[Zilog80]

Hello br0s.

I'm trying to figure out how to 'convert' an standard USB Key into USB dongle for protecting our software. I will try to explain:

I use a DVD media to distribute our software. Our software use an USB dongle for protection & decrypt stuff. With out this USB dongle the software does not work.

But now, we are going to use an OEM USB stick (with our own corp. logo) instead the DVD media for distribute the software.

I was looking if would be posible use this OEM USB stick as 'a USB dongle', in this case we would save some buckets because don't need 'real' USB dongle anymore.

My first choice was 'write some kind of file content' into OEM USB, but this seems a waste of time, because anyone could 'buy us' one copy of our software and then 'clone' the OEM USB and booom!: unlimited copies ❓

Some ideas?

[Ninja]

How about you check some hardware settings for the USB? Like the brand, storage size, etc. This means that if people used the same USB they can still copy it but at least it is somewhat protected...

Or encrypt it in some other way into the USB that you cant find it with a file manager or something.

[gigajew]

Add checksum for USB hardware id and verify upon install (when run from USB)

[GuRuHaX]

I don't know if i am misunderstanding the issue but, you could use RSA and implement private & public key (asymmetric encryption) encrypt with the public key and decrypt with the corresponding private key ?

🤝

[GuRuHaX]

Out of curiousity, have you found something that fitted your needs ?

🤝

[Zilog80]

Out of curiousity, have you found something that fitted your needs ?

🤝

Nope 😟

There are some software out there (1st Google results) that supposedly converts the USB into a 'device for protect files' like docs, txt, Excel, etc but this is not my scenario.

Still searching for a solution.

[The RAT Coder]

Just a question, why did you post this into the VB.NET section?

[GuRuHaX]

Just a question, why did you post this into the VB.NET section?

Probally because he wants to code it in VB ? 😧

@OP, what are the actual functions/behaviors you want it to have specifically ?

🤝

[Zilog80]

Probally because he wants to code it in VB ? 😧

@OP, what are the actual functions/behaviors you want it to have specifically ?

🤝

I did it this weekend.

How it works:

On USB root I look for a "xxxxxx.ext" file:

A) if file not exists the App don't start
B) if file exists:
B.1) "xxxxx.ext" contains the available features. This file is crypted using the USB serial ID. The "xxxxx.ext" is created by other tool. So.
App reads and decrypt the "xxxxx.ext" file. The decryption only "works" for this USB Key. Once decrypted we have the available features.

So I have this methods: (IDongle Interface)

PHP Code


<?php 
bool Check() 


Return true when:
1) we have a USB plugged with right "xxxxx.ext" file

Return false when:
1) No USB plugged
2) USB plugged but without "xxxxx.ext" file
3) USB plugged and with "xxxxx.ext" file but copied by hand from other USB
4) USB plugged and with "xxxxx.ext" file modified by hand (decrytion error)

PHP Code


<?php 
bool CheckFeature(int featureNumber) 


Return true or false with same criteria as Check() method.

Profit Sentinel HASP and/or SecuTech UniKey 🎉

[GuRuHaX]

I did it this weekend.

How it works:

On USB root I look for a "xxxxxx.ext" file:

A) if file not exists the App don't start
B) if file exists:
B.1) "xxxxx.ext" contains the available features. This file is crypted using the USB serial ID. The "xxxxx.ext" is created by other tool. So.
App reads and decrypt the "xxxxx.ext" file. The decryption only "works" for this USB Key. Once decrypted we have the available features.

So I have this methods: (IDongle Interface)

PHP Code


<?php 
bool Check() 


Return true when:
1) we have a USB plugged with right "xxxxx.ext" file

Return false when:
1) No USB plugged
2) USB plugged but without "xxxxx.ext" file
3) USB plugged and with "xxxxx.ext" file but copied by hand from other USB
4) USB plugged and with "xxxxx.ext" file modified by hand (decrytion error)

PHP Code


<?php 
bool CheckFeature(int featureNumber) 


Return true or false with same criteria as Check() method.

Profit Sentinel HASP and/or SecuTech UniKey 🎉

Nice to hear you found and made what you needed !
I had some issues understanding the OP but now i totally understand what you where after and . "UniKey" looks nice 👍

One question though, if one would RE your app, and set/return the bool Check() to true and same for CheckFeature(int featureNumber), wouldn't that defeat it in a certain way or are you handling other things along those checks (serverside maybe) ?

🤝

[Ninja]

One question though, if one would RE your app, and set/return the bool Check() to true and same for CheckFeature(int featureNumber), wouldn't that defeat it in a certain way or are you handling other things along those checks (serverside maybe) ?

🤝

You could combine this with like remote assembly loading. When the dongle works, grab an assembly from a source, decrypt it using a key on the dongle, and then use reflection to instantiate the classes you need.

[GuRuHaX]

You could combine this with like remote assembly loading. When the dongle works, grab an assembly from a source, decrypt it using a key on the dongle, and then use reflection to instantiate the classes you need.

Yeah would work, im thinking of ways to prevent that (for OP) but only thing i can think of now is making it harder to inject/load.

There are some usb-ish like token generators (idk the correct name) its like a USB with a button, push it and it generates a unique token (connected to server).

He could use a staticValue + tokenValue (from the human user not the app) and that would make it almost impossible unless the server is compromised, its pricy but if its a business investment its worth the money i would say.

🤝

[Zilog80]

Well, our app need special hardware to work (PLC, LPR camera, digital I/O device, digital scale, ...) so I don't worry much about "some one bypass/inject/tamper" our USB/HASP-UniKey Dongle protection.

Also many times our app runs on "isolated" facility in middle of nowhere with out internet connection, so Server side validations/checking are not suitable in our scenario.

And finally we use custom (and not public) ConfuserEx version to protect critical section of code.

We are not trying to stop 10 year experienced IDAPro/WinDbg/OllyDbg reverser, because our target is industrial target, not domestic target.

With your permissions, i'm going to close the thread because I fixed the 'problem'.
Thanks for replies. 👍