1. Get time difference without time()
- Posted by aku at inbox.as
Mar 14, 2001
How I can get time difference without using time()? (in win32)
But I don't want to use date() because user can change system time.
Maybe something like time() but using win32 api calls.
Thanks.
2. Re: Get time difference without time()
Hello Aku,
>How I can get time difference without using time()? (in win32)
>But I don't want to use date() because user can change system time.
>Maybe something like time() but using win32 api calls.
Let me guess, You are wanting to do this to prevent the
following scenario:
Joe Blow downloads your shareware (time-limited) software.
Joe Blow sets his computer clock to 5 years ahead.
Joe Blow installs your software.
Joe Blow sets his computer clock back to normal time...
.. thus defeating your time-limit.
The truth is, I think the user can change any time that you
can check with your program. However, if you use date() then
check to make sure that your saved-time is actually AFTER
the current time, that should prevent Joe Blow from
preventing you from preventing him from using your software
more than the specified amount of time.
Am I wrong... anyone?
Lewis Townsend
3. Re: Get time difference without time()
In this case you'd simply record the date of the install. When your program
runs, you check the date of install vs. the current date... if the date of
install is now AFTER the current date, delete their entire hard drive.
Just kiddin' 'bout the deleting part.
> >How I can get time difference without using time()? (in win32)
> >But I don't want to use date() because user can change system time.
> >Maybe something like time() but using win32 api calls.
>
> Let me guess, You are wanting to do this to prevent the
> following scenario:
>
> Joe Blow downloads your shareware (time-limited) software.
> Joe Blow sets his computer clock to 5 years ahead.
> Joe Blow installs your software.
> Joe Blow sets his computer clock back to normal time...
> ... thus defeating your time-limit.
>
> The truth is, I think the user can change any time that you
> can check with your program. However, if you use date() then
> check to make sure that your saved-time is actually AFTER
> the current time, that should prevent Joe Blow from
> preventing you from preventing him from using your software
> more than the specified amount of time.
>
> Am I wrong... anyone?
> Lewis Townsend
4. Re: Get time difference without time()
- Posted by leviathan at uswest.net
Mar 15, 2001
> Let me guess, You are wanting to do this to prevent the
> following scenario:
>
> Joe Blow downloads your shareware (time-limited) software.
> Joe Blow sets his computer clock to 5 years ahead.
> Joe Blow installs your software.
> Joe Blow sets his computer clock back to normal time...
> ... thus defeating your time-limit.
>
> The truth is, I think the user can change any time that you
> can check with your program. However, if you use date() then
> check to make sure that your saved-time is actually AFTER
> the current time, that should prevent Joe Blow from
> preventing you from preventing him from using your software
> more than the specified amount of time.
Simple as this, record the date the program was first run. Check for
negative days (in this case, just go and deny the program to run
anymore), check for it running past any number of days (deny the
program to run afterward?). Best way to do this is either:
1) Put the key into the registry. A tad trickier to defeat such a
problem, but it can still be defeated by even a weak cracker-jocker
like me, and some free programs on the web (Sysinternals RegMon).
1a) If you do put a key into the registry, modify some key that
_looks_ highly important (Anything regarding Windows/IE* seems
important to me, no doubt someone was crafty enough to slip
something like that by me), but it isn't (i.e. delete it, and nothing
noticable happens). This'd throw me off :)
2) If you're good with executables, particularly win.com or even
VxDs, toss into their headers, wherever unused, the date code.
Deleting any such system file could cause the OS to cease
function/retire life, and it'd be VERY hard for just anyone to crack
such a eval deal. (I _might_ be able to do it - again, with a couple of
free programs, SysInternals FileMon and Hackman, and even VC++
debug, perhaps)
3) Put a bug on the HD. With Filemon, its easy to track something
like this down.
4) Self-modifying executable. Can't be done in Euphoria, however.
(So I've heard).
So, any way you do it, you're screwed, it'll be cracked. But when
you do implement such a deal, be very very crafty about it, and
remember: It will be cracked. Oh well.
HTH,
--"LEVIATHAN"
5. Re: Get time difference without time()
>> Let me guess, You are wanting to do this to prevent the
>> following scenario:
>>
>> Joe Blow downloads your shareware (time-limited) software.
>> Joe Blow sets his computer clock to 5 years ahead.
>> Joe Blow installs your software.
>> Joe Blow sets his computer clock back to normal time...
>> ... thus defeating your time-limit.
As long as we're talking about this...Here's a solution:
You have a company, supersoftware.com. On your server, you run an NTP
server, tick.supersoftware.com. Your time-bombed software could compare
the current date, as reported by your NTP server, to the installed date,
and act accordingly.
Problems:
1) User has to have Internet connection to use software
2) Sophisticated user could setup their own local NTP server, and spoof
yours.
The fix for #2 is to access the server using SSL with a Verisign-signed
certificate. I don't know if NTP can actually be tunneled through this, so
you might just have to have your program access a secure HTTP server, the
URL of which simply shows the current date & time. I don't see how this
could be spoofed...
I don't have a fix for #1. You'd just have to tell users that they'd have
to be connected...
Didn't say it was practical (though it seems pretty practical if you're
talking about millions of dollars in revenue :) ), didn't say you'd want to
do it. But it seems pretty simple, and workable, really. I guess whether
#1 is a problem depends on the type of software, and client expectations...
