How To Protect Your Application Against a Keygen

How To Protect Your Application Against a Keygen

How to protect your application against a keygen
http://www.newlc.com/article.php3?id_article=606

Tutorial posted November 19th, 2004 by eric
in
    • Security
This first article introduces a basic protection scheme based on IMSI or IMEI and how a cracker can defeat it.

Identifying a device

A mobile phone is typically identified by two unique numbers:
[pic]  the IMEI, short for International Mobile Equipment Identity, which represents the device hardware itself. This number and its format is described in Retrieving the device IMEI code.
[pic]  the IMSI, International Mobile Subscriber Identity which represents your subscription. The number contains two parts: the first identifies the GSM network operator with whom the subscriber has an account. The second part of the number is allocated by the network operator to identify uniquely the subscriber.
When registering your application, you can use one of these two codes - or a combination of both - to generate an lock/unlock code for your application. :
[pic]  if you choose the IMEI, you bound the application to the device: the user will only be able to run the application on its current phone. He can change and move to another operator without problem but if he has a new phone, he will have to buy a new license.
[pic]  if you choose the IMSI, you bound the application to the user. He can install the application on several devices but only the device he is currently using (i.e. which contains the proper SIM card) will be able to run it. This is useful when - like me - you have a single subscription but several devices.
[pic]  you can be a lot more restrictive and use a combination of both and then lock your application on the IMSI and the IMEI.
[pic]  you may also generate your own unique code based on other number (server generated, time based, etc....).
Note that, while there are some APIs to retrieve the IMEI on all Symbian OS phone (check Retrieving the device IMEI code), this is not always true...