[Derrpy]

How do I make a secure hwid login?

I have a txt_username (Username textbox)
I have txt_password (Password textbox)
I ave txt_Hwid (Your machine's HWID.)

I know how to get username and password work. But when I contacted a reverse engineer master, he just cracked it withing a minute, so I decided to do a HWID login so it will only work on 1 PC, could someone tell me how it worked? Thanks! :D

[SIM-1230922]

Ideally you would store those values in a MySQL database on your server and then validate the given values in the application with the server.

[System[X]]

How do I make a secure hwid login?

I have a txt_username (Username textbox)
I have txt_password (Password textbox)
I ave txt_Hwid (Your machine's HWID.)

I know how to get username and password work. But when I contacted a reverse engineer master, he just cracked it withing a minute, so I decided to do a HWID login so it will only work on 1 PC, could someone tell me how it worked? Thanks! :D

Sorry to tell you that even with a HWID the tool can be cracked within seconds as they just remove the statement that requires it.

Even if you have the usrname/password/hwid or whatever in an online MYSQL, they don't need them, they simply remove the call for them or more specifically they change false to true and vice verse . Basically removing the login from the tool.

Remember that they can see your full code and any usernames/passwords within the tool.

Thanks

[EagleEye]

you can try to use our system, we have already done everything needed for your application to get licensed

[Barret]

you can try to use our system, we have already done everything needed for your application to get licensed

lol ..."buy me , ME ME ME ME WE HAZ IT" 🤭

[EagleEye]

lol ..."buy me , ME ME ME ME WE HAZ IT" 🤭

i won't discuss this...🙃

[Derrpy]

Sorry to tell you that even with a HWID the tool can be cracked within seconds as they just remove the statement that requires it.

Even if you have the usrname/password/hwid or whatever in an online MYSQL, they don't need them, they simply remove the call for them or more specifically they change false to true and vice verse . Basically removing the login from the tool.

Remember that they can see your full code and any usernames/passwords within the tool.

Thanks

Aww, that sounds bad, is there a way to make my program "un-crackable"
Thanks.

[CoderEX]

Aww, that sounds bad, is there a way to make my program "un-crackable"
Thanks.

It is always going to come down to the fact that it is really easy to patch a login system in any .NET language by removing or tampering with the if statement.

You have a few options:

1. Code in some integrity checks. This can include but not limited to hash check of your own application and have a way to check the authenticity of the user's request to the server to make sure it is not a spoof request.

2. Start looking into importing your code to a Server Side logic type application. What I mean by this is start taking advantage of storing code on a server. Have the user send a request to the server with some information to verify if they have a legit login Session. If they do, then launch the code, if not then deal with it accordingly.

Also, you should avoid hard coding your MySQL connection into your code. Your database information will be at risk and you could possibly have someone tamper with your database. Consider using PHP as your middleman to communicate between the database and your application.

Obfuscation is a nice tool as well. Although, you should not rely on it entirely, it does help keep most crackers away.

Hopefully nothing was too confusing and it was some help.

[Rhez]

Having an if else condition on your login system won't help you secure it.