--Ted
--On Thursday, March 15, 2001 01:01:57 AM -0800 leviathan at uswest.net wrote:
>
>
>> Let me guess, You are wanting to do this to prevent the
>> following scenario:
>>
>> Joe Blow downloads your shareware (time-limited) software.
>> Joe Blow sets his computer clock to 5 years ahead.
>> Joe Blow installs your software.
>> Joe Blow sets his computer clock back to normal time...
>> ... thus defeating your time-limit.
>>
>> The truth is, I think the user can change any time that you
>> can check with your program. However, if you use date() then
>> check to make sure that your saved-time is actually AFTER
>> the current time, that should prevent Joe Blow from
>> preventing you from preventing him from using your software
>> more than the specified amount of time.
>
> Simple as this, record the date the program was first run. Check for
> negative days (in this case, just go and deny the program to run
> anymore), check for it running past any number of days (deny the
> program to run afterward?). Best way to do this is either:
>
> 1) Put the key into the registry. A tad trickier to defeat such a
> problem, but it can still be defeated by even a weak cracker-jocker
> like me, and some free programs on the web (Sysinternals RegMon).
>
> 1a) If you do put a key into the registry, modify some key that
> _looks_ highly important (Anything regarding Windows/IE* seems
> important to me, no doubt someone was crafty enough to slip
> something like that by me), but it isn't (i.e. delete it, and nothing
> noticable happens). This'd throw me off :)
>
> 2) If you're good with executables, particularly win.com or even
> VxDs, toss into their headers, wherever unused, the date code.
> Deleting any such system file could cause the OS to cease
> function/retire life, and it'd be VERY hard for just anyone to crack
> such a eval deal. (I _might_ be able to do it - again, with a couple of
> free programs, SysInternals FileMon and Hackman, and even VC++
> debug, perhaps)
>
> 3) Put a bug on the HD. With Filemon, its easy to track something
> like this down.
>
> 4) Self-modifying executable. Can't be done in Euphoria, however.
> (So I've heard).
>
> So, any way you do it, you're screwed, it'll be cracked. But when
> you do implement such a deal, be very very crafty about it, and
> remember: It will be cracked. Oh well.
>
> HTH,
>
> --"LEVIATHAN"
>
>
>
>
6. Re: Get time difference without time()
On 15 Mar 2001, at 5:40, Ted Fines wrote:
> >> Let me guess, You are wanting to do this to prevent the
> >> following scenario:
> >>
> >> Joe Blow downloads your shareware (time-limited) software.
> >> Joe Blow sets his computer clock to 5 years ahead.
> >> Joe Blow installs your software.
> >> Joe Blow sets his computer clock back to normal time...
> >> ... thus defeating your time-limit.
>
> As long as we're talking about this...Here's a solution:
> You have a company, supersoftware.com. On your server, you run an NTP
> server, tick.supersoftware.com. Your time-bombed software could compare
> the current date, as reported by your NTP server, to the installed date,
> and act accordingly.
> Problems:
> 1) User has to have Internet connection to use software
> 2) Sophisticated user could setup their own local NTP server, and spoof
> yours.
>
> The fix for #2 is to access the server using SSL with a Verisign-signed
> certificate. I don't know if NTP can actually be tunneled through this, so
> you might just have to have your program access a secure HTTP server, the
> URL of which simply shows the current date & time. I don't see how this
> could be spoofed...
>
> I don't have a fix for #1. You'd just have to tell users that they'd have
> to be connected...
>
> Didn't say it was practical (though it seems pretty practical if you're
> talking about millions of dollars in revenue :) ), didn't say you'd want to
> do it. But it seems pretty simple, and workable, really. I guess whether
> #1 is a problem depends on the type of software, and client expectations...
Have the server that sent the software hard code the current date and the crash
date
into the software in an encoded form, before sending it. Then have the software
check
the system date on the puter, and calculate the time till crash and/or running
time.
Sooner or later, the crash date will be hit and the software will erase itself.
Kat
7. Re: Get time difference without time()
----- Original Message -----
From: <leviathan at uswest.net>
To: "EUforum" <EUforum at topica.com>
Sent: Thursday, March 15, 2001 04:01
Subject: Re: Get time difference without time()
| > Let me guess, You are wanting to do this to prevent the
| > following scenario:
| >
| > Joe Blow downloads your shareware (time-limited) software.
| > Joe Blow sets his computer clock to 5 years ahead.
| > Joe Blow installs your software.
| > Joe Blow sets his computer clock back to normal time...
| > ... thus defeating your time-limit.
| >
| > The truth is, I think the user can change any time that you
| > can check with your program. However, if you use date() then
| > check to make sure that your saved-time is actually AFTER
| > the current time, that should prevent Joe Blow from
| > preventing you from preventing him from using your software
| > more than the specified amount of time.
|
| Simple as this, record the date the program was first run. Check for
| negative days (in this case, just go and deny the program to run
| anymore), check for it running past any number of days (deny the
| program to run afterward?). Best way to do this is either:
|
| 1) Put the key into the registry. A tad trickier to defeat such a
| problem, but it can still be defeated by even a weak cracker-jocker
| