激活密钥算法-安全
我正在编写一个软件应用程序，用户需要购买许可证并激活它。我需要有关如何开始编写用于代码生成以及代码检查的强大算法的建议。我知道人们可以对代码进行逆向工程并制作注册机，但是，我的问题是两个部分：
一般来说，无论应用程序以这种方式破解，我如何开始编写算法来接受某个串行或字符串或组合。 （例如，这是正确的吗？例如：第一个数字是 3-9，第二个数字应该是第一个 - 3，而第三个数字应该是第二个 * + ....无论如何...？？）
在不与互联网打交道的情况下保护桌面应用程序免受盗版的最佳方法是什么？是算法（使逆向工程变得更困难），保护源代码在应用程序安装在某处后不被看到吗？ ...??
PS：也许值得一提的是，我使用 Java 作为我的开发语言。 谢谢
I'm writing a software application that the user needs to buy a license for and activate it. I need suggestions on how to start about writing a powerful algorithm for code generation and of course, code checking. I know that people can reverse engineer the code and make a keygen, however, my question is two parts:
In general, regardless of the application being cracked this way, how can I start writing an algorithm to accept a certain Serial or String or a combination. (e.g is that the right thing? e.g: the first number is from 3-9 the second should be the first - 3, while the third number should be the second * + ....whatever...??)
What is the best approach for protecting a Desktop application from piracy without dealing with the internet. Is it the algorithm (make it harder to reverse engineer), protect the source code from being seen after application is installed somewhere?? ...??
PS: Maybe it is worth to mention that I am using Java as my development language.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
听起来您可能会从公钥加密方法中受益。< /p>
这可以分为两个子点：
（在声明他正在使用 Java 之后进行编辑）
It sounds like you might benefit from the public-key cryptography approach.
This can be broken down into two sub points:
(edited after stated he's using Java)
对于许可证密钥，您可以使用公钥-私钥进行加密。通过这种方式，您可以将私钥嵌入到软件中并加密对您的软件有意义的字符串（例如您的软件的哪些功能已获得许可）。或者，您可以嵌入公共并为软件提供一个具有特殊含义的字符串，并使用您的私钥对其进行签名。然后软件可以检查签名是否有效。
编辑： labratmatt 的公钥-私钥答案更快:)
显然，保护的第二部分需要处理使您的软件难以反汇编和调试（这就是黑客检查您的软件并尝试的方式）通过补丁绕过保护或者尝试找出如何制作注册机）。这部分实际上要困难得多，涉及一些技术，例如加密整个可执行文件并将其包装在加载器中，加载器在运行时对其进行解密。加载程序还可以使用各种技术来检测调试器的存在。
编辑：既然您提到应用程序是用JAVA编写的，那么这个加密和打包步骤就更加重要，因为JAVA可以很容易地反编译成人类可读的形式。有一些“混淆器”程序会混淆这些类，使反编译器无法生成可读的代码，但破解它仍然比破解编译为机器代码的东西要容易得多。
如果您不想花时间开发自己的保护，您也可以使用商业保护软件之一。它们有很多可供选择，并且提供多种保护方案（加密狗、基于时间的许可证……）
许多商业软件使用 FlexNet、HASP、Wibu-key 等软件包
For the license keys you could use an encryption with public-private keys. In this way you could either embed the private key into the software and encrypt a string which would mean something to your software (like which features of your software are licensed). Or you could embed the public and give the software a string with special meaning and sign it with your private key. The software could then check if the signature is valid.
edit: labratmatt was faster with the public-private key answer :)
Obviously second part of your protection would need to deal with making your software hard to disassemble and debug (this is how crackers examine your software and try to bypass the protection with a patch or they try to figure out how they can make a keygen). This part is actually much harder and involves techniques like encryption the whole executable and wrap it inside a loader which decrypts it at runtime. The loader can also use various techniques to detect the presence of debuggers.
edit: Since you mentioned that the application is written in JAVA, then this encrypting and packing step is even more important as JAVA can easily be decompiled into a very human readable form. There are "obfuscator" programs which mess around with the classes so that the decompilers can't generate readable code, but cracking this is still much easier than cracking something compiled to machine code.
If you don't want to spend time with developing your own protection you can also use one of commercial protection software. There are quite a lot of them to choose from and they offer numerous protection schemes (dongles, time based licenses,...)
Lots of commercial software uses packages like FlexNet, HASP, Wibu-key
建议：加密应用程序中提供仅限许可功能的部分。用户需要您在购买时提供的密钥才能使用该部分代码。
如果您让用户在购买之前运行您想要保护的代码，则没有明显安全的离线解决方案。充其量，你可以阻止最随意的盗版行为。
Suggestion: encrypt the part of the application that provides licensed-only functionality. The user needs a key you provide on purchase in order to use that portion of the code.
If you ever let the user run the code you want to protect before they've purchased, there is no significantly secure offline solution. At best, you can stop the most casual piracy.
您还应该考虑以一个密钥不能在两台不同的计算机上使用的方式进行操作。只是为了防止公司购买一把钥匙并多次使用它。
You should also thing about doing it in a way that one key cannot be used on two different computers. Just to prevent a company buying one key and using it for many instalations.
你也写了自己的JRE吗？构建一个安全、功能强大的激活系统，可以顺利处理您将遇到的各种用户场景（没有网络连接的人、防火墙、代理服务器等），并且已经在现场进行了彻底的测试，需要大量的领域专业知识和时间。
作为此类系统的供应商，我们确实有自身利益需要声明，但我们也有数据 - 我们看到许多公司信任开发人员，说他们可以构建许可系统，然后他们又回到我们这里因为它从来没有满足他们的需要。这篇文章（我的）详细阐述了这些问题：http://knol.google.com/k/dominic-haigh/issues-to-consider-before-building-your/2zijsseqiutxo/6#
Did you write your own JRE too? Building a secure, capable activation system that deals smoothly with the range of user scenarios you'll encounter (people with no network connection, a firewall, a proxy server etc) and has been thoroughly tested in the field takes considerable domain expertise and time.
As a supplier of such systems we do have as self-interest to declare, but we also have data - we see many companies who put their trust in a developer who says they can put together a licensing system, then later they come back to us as it never did what they needed. This article (of mine) expands on the issues: http://knol.google.com/k/dominic-haigh/issues-to-consider-before-building-your/2zijsseqiutxo/6#
https://superuser.com/questions/14224/how-to- explain-drm-cannot-work/14254#14254
即使您确实对软件设置了非常强大的锁定，盗版者仍然会找到一种方法来破解它并将其放在 torrent 站点上。 （恰当的例子：Spore）
您正在谈论 DRM，并且没有简单的方法（如果有的话）来阻止盗版者盗版您的软件。此外，您正在与可以完成您的软件功能的免费产品竞争（总是如此），因此您应该更多地关注使您的软件易于安装和使用，而不是难以安装和使用超出您的预期。
https://superuser.com/questions/14224/how-to-explain-drm-cannot-work/14254#14254
Even if you did put a very powerful lock on your software, pirates would still find a way to crack it and put it on a torrent site. (case in point: Spore)
You are talking about DRM, and there's no easy way (if any) to lock pirates out of pirating your software. And besides, you are competing with free products that can do what your software does (always the case), so you should focus more on making your software easy to install and use, not hard to install and use for more than you intended.