ToringoDRMInfo to get Machine ID

General
1

Hi. I recently purchased the ToringoDRMInfo plugin in an event to add to the security of my desktop apps. Targeting Windows and Mac. My hopes with using this was to have the MachineID and PrimaryMACaddress saved to a table upon initial product registration. Each time the software opens up, it calls the following to get the MachID and PrimaryMACaddress, and then it compares the values to the values stored in the db table

dim strMacID as String = ToringoDRMInfo.GetMachineID dim strMacAdd as String = ToringoDRMInfo.GetPrimaryMACAddress

If the values do not match (meaning a pirate was savvy enough to think to copy another user’s registration database into the same folder on their computer, so it looked like their pirated program was registered), it would wipe out the registration db, so they would be asked to register the software.

I implemented this about 2 weeks ago, and have already had about 5 users’ programs improperly deactivated (db wiped). I built in a method to safeguard this, but I’m afraid the method is not working as expected.

What I need is a unique computer identifier that does not change. I was happy to have found Toringo and after reading the users manual, it seemed that the MachineID and PrimaryMACaddress do not change unless the computer’s hard drive is replaced. I find it hard to believe that in just two weeks that 5 users have had hard drives replaced, so I’m not sure why these values would change.

In the past, I’ve used the System.GetNetworkInterface(0).MACAddress, but it appears that if the user is not connected to the internet, this results as an empty string, and also I found out that this value seems to change on occasion and is not consistent.

I also just found this snippet below from another post. Is this a more surefire method that will not change (unless HD replaced of course) regardless of internet connection, whether a flash drive is inserted, or any other possible scenario?

Volume(0).CreationDate.TotalSeconds

I know software piracy is going to happen if someone really wants it to. I’m just trying to make it a bit more difficult for the novice tech savvy person to easily use the program without purchasing. Plus, my software is quite highly priced, and if one person discovers they can bypass the registration process, I’d be looking at potentially losing thousands of dollars.

TIA
Ryan

2

MAC address can be changed via tons of 3rd party tools… so it should never be thought of as “static”
HardDisk serial numbers will change if a HDD fails and is replaced
Motherboard serial # change, or may not exist (Apple Tech is notorious for not resetting these during repairs)

My question is… what did those 5 users do? or was it a flaw in your process?

3

[quote=339782:@Dave S]MAC address can be changed via tons of 3rd party tools… so it should never be thought of as “static”
HardDisk serial numbers will change if a HDD fails and is replaced
Motherboard serial # change, or may not exist (Apple Tech is notorious for not resetting these during repairs)

My question is… what did those 5 users do? or was it a flaw in your process?[/quote]

there are many ways to change MAC address on most platforms. I change my MAC address all the time for work.

HD serial numbers will be changed everytime you change the HD out. For spinning media (spinning drives aka not SSDs) that will be done on average every 2 years. SSDs are running about every 4. These are averages. I last less than 1 year and 3 years respectfully. Plus if the system is virtualized, the HD serial number is randomized. And can change frequently.

4

Thanks for replying Dave. This is helpful.

Surprisingly, when I spoke with two of the users, the one mentioned a terrible storm blew through and knocked out power. The other said something similar - there was a small power outage. I didn’t ask the other 3. These came in before the 2 I spoke with, but I’d wonder if something similar happened to them. Another similarity I can share is that each of these users were on Windows. To date, no Mac issues

Since I implemented, I’ve had probably 50 or more users either update to this version or purchase a new license, so these 5 would represent about 10%.

#1 What are your thoughts on the Volume(0).CreationDate.TotalSeconds method for trying to accomplish?
#2 Knowing my intention for some identifier, do you have a better suggestion? Do you think HD serial number is better?

Again, this method (identifier saved to db needs to match the computer’s ID) is one of several I have implemented in the program.

5

Thanks Scott. I read about the virtual machine in the Toringo manual, and I don’t see that as a problem with my users.

My targets are collage age nutrition students. Many of them know only the basics of using a computer. I cannot see them manually changing a MACaddress unless another program is doing that without them knowing

6

We had one client use MAC addresses for several years and they finally got rid of it. The problem was that every time the user switched between ethernet and WiFi, or from WiFi to phone tethering, the MAC address changed. It was so unreliable that they decided to do something different. The Macintosh will give you a processor serial number which is pretty reliable but on Windows it’s tough to find something that doesn’t change.

7

IF you use this on Linux you’ll have a lot of problems
CreationsDate literally may not exist and so it may appear to change on every reboot
Mac OS and Windows behave more consistently in this regard

On OS X you can get a hardware UUID in one of several ways which isn’t dependent on the MAC address
Quick & dirty is to run a shell command like

    system_profiler  | grep "Hardware UUID"

I’m sure there are piles of others (like https://forum.xojo.com/18029-native-uuid-generation, https://forum.xojo.com/10597-uuidmbs-how-to-always-get-the-same-uuid)

I’m sure Windows has something similar

See the update at the end of

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

which is generated uniquely during the installation of Windows and it won’t change regardless of any hardware swap (apart from replacing the boot-able hard drive where the OS are installed on).

8

On Windows, you may be able to get a lot of processor information with the Win32_Processor class. I have not used it myself with Xojo, so I can,t say for sure that it is directly usable, but someone could probably make a C++ plugin if we cannot use it directly with Xojo. This is a class, not the usual declare.

edit: I finally found my old VB6 code to call Win32_Processor. At first glance, it should be easy to port to Xojo.

Motherboard info:

[code]Private Function SystemSerialNumber() As String
Dim mother_boards As Variant
Dim board As Variant
Dim wmi As Variant
Dim serial_numbers As String

' Get the Windows Management Instrumentation object.
Set wmi = GetObject("WinMgmts:")

' Get the "base boards" (mother boards).
Set mother_boards = wmi.InstancesOf("Win32_BaseBoard")
For Each board In mother_boards
    serial_numbers = serial_numbers & ", " &  board.SerialNumber
Next board
If Len(serial_numbers) > 0 Then 
     serial_numbers =  Mid$(serial_numbers, 3)
end if

SystemSerialNumber = serial_numbers

End Function[/code]

CPU:

[code]Private Function CpuId() As String
Dim computer As String
Dim wmi As Variant
Dim processors As Variant
Dim cpu As Variant
Dim cpu_ids As String

computer = "."
Set wmi = GetObject("winmgmts: {impersonationLevel=impersonate}!\\\" & computer & "\\root\\cimv2")
Set processors = wmi.ExecQuery("Select * from Win32_Processor")

For Each cpu In processors
    cpu_ids = cpu_ids & ", " & cpu.ProcessorId
Next cpu
If Len(cpu_ids) > 0 Then 
    cpu_ids = Mid$(cpu_ids, 3)
end if

CpuId = cpu_ids

End Function[/code]

9

Bob - Yes, with my findings recently on the MACaddress constantly changing, I’ve decided to move past using this as an identifier, hence my search into Toringo.

And that’s what I am finding with Windows too :-/

[quote=339794:@Norman Palardy]IF you use this on Linux you’ll have a lot of problems
CreationsDate literally may not exist and so it may appear to change on every reboot
Mac OS and Windows behave more consistently in this regard[/quote]
At this time, I’m only supporting Windows and Mac, so this issue with Linux wouldn’t come into play for me.

10

looking at the toringo web site, it appears they are using “real studio” and nowhere “xojo”
at the bottom, the © is 2012 …
so may be their software is not as up to date as it should be ?

11

I appreciate the responses all! If anyone else has any suggestions, I’d love to hear.

I just had a thought on the Volume(0).CreationDate.TotalSeconds method. Doesn’t this calculate the total seconds from the creation date to this very moment? So, if I registered the program today, and (for simplicity purposes) the creation date total seconds was something like 90000. Then I close it out and come back in one minute later, wouldn’t the value be 90060? Or is it that the creation date seconds are a much larger number that this would not even be noticed? For example, on my computer, it shows as “3.55849e+9”. What if I came back into the program a year later or two or three years later. Would this value be different?

12

No
Its the creation date in total seconds for that date
The base date and the date the volume was created on aren’t changing relative to each other

13

[quote=339808:@Norman Palardy]No
Its the creation date in total seconds for that date
The base date and the date the volume was created on aren’t changing relative to each other[/quote]
Oh I think I get it. It calculates to the date it was created, not from that date to today. Thanks Norman! And there will be no impact on whether the computer is connected to the internet, WiFi, a flash drive is inserted, etc, right? So this value should be consistent and maybe change only if the HD was replaced?

I think I’m going to give this a try with some testing. In the next update, I’ll have the program send me an email if the creation date seconds in the db table does not match that on the user’s computer. Have this run for a few weeks until I feel comfortable it will work appropriately, then try to implement it.

Thanks all!

14

[quote=339809:@Ryan Hartz]Oh I think I get it. It calculates to the date it was created, not from that date to today. Thanks Norman!
[/quote]
Yes
Totalseconds is from the base date not to today

[quote=339809:@Ryan Hartz]And there will be no impact on whether the computer is connected to the internet, WiFi, a flash drive is inserted, etc, right?
[/quote]
I would not expect it to
EXCEPT in the case a person restarts their computer from a different start up disk and then Volume(0).creation date would be different
The Mac Hardware UUID (which I noted above) remains the same AFAICT since its not dependent on the start up disk
I think the Windows one would change based on their notes about replacing the HD

Or they start from a different HD for some reason :stuck_out_tongue:

I will say that trying to use “the same mechanism” cross platform doesn’t always pan out because how people actually use their machines is different x-platform
We found this out the hard way on linux where old code did try to use the volume creation date to identify a machine - which doesn’t work - and fails spectacularly on certain file systems
And on OS X because people do restart from different boot drives (I do it all the time to test the IDE) we cant use the creation date to identify a machine there
Windows is about the only one where this is “stable” because restarting from a different boot drive on the same machine doesn’t seem to be that common
If it were then creation date would also be an issue there and a different means to ID the machine would have to be used

15

Thanks for the insight Norman! We’ll see where this next round of testing takes me