<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/12/2015 08:29, Richard Mace
wrote:<br>
</div>
<blockquote
cite="mid:CAK+KT39Amnvz2u=Bt=00p1=_VZDNDGwCkqpSK--s4ezaGhoq8A@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default"
style="font-family:arial,helvetica,sans-serif">Hi All,<br>
</div>
<div class="gmail_default"
style="font-family:arial,helvetica,sans-serif">I was wondering
if there was a way where an application, written in Lazarus,
could detect when a compiler is running, perhaps by it's
mutex?<br>
</div>
<div class="gmail_default"
style="font-family:arial,helvetica,sans-serif">My idea was, in
my application, I could periodically check to see if a
decompiler was running and then my app could perform an
operation, such as maybe closing.<br>
</div>
</div>
</blockquote>
<br>
Well there is no 100% protection.<br>
Even if you make it so hard, that it is financially not interesting
for a cracker, there will be someone who does the job to make him
self a name, add it to their trophy list.<br>
Hence my opinion: if you spent to much time/money on protection,
then thats already your loss.<br>
<br>
Anyway, there are 2 ways your app can be hacked.<br>
1) a key can be distributed. <br>
1a) Either stolen, or bought with wrong credentials<br>
1b) a key generator can be written<br>
2) a patch can be written to modify your exe.<br>
<br>
(2) is always possible, and will happen unless (1) is really simple.
But (2) is not so attractive to the users, as the risk is that they
download a virus with it. IMHO attempting to protect against (2) is
a waste of time.<br>
<br>
(1) is important. Because downloading a key (usually a bit of text)
is easy. Sign licenses with a private key. That should stop (1b). <br>
<br>
(1a) can IMHO only be solved by phoning home. That in itself can
loose you a small number of potential buyers. <br>
Download a revocation list: hashes of keys no longer allowed, the
overall list is signed, and it is issued with a time stamp, updated
every minute. Your app will only run, if it can get a list not olden
than x days. Downside if your server is down, longer that this
..... Also the user needs internet.<br>
Alternatively you can try to bind the license key to the hardware
signature of the users pc. Allowing to reactivate a few times, then
having to phone you.... I remember some big company did that in the
past.<br>
<br>
The other option is a dongle. Then you do not need to phone home.
Again some hacker will create a patch to your software. But
hopefully enough users will pay, rather than risking a virus.<br>
<br>
<br>
</body>
</html>