Defeating a 40-year-old copy protection dongle • Hacker News Board

Re: Defeating a 40-year-old copy protection dongle

#201

Post by analog31 » Mon, Feb 02, 2026, 1:08 PM UTC

nsoonhui wrote: post #27

I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Als…

I use one engineering app that has a "soft" license. It has a lot of failure modes, all of which are essentially administrative not technological. A fair number of departments have to work together: IT, purchasing, and accounts payable (in case the company is on credit hold for non-payment of a previous license renewal) across multiple corporate divisions. It can eat up a few days of my life, and sometimes I lose access to the software for a few days.

The IT department restructures the license server or it goes down.

The vendor changes their license technology every few years.

If you have a physical dongle, the vendor will beg you to send it in and receive a soft license. The few remaining users with dongles refuse. The hardware is more reliable.

Re: Defeating a 40-year-old copy protection dongle

#202

Post by compsciphd » Mon, Feb 02, 2026, 1:11 PM UTC

notpushkin wrote: post #185

giamma wrote: post #143

This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version. So I first decompressed the executable program (Windows executable were often pa…

My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.

back in the mid to late 90s, I got a trial for compuserve that was a free 2 month trial. I liked it as as they provided dialup PPP access so was able to use it as full time internet access. It wasn't quite "2 months" of access though. It was 1500 hours of access (which in practice > 24*62).

However, their usage accounting software wasn't great. I had it setup to reconnect if the connection dropped, and they didn't do a great job seeing this, so they accused me of using 2-3k hours during those 2 months (should be impossible if always coming from the same #) and sent me a large bill (for the hours used over 1500). They eventually gave in when I showed them it was impossible and they could validate that the calls were coming from the same line due to the connection dropping and being simple reconnections.

Re: Defeating a 40-year-old copy protection dongle

#203

Post by compsciphd » Mon, Feb 02, 2026, 1:14 PM UTC

miki123211 wrote: post #164

ruleryak wrote: post #7

Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you wer…

Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line. This works because s…

mellanox switches included an executable keygen in their firmware bundle. It could be used to both generate a key (given feature set) combined with a secret, but could also be used to validate what features a given key gave you (using the secret). Hence, the secret was stored in the binary and was easily visible with strings and one could then just use the tool itself to generate keys.

Re: Defeating a 40-year-old copy protection dongle

#204

Post by anymouse123456 » Mon, Feb 02, 2026, 1:26 PM UTC

markh1967 wrote: post #137

ruleryak wrote: post #7

Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you wer…

Many years ago I was a technician supporting a few custom programs on thousands of PCs. The developer of one of these programs had added a date check to his code so the program would refuse to run after a set date and each new release would increase this date by a few months so it would stop working after a few weeks if he ever stopped creating new releases. His contract ended and a few weeks later his software, now…

If you think it's bad now, the early days of the web were absolutely filled with scumbag grifters who made small fortunes hiring contractors and then refusing to pay.

Many of them disappeared in the y2k dot com bust, but then seem to have reappeared in SF after 2008.

In the late 1990's, my second ever Flash app development client stiffed me on a $10k invoice.

He finally figured out 6 months later that he didn't have the source material to make changes and paid the full invoice in order to get it.

So I took precautions with the next client. It was a small agency that was serving a much larger business.

We were on 30 days net payment terms and I submitted the invoice when the project was done.

They didn't pay and within a couple weeks of gentle reminders, they stopped responding.

I smiled.

Exactly 30 days from the due date, I got a panicked call shrieking about their largest client website being down and did I have anything to do with it?!

I asked them what the hell they were talking about, they don't own a website. They never paid for any websites. I happen to own a website and I would be happy to give them access to it if they want to submit a payment.

They started to threaten legal nonsense, and how they had a "no time bombs clause in the contract."

I laughed because my contract had no such clause. If they signed such a contract with the client, that's not my problem.

I told them I wouldn't release the source files until the check cleared my bank, which could be weeks. A cashier's check arrived that morning and their source files were delivered.

By the end of it, the folks at the agency thanked me because that client wasn't planning to pay them and they hired me for other work (which, they had to prepay for).

Of course I don't know about the OP, but I'd bet the company was trying to stiff that contractor on their last check.

Re: Defeating a 40-year-old copy protection dongle

#205

Post by acdha » Mon, Feb 02, 2026, 1:39 PM UTC

b1temy wrote: post #81

nsoonhui wrote: post #27

I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Als…

> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liabl…

> it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability

Trust the people whose paychecks depend on it, it was extremely common. I knew multiple people at different companies who had endless stories about customers buying a couple of copies for a large department to “share”, and they expected the vendor to support everything because it was “business critical”. This was also a problem for things like student licenses where people would expect enterprise-level support despite the massively-discounted copy they had clearly stating it was only for educational usage.

This has a lot of negative aspects for preservation, downtime due to issues with licensing, challenges around virtualization or hardware replacement, etc. so I don’t love the situation we ended up in but it’s entirely understandable given how pervasive theft was – there were a ton of small businesses which ran entirely on bootlegged software. Software developers have high leverage but if you aren’t in a mainstream market you’re not going to get over the threshold where you’re no longer worried about making payroll.

