 2007. Back then a Vista compatible version was in the work but never came out of beta. I don't think they updated the component for Delphi 2009 and 2010 yet.

Ionworx is an one man company which might explain the lack of updates and lack of answer to support questions (emailed them 2-3 times since 2007 and never got back to me). They also removed their support forum from their site.

ICE License is better than nothing but I would stay away from this product because the lack of updates & support.

AlexV
  • 22,658
  • 18
  • 85
  • 122
2

I investigated this a few years ago, and came to the following conclusions:

  • All copy protection can be broken
  • Nag screens on load irritate people to the point where they may stop using the product
  • Random nag screens can interrupt the users work flow to the point where they perceive it to be a reduction in the speed of the application

Set up compiler options, so that you have a version as a demo (perhaps with save functions removed), reduce multi user versions so that only one client can connect at a time (not using, for ex:

if connection=1 then reject

but reducing the viability for multiple connections in code)

Mark Robinson
  • 943
  • 9
  • 26
1

Themida has good protection, and I think it built with Delphi too ;-)

if you have a better budget, you can look at winLicense and other tools from same company.

Mohammed Nasman
  • 10,992
  • 7
  • 43
  • 68
0

AppProtect wraps an EXE or APP file with computer unique password or Serial Number based online activation. QuickLicense is a more comprehensive tool that support all license types (trial, product, subscription, floating, etc.) and support both a wrapping approach or API to apply the license to any kind of software. Both are available from Excel Software at www.excelsoftware.com.

Harold
  • 1
0

Have a look at this question which is pretty similar, and includes many of the tools.

Community
  • 1
  • 1
mj2008
  • 6,647
  • 2
  • 38
  • 56
0

Take a look at InstallShield. We've been using it for a while ourselves, and it has a lot of capabilities for trial support, licensing, and others. I don't know about key generation off the top of my head as our use doesn't require keys, but there's a lot available to you from them.

Tom A
  • 1,662
  • 2
  • 23
  • 41