如何保护应用程序免受虚拟机重复
我们使用硬盘和 CPU ID 等标准项目将我们的软件许可证锁定到物理硬件。 我们如何降低客户绕过我们的许可安装到虚拟机然后克隆虚拟机的风险？
We are using standard items such as Hard Disk and CPU ID to lock our software licenses to physical hardware. How can we reduce the risk of customers installing onto a virtual machine and then cloning the virtual machine, bypassing our licensing?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
没有充分的理由锁定物理机器。 上次我检查过计算机可能会崩溃，然后用户可能不仅会因为计算机死机而感到不便，而且还必须打电话给您将软件锁定到新机器。 如果您必须进行严格的许可证管理，请使用（本地）管理服务器并让正在运行的副本每隔几分钟验证一次是否拥有许可证。 只要意识到，无论你做什么，如果有人真的想在不付费的情况下使用你的软件，他们就会找到办法。
There is no good reason to lock to a physical machine. Last I checked computers can break down, and then the user is probably going to be inconvenienced not only by a dead computer, but by having to call you to get the software locked to a new machine. If you must do draconian license management use a (local) management server and have running copies verify that they have a license every few minutes. Just realize that whatever you do if someone really wants to use your software without paying you they will find a way.
您需要计算机“硬件”之外的东西来进行身份验证。 大多数公司选择硬件密钥（加密狗）作为软件，但成本较高，用户也能忍受。
其他公司使用在线方法 - 如果多个具有 CPUID 和其他硬件的用户同时使用给定许可证，则不允许另一实例化，或关闭现有实例化。
您必须根据您的需求以及消费者跨越反盗版障碍的意愿来选择保护措施。
-亚当
You need something outside the computer "hardware" to authenticate against. Most companies choose hardware keys (dongles) in for software with a high cost where users will put up with it.
Other companies use online methods - if more than one user with CPUID and other hardware is concurrently using a given license, then disallow another instantiation, or close the existing instantiation.
You have to choose protection according to your needs and the consumer's willingness to jump through your anti-piracy hoops.
-Adam
据我所知，除了需要定期在线激活之外，您可以做的事情并不多。
我们在人们对物理机器进行诺顿重影的问题上遇到了问题。 显然硬盘序列号也被隐藏了。
There's not a lot you can do AFAIK, except require periodic online activation.
We have problems with people Norton-ghosting physical machines. Apparently HDD serial numbers are ghosted too.
如果您的软件在虚拟机下运行，那么它将在任意数量的克隆虚拟机下运行。 因此，唯一的选择似乎是完全阻止它在虚拟机下运行。 这是一篇关于虚拟机检测的文章：检测您的程序是否在虚拟机内运行 和一个关于阻止它的内容。
顺便说一句，克隆虚拟机通常很麻烦，足以阻止临时用户绕过您的许可，而那些一心想要破解的人可能会找到一种方法来绕过它。
If your software runs under a VM, then it will run under any number of cloned VMs. Therefore, the only option seems to prevent it running under a VM at all. Here's an article about virtual machine detection: Detect if your program is running inside a Virtual Machine and one about thwarting it.
By the way, cloning a VM is usually enough of a hassle to deter casual users from bypassing your licensing and those hell bent on cracking will probably find a way to bypass it anyway.
“别打扰”是简短的版本。 对于您的客户来说，这样做并不简单，如果他们这样做，那么他们要么无论如何都不会为他们使用的东西付费（除非他们可以免费获得，否则他们不会使用它），或者你只是平庸收费过高（就像你在哄抬物价一样）。
“真正的”客户通常会为这些东西付费。 据我所知，像企业这样的地方通常会认为不值得付出努力。
"Don't bother" is the short version. It's non trivial enough for your clients to do it that if they are doing that, then either they won't pay for what they use no matter what (they will not use it unless they can get it for free) or you are just flat charging to much (as in you are gouging.)
The "real" customer will generally pay for the stuff. From what I've seen, places like businesses will generally consider it not worth the effort.
我知道一些虚拟机软件（至少是VMware）具有允许软件检测虚拟化的功能。 但没有万无一失的方法，无论如何都可以修补这些功能。 也可以使用神秘变化的性能（由于主机中的 CPU 峰值），可靠性值得怀疑。 有很多“被虚拟化的迹象”，但它们往往不是 100% 可靠。
I know some virtual machine software (at least VMware) have features that allow software to detect virtualization. But there is no foolproof way, it's possible to patch such features away anyway. Mysteriously changing performance (due to CPU spikes in the host) could also be used, reliability is questionable. There is a plethora of "signs of being virtualized", but they tend to be not 100% reliable.
这是一个问题，任何精明的用户都能够击败你对此所做的几乎任何事情。 不熟练的用户可能会遇到像 VmWare 播放器这样的行为，当您移动虚拟机时，它会更改虚拟机的 MAC 和其他 ID，大概是为了解决此类问题。
最好的解决方案可能是使用许可证服务器，因为该服务器将计算活动许可证的数量。 节点锁定更容易被破解，并且使用服务器往往也会将责任推给 IT 部门，与只想尽快完成工作的个人用户相比，IT 部门对不违反许可协议更加敏感。
但最终，我同意这一切都取决于适当的许可语言和拥有您某种程度上信任的客户。 如果您认为人们以这种方式愚弄您，那么您一开始就不应该向他们出售您的软件......
