Defeating a 40-year-old copy protection dongle • Hacker News Board

Re: Defeating a 40-year-old copy protection dongle

#171

Post by hdjrudni » Mon, Feb 02, 2026, 9:36 AM UTC

xp84 wrote: post #154

dataflow wrote: post #35

Earlier quoted context omitted.

> from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade. Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?

Honestly, if they never need anything more from the developer, a perpetual license and never spending another dime seems fine. However, in modern times, OS vendors (especially one named after fruit) tend to break a ton of APIs and change rules with every "major release," meaning developers have to invest a ton of effort to at minimum meet all those new requirements every year (!) or else the app will at best look out…

Right, but then you're providing tangible value to the customer and thus it's warranted to charge again.

The fairest thing to do is when a customer buys the software, they're entitled to that exact version forever. Or maybe 1 year of updates and bug fixes if you're feeling nice. If they want the next version that supports the next OS, it's fair to charge some more.

This what IntelliJ does. When I buy their IDE I can use it forever, and then they offer discounts for renewing. Pricing seems reasonable even though I'm currently generating $0 from my software development so I keep paying.

Re: Defeating a 40-year-old copy protection dongle

#172

Post by potatomaseat9 » Mon, Feb 02, 2026, 9:42 AM UTC

Its insane this things still works after 40 year old and someone now able to cracked it down

Re: Defeating a 40-year-old copy protection dongle

#173

Post by alibarber » Mon, Feb 02, 2026, 9:42 AM UTC

thenthenthen wrote: post #119

As a hardware guy I would first start with opening up the dongle, but hey! Still very curious to see whats inside!

Yes my first thought would be to probe the parallel lines and see what went in and came out, but this approach was just as interesting!

Re: Defeating a 40-year-old copy protection dongle

#174

Post by 71bw » Mon, Feb 02, 2026, 9:49 AM UTC

unnouinceput wrote: post #118

sedatk wrote: post #108

Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.

Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do…

>Also to this day there is no crack to Diablo 3

Look into Blizzless :-)

Re: Defeating a 40-year-old copy protection dongle

#175

Post by alias_neo » Mon, Feb 02, 2026, 9:50 AM UTC

miki123211 wrote: post #164

ruleryak wrote: post #7

Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you wer…

Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line. This works because s…

When I was a child, in the 90s, I did this all of the time.

Input a unique string I could watch for, fire up SoftICE, watch for the string, and then step through until the == comparison happened, then either grab the calculated key and input it, or patch the comparison from == to != or just return true, depending on the implementation.

Re: Defeating a 40-year-old copy protection dongle

#176

Post by quietbritishjim » Mon, Feb 02, 2026, 9:53 AM UTC

b1temy wrote: post #81

nsoonhui wrote: post #27

I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Als…

> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liabl…

> who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves

They often need to "purchase" the license themselves in the sense of convincing someone higher up to buy it - so they're spending their time, which is still a sort of expense.

Also, piracy in companies is often just honest people who are in a bit of a hurry and need this software running on some other PC right now, or just want their colleague to give it a quick go (but then they end up using it all the time). Copy protection helps keep those honest people honest.

Re: Defeating a 40-year-old copy protection dongle

#177

Post by cricalix » Mon, Feb 02, 2026, 10:19 AM UTC

u1hcw9nx wrote: post #148

3uruiueijjj wrote: post #146

USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so. In our case, the copy protection would still be as easy to bypass as the one in the article.

You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't. Actual dongles with encryption and processor cost only $15 in batches of 100.

UnRaid does a variant of this; license is tied to the serial of the USB drive. It barely writes to the drive, so wear isn't meant to be much of an issue.

Re: Defeating a 40-year-old copy protection dongle

#178

Post by haspok » Mon, Feb 02, 2026, 10:33 AM UTC

nsoonhui wrote: post #47

dataflow wrote: post #35

Earlier quoted context omitted.

> from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade. Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?

Because 1. Physical dongle tends to break, and when it does, they expect us to give them replacing parts 2. They do expect bug fixes-- especially calculation bug fixes-- as the bugs are discovered. It's hard to leave their production critical apps broken like that once you know that the bugs can cause monetary or even life loss.

> They do expect bug fixes-- especially calculation bug fixes-- as the bugs are discovered.

Maybe I'm the weird one to expect reasonably bug-free software, and if a bug is found, an eventual bugfix "for free"? ESPECIALLY if they cause monetary or life loss!

A bug means the developer did not do their job. Let's not pretend this is OK.

Re: Defeating a 40-year-old copy protection dongle

#179

Post by yesturi » Mon, Feb 02, 2026, 10:35 AM UTC

It is interesting that the vendor adapts the hardware token and then makes it weak on the software side.

I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all.

[0] https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/

Re: Defeating a 40-year-old copy protection dongle

#180

Post by yesturi » Mon, Feb 02, 2026, 10:38 AM UTC

odomus wrote: post #55

Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?

BTW, in the European Union, reverse-engineering is perfectly legal, if it is done to ensure compatibility with the current tech.

I cannot cite the reliable sources for it, though.