Re: Defeating a 40-year-old copy protection dongle

#206

Post by bruce511 » Mon, Feb 02, 2026, 1:40 PM UTC

darkwater wrote: post #196

bruce511 wrote: post #99

Earlier quoted context omitted.

This sounds good, but in the real world it leads to massively upset customers. The problem exists from both sides of the coin. Firstly the bulk of customers don't purchase a support contract. So there is very little income to pay staff. So the "support" department has very few people. They're also not very good because low wages means staff turnover. Then Betty phones with a problem. Significant time is spent explain…

> We switched to a SaaS model in 2011. Users fell over themselves thanking us. They don't have to justify it to procurement. In the companies I've worked for so far since SaaS became a thing you absolutely need to go through procurement for a big enough purchase. You actually need to negotiate the contract each time it expires, which is IMO more burden on the end user than buying a one-off license.

Sorry, I should be more clear. Yes there is a procurement process. But that happens out of band to the support request.

The problem with support contracts, or support requests solved by an upgrade, is that the User needs it now, not after a procurement process.

Doing procurement annually is easier because it can be planned for, budgeted for etc, and happens on a separate thread to the actual support.

Even when they overlap there's enough grace to keep the User happy while waiting on the customer.

Re: Defeating a 40-year-old copy protection dongle

#207

Post by wongarsu » Mon, Feb 02, 2026, 1:46 PM UTC

Joel_Mckay wrote: post #190

samplatt wrote: post #144

Earlier quoted context omitted.

VS is actually one of the cheaper tools in our stack; Unity (the game engine) is probably the most expensive one at the moment, and it's going to get much more so with their recent changes to licensing structure for embedded hardware.

Unity has always had janky shaders, the fact people still use it over Unreal Engine or even Godot is completely baffling. Unity is getting way too cheeky considering how they started out. =3

For anything smaller than AAA, C# is just generally much more pleasant to work in than C++. That's Unity's edge. And Godot is the "new" kid on the block

I'd agree that between Unreal and Godot, Unity doesn't look very attractive right now. But inertia will carry them for a long time

Re: Defeating a 40-year-old copy protection dongle

#208

Post by spicyjpeg » Mon, Feb 02, 2026, 1:50 PM UTC

alkonaut wrote: post #162

I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years. The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded. A big reason for the dongle is to regionally control fea…

Plenty of low-volume industrial software has never really moved on from security dongles. Most modern arcade games for instance still rely on a USB dongle to decrypt game files [1], though nowadays they typically also come with an additional layer of TPM-backed encryption as well as always online DRM (many of them are region locked and operate on a revenue share contract, where the owner has to pay a per-play fee to the game manufacturer).

These measures typically work well against piracy in the markets the game is officially distributed in (mainly Japan), but end up being cracked anyway once the game is popular enough that foreign arcades and private owners start importing older decommissioned cabinets and create demand for a way to get them running again without depending on the manufacturer's servers.

[1]: https://mon.im/2017/12/konami-arcade-drm

Re: Defeating a 40-year-old copy protection dongle

#209

Post by unnouinceput » Mon, Feb 02, 2026, 1:52 PM UTC

71bw wrote: post #174

unnouinceput wrote: post #118

Earlier quoted context omitted.

Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do…

>Also to this day there is no crack to Diablo 3 Look into Blizzless :-)

Looking into Issues, reading 48 and just scrolling at beginning: "Local and LAN systems talk, but will not authenticate" / "Multiplayer Game Problem" / "cannot restore DB" / "Items stats do not reflect the game class"...etc, just to name a few.

Yeah, I really like to get frustration when I am gaming due to unsupported and canceled project /s

Re: Defeating a 40-year-old copy protection dongle

#210

Post by wildzzz » Mon, Feb 02, 2026, 2:04 PM UTC

analog31 wrote: post #201

nsoonhui wrote: post #27

I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Als…

I use one engineering app that has a "soft" license. It has a lot of failure modes, all of which are essentially administrative not technological. A fair number of departments have to work together: IT, purchasing, and accounts payable (in case the company is on credit hold for non-payment of a previous license renewal) across multiple corporate divisions. It can eat up a few days of my life, and sometimes I lose acc…

We use Flex license server for so many pieces of software. It works well as long as everything is up and running. Several years ago, we merged with another company and slowly began to consolidate IT infrastructure. The license server was moved many times without giving proper notification to users until it eventually settled at the main DC we use. Then came the issue of renewing the license. Previously, license renewal was managed at the department level which means the users only need to go to their boss if there's an issue and only had to send one email to our local IT to apply a new license. Funding for licenses came out of a special budget so department heads didn't have to beg. Very simple and it worked fine for years. Now, everything is centralized which sounds great except that the people that manage the license server are so far removed from where we are that it can take months for a license renewal. You're not talking to people you have an email address for, you're submitting tickets to our central system where they forward it onto the license group somewhere. It used to be incredibly painful but has gotten better now that the license group is more aware of the entire division of employees that now require their services too.