Really interesting read, wonder how many other installs are using (and trapped into continuing to use) such obscure legacy software.
Defeating a 40-year-old copy protection dongle
161–170 of 302 posts
Re: Defeating a 40-year-old copy protection dongle
#162I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years.
The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded.
A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.
Re: Defeating a 40-year-old copy protection dongle
#163Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you wer…
I was wondering this actually, why not just skip past the check entirely instead of going through the effort to pass the check without the dongle?
Re: Defeating a 40-year-old copy protection dongle
#164Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you wer…
Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line.
This works because some programs use a hashing algorithm to calculate the key based on the name, do a strcmp, and pop a messagebox if the keys don't match, without zeroizing the valid key buffer first. If the key buffers are on the stack (or if the two mallocs just happen to use the same region in memory), it is often easy to find a valid key if you know where the invalid one is.
I guess software that derives keys this way is far less common than it once was, but I know of somebody who cracked something using this method just a few years ago, so it still pops up from time to time.
Re: Defeating a 40-year-old copy protection dongle
#165I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Als…
> which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users.…
> I don't condone piracy, but I also don't condone SaaS.
What's wrong with SaaS?
If we didn't sell our desktop software to ~1000 companies as a SaaS then few would afford it. We could sell one-off/perpetual licenses for maybe $1M but only our biggest customers would manage that expense, while smaller competitors would not. And if that means we sold only 300 licenses, then the price would be even higher because the number of licenses sold would be even smaller. The SaaS is basically what the customers ask for. They can cancel and switch to competing software when they want to. In fact, customers who use the software rarely feel the SaaS yearly cost is too high so ask for even more SaaS-y functionality such as paying by minute of use or per specific action like "run simulation", instead of having a yearly subscription. Because they might just use it a few days per year so they feel that (say) $10/yr is too much.
Re: Defeating a 40-year-old copy protection dongle
#166Earlier quoted context omitted.
Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000. In most cases it was not much more difficult than what OP described.
I worked on some software that was used by telcos around that time - you were probably hacking our dongles :)
Even more amazingly - that software I worked in is still being used and sold. Probably still has some of my ropey old code on it…
Re: Defeating a 40-year-old copy protection dongle
#167Earlier quoted context omitted.
If I get ongoing value from my fully paid off car, should I keep paying the OEM? How about my house or my bike or my shoes? My toilet (huge ROI on this one)? My fridge?? Why do we feel that software gets to impose this ridiculous SaaS model? The only real answer is "because they can", not because it's helping anyone. Reality is that many modern software developments have plenty in common with designing a toilet. You…
Seriously, I have a house full of appliances, tools, clothing, and so on, that I get "ongoing value" from and whose manufacturers don't have the gall to try to charge me monthly for. Totally unacceptable business model.
If you were given the choice of buying a fridge for $0 and paying $10/mo for using it, or paying $1k and $0/mo those are both entirely valid pricing models. If you are a homeowner you probably don't want the hassle of managing subscriptions but if you are starting a business where you need fridges but don't have a lot of capital it might be worth looking into. It's basically just financing + service etc.
Re: Defeating a 40-year-old copy protection dongle
#168Earlier quoted context omitted.
There are arrangements where you continue to pay for cars and houses without owning them. They're called leases and rental agreements. They typically cost a lot less for the consumer than outright purchases and at the conclusion of the lease/rental term the consumer is free to return the car/house to its owner without compensation for depreciation or wear & tear (though car leases usually impose mileage restrictions…
Rental cars and houses do exist, but you could still have fully owned cars and houses whose doors lock without paying a subscription. It doesn't have to be the full thing either. Certain tiers could disable only air conditioning for example.
This is happening right now with cars. Regular payments or some features on the car you bought outright stop working.
Mercedes restricts the performance of some cars if you don't pay $1200 a year for the “Acceleration Increase”. You have to pay more if you want to use the power you already paid for.
BMW offer heated seats for £10 a month. The car has heated seats that work fine, and you paid for the hardware already, but they are turned off if you don't pay more.
Neither of these are anything to do with ongoing costs to the company, like support or mobile connection, they just want ongoing revenue.
Re: Defeating a 40-year-old copy protection dongle
#169Earlier quoted context omitted.
If a user gets ongoing value from software it makes sense for them to be willing to pay ongoing for that value. What users need is that the value they get from a product is more than the money they are trading for it. A one off license would be the result of a race to the bottom due to competition.
If I get ongoing value from my fully paid off car, should I keep paying the OEM? How about my house or my bike or my shoes? My toilet (huge ROI on this one)? My fridge?? Why do we feel that software gets to impose this ridiculous SaaS model? The only real answer is "because they can", not because it's helping anyone. Reality is that many modern software developments have plenty in common with designing a toilet. You…
> work out the bugs, ship the final product
This part is left out in modern software development.
Bugs ? What bugs ? We just (re)wrote a new version. This one should be better.
Re: Defeating a 40-year-old copy protection dongle
#170I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Als…
> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liabl…
> I understand you might feel this way, but it seems to me...
I always thought that selling B2B. Then I started checking and it was much worse than I expected. Big corporates were mostly fine but small to medium sized business were pretty bad. Also Asia was much worse than Europe and the US.