It is a problem, and any savvy user will be able to defeat pretty much anything you do about it. Unsavvy users might get caught by behaviors like VmWare's player that changes MAC and other IDs of the virtual machine when you move it, presumably in a nod to this kind of issue.
The best solution is likely to use a license server instead, since that server will count the number of active licenses. Node locking is easier to defeat, and using a server tends also to push responsibility onto an IT department that is more sensitive to not breaking license agreements compared to individual users who just want to get their job done as quickly as possible.
But in the end, I agree that it all falls back to proper license language and having customers you trust somewhat. If you think that people are making a fool of you in this way, you should not be selling your software to them in the first place...
如果您的软件需要在虚拟机上运行，那么这个概念怎么样：
或者更好的是，让主机程序以某种方式直接与虚拟机中的软件进行通信。
难道这不是一个好的解决方案吗？ 不像使用硬件密钥（如 Yubikey）那么安全，但你必须非常精通技术才能破解它......？
If your software was required to under on a VM what about this concept:
Or better yet, have the host program somehow communicate with the software in the VM directly.
Couldn't this be an okay solution? Not as secure as using a hardware key (like Yubikey) but you would have to be quite tech savvy to break it...?
一种方法是拥有一个许可服务器。 当您将许可证代码输入客户端（在虚拟机上）时，它会联系服务器并向其发送许可证代码和其他信息。 它会反复联系它（您定义间隔 - 也许每隔几个小时一次）询问“我仍然有效吗？”除了此请求之外，它还会发送一个唯一的 ID。服务器回复“是的，您是有效的”，并发送一个新的唯一 ID 发送回客户端，服务器会验证该 ID 是否与上一个请求发送给客户端的 ID 相同
。下次它询问服务器“我有效吗？”时，该唯一 ID 要么对它来说不正确，要么对另一个 VM 来说都将无法继续工作，
您将需要确定如果服务器出现故障该怎么办 。 ，或者网络出现故障，您是否立即禁用您的软件？不要让您的客户生气。您应该给他们多长时间的宽限期。几天？几周？
理论上，他们可以在输入许可证密钥后克隆父虚拟机，然后在宽限期结束前将其他虚拟机恢复到该克隆。出，禁用对它们的网络访问。 不过，如果您的客户拥有额外的盗版软件副本，这对您来说将是一件麻烦事。 您必须确定什么样的宽限期不会给您的合法客户带来麻烦，同时希望为您提供所需的保护。
通过验证虚拟机的时钟设置是否正确可以实现额外的保护。 这将防止上述盗版方法。
另一个考虑因素是，精明的用户可以编写自己的许可服务器来与虚拟机实例通信，并告诉它们“你很好”——因此加密通信可以帮助阻止这种情况。 您想走多远实际上取决于您认为盗版对您的客户来说可能是一个多大的问题。 最终，您将无法阻止有时间的真正盗版者，但您可以让诚实的用户保持诚实。
One approach is to have a licensing server. When you enter a license code into the client (on a VM), it contacts the server and sends it its license code and other information. It contacts it repeatedly (you define the interval -- maybe once every few hours) asking 'Am I still valid"? Along with this request, it sends a unique ID. The server replies 'Yes, you are valid', and sends a new unique ID back to the client. The client sends this unique ID back with its next request to the server. The server verifies this is the same ID it sent to the client for that license, the previous request.
If the VM is duplicated, the next time it asks the server 'Am I valid?', the unique ID will be incorrect either for it, or for the other VM. Both will not continue to work.
You will need to determine what to do if the server goes down, or the network goes down, such that the client cannot communicate with the server. Do you immediately disable your software? Bad idea! Don't make your customers angry. You'll want to give them a grace period. How long should this be? A few days? Weeks?
Let's say you give them a 1-month grace period. In theory, they could clone the parent VM just after entering the license key, then restore the other VMs to this clone just before their grace period runs out, disabling network access to them. This would be a hassle for your customers though, just to have pirated additional copies of your software. You have to determine what kind of grace period won't hassle your legitimate customers, while hopefully giving you the protection you seek.
Additional protection could be achieved by verifying that the VM's clock is set correctly. This would prevent the above approach to pirating.
Another consideration is that a savvy user could write their own licensing server to communicate with the VM instances, and tell them all 'you're good' -- so encrypting the communication could help deter this. How far you want to go here really depends on how much you think pirating really might be an issue with your customers. In the end you won't be able to stop true pirates who have time on their hands, but you can keep honest users honest.
执照。 告诉您的用户，他们不得运行未经许可的副本。
实际上，我们目前未能购买软件许可证，因为供应商害怕虚拟机：我们部门的基础设施正在转移到集中式虚拟化解决方案，我们必须与虚拟机作斗争。供应商被允许为其软件购买许可证！
不要害怕付费用户。
人们太便宜而无法购买许可证，他们会寻找另一种解决方案，无论如何都会带来太多麻烦。
（不过，祝你好运告诉你的老板......）
License. Tell your users, they may not run unlicensed copies.
We are actually failing to buy a license for a software at the moment, because the vendor is scared of virtual machines: The infrastructure for our department is being moved to a centralized virtualized sollution and we have to fight the vendor to be allowed to buy a license for his software!
Don't be afraid of paying users.
People too cheep to buy licenses are going to look for another sollution and will be too much hassle anyway.
(good luck telling your boss that, though...)