Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Defeating a 40-year-old copy protection dongle

dmitrybrant.com

Post reply on HN
Print view View original

141–150 of 302 posts

Re: Defeating a 40-year-old copy protection dongle

#141

Post by charcircuit »

direwolf20 wrote: post #139
charcircuit wrote: post #116

Earlier quoted context omitted.

No, since that food no longer exists. There's nothing the food creator can do. They can't cause it to spoil after you ate it. The massive benefit of not dying allows the price ceiling of food to be very high. But within society there is a lot of competition for nutrients which prevents food from reaching such heights.

So when I buy a CD, I can install the software, and then grind the CD into powder, and since what I bought no longer exists, I can stop paying?

Well the software could disable itself when you stop paying. You stop paying for the value, the software stops providing you value.

Re: Defeating a 40-year-old copy protection dongle

#142

Post by alexfoo »

bri3d wrote: post #10
catlikesshrimp wrote: post #9

Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey. I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars. The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!

Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly. I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since…

> I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion ...

Starting in '97 I worked on some software that used Elan License Manager (elmd) that then moved on to FlexLM in a major release.

Requests for, and problems with, licensing were a considerable source of support tickets but I'm sure it also drove a reasonable amount of sales as customers wanted to play with component X but were prevented from doing so by a lack of license.

When we were acquired by IBM we replaced the licensing code with lawyers and (threats of) audits. It didn't seem to harm the revenue. The product is still being maintained and sold.

> ... if you could reverse one you could reverse the other.

I can confirm it was quite easy with gdb to either skip past the license checks or, in the case of Elan licensing at least, call the license generation function from within the binary to generate whatever licenses for whatever features you liked.

The "hardware identifiers" were a nightmare too. I ended up writing some code that would pull all of the necessary information (primary MAC, IP address, hostid for Sparc machines, hostname, etc) and give it to us in a base64 encoded blob, we also grabbed some CPU and memory information that proved quite useful in seeing how the software was deployed.

Re: Defeating a 40-year-old copy protection dongle

#143

Post by giamma »

This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version.

So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation.

[0] https://en.wikipedia.org/wiki/Executable_compression

Re: Defeating a 40-year-old copy protection dongle

#144

Post by samplatt »

IshKebab wrote: post #135
Plasmoid wrote: post #87

Earlier quoted context omitted.

Even at a simple level, if it's between spending weeks going through purchasing or not asking too many questions and getting on with it. I can see a lot of people choosing option B.

Yeah case in point - how many people actually pay for Visual Studio? You're supposed to if you're using it for commercial purposes but I don't think I've ever seen a commercial license used (though I don't do a lot of Windows work tbf).

VS is actually one of the cheaper tools in our stack; Unity (the game engine) is probably the most expensive one at the moment, and it's going to get much more so with their recent changes to licensing structure for embedded hardware.

Re: Defeating a 40-year-old copy protection dongle

#145

Post by urbandw311er »

userbinator wrote: post #124
gnabgib wrote: post #103

Earlier quoted context omitted.

Do you mean 20th? Even current looms, steam engines, stills aren't from the 18 hundreds

No, I do mean the late 1800s. Operations processing "low level" materials like agricultural, steel, and mining.

There are an awful lot of pieces of hardware around still using atoms from when the Big Bang detonated.

Re: Defeating a 40-year-old copy protection dongle

#146

Post by 3uruiueijjj »

USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so.

In our case, the copy protection would still be as easy to bypass as the one in the article.

Re: Defeating a 40-year-old copy protection dongle

#147

Post by urbandw311er »

bitwize wrote: post #111

This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.

…and?

Re: Defeating a 40-year-old copy protection dongle

#148

Post by u1hcw9nx »

3uruiueijjj wrote: post #146

USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so. In our case, the copy protection would still be as easy to bypass as the one in the article.

You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't.

Actual dongles with encryption and processor cost only $15 in batches of 100.

Re: Defeating a 40-year-old copy protection dongle

#149

Post by hulitu »

nsoonhui wrote: post #27

I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Als…

> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation.

Sometimes, there are network interuptions. Then it is the right time to work because youtube isn't available.

Re: Defeating a 40-year-old copy protection dongle

#150

Post by anilakar »

ruleryak wrote: post #7

Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you wer…

A certain automation system vendor uses proper USB license dongles in their PC software but they do not do challenge-response authentication. Instead they send a hardcoded string to the dongle and compare the response against a list that contains various software feature levels.

The whole automation system including machinery costs anywhere from 200k to 1M yet Vendor™ tries to milk the customers dry with a 1.5k software license that lets you manage up to 254 physically* connected systems. I'm pretty sure the license dongle is in reality designed to prevent casual tinkering of parameters, which is something only service techs should do.

*You can circumvent this with serial-over-Ethernet converters, which has resulted in an Industrial Internet of Shit-level security nightmare as companies happily expose their systems over the internet, thinking that license dongles are a substitute for authentication.

Post reply on HN