Brain... freeze....!

[robinbloke]

Anyone know an API (preferably Win32, yes, sorry, I know) or way I can get the Processor Serial Number, I need a reliable unique number to use with the hard drive serial number for a license key system I'm writing.

Comments

[briggsy.livejournal.com]

System::Management::ManagementObject

Visual C++.NET, C#.NET and VB.NET

Isn't it better to use the MAC address rather than the PSN, given that the PSN is disabled by the BIOS in most systems?

[robinbloke.livejournal.com]

Hrm, didn't know that about the PSN; I was going to use the HDDSN and the PSN ideally as if I use the MAC address I can't guarantee a) how many cards (if any) the machine has, but given most systems now have an onboard card it is probably safe enough.

cheers!

[briggsy.livejournal.com]

Also, because the MAC address can be spoofed in Windows, but only via the registry, you need to do the funkyness that is (1) read and store the registry MAC address. (2) delete the registry MAC address. (3) request the MAC address via whatever API provides that, which populates the registry with the correct hardware MAC address, and presumably provides it to you, then (4) rewrite the stored MAC address to the registry to restore the previous setting.

This isn't some innate knowledge, just saw it on a forum when verifying that the PSN was turned off.

[robinbloke.livejournal.com]

Yeah; I know the MAC address can be spoofed, but without a lot of time and hassle (which sadly I have little of the former) it's not going to be secure, need some numbers. Hopefully the HDD will be enough, the BIOS and CPU would have been perfect but getting them seems pretty difficult and very unreliable.

The class I'm building however I'm going to give some generic seeding functions so that if I find some other useful values I can use them instead.

[sesquipedality.livejournal.com]

I was going to say, don't write licensing yourself, buy it. Anything you have time to write will be easy to trivial to circumvent. However, I bet your company doesn't want to spend money either, does it?

[robinbloke.livejournal.com]

Indeed so; as far as it's concerned we are coders therefore we provide all the code. Took me long enough to convince them to buy in support for the barcode system I wanted to save us from compatibility hell.

That said it's not really going to see serious attack (as far as I can predict) and anyone who was serious enough to want to circumvent a serial number/security system would be able to break the code wide open and disable that section anyway.

[hairyears.livejournal.com]

Why not the MAC address on the network card?

[robinbloke.livejournal.com]

MAC addresses can be changed or the card can die (admittedly there is usually one on the main board nowadays) plus I'd like to rely on more than one "unique" id per machine.

[gerald_duck]

What's the point of the licence-key system? Are you trying to impress management or deter hackers? How high a profile will the target have?

The moment you use an API people will insert a shim to fake it. If you're doing more than going through the motions you probably need to talk directly to the hardware… and pray you're not running under Xen. :-p

[robinbloke.livejournal.com]

It's to stop people using software we don't want them to, unfortunately this is mostly on a PC so quite a lot of useful info (CPU serial number, BIOS serial number) can't be relied on (Under XP, yes, I know) to be returned the same way all the time.
Profile is probably low to "ugh, computer" level, high level hackers I'm not worried about. The code is compiled in MFC and if they want to break it, they will and there's not much I can do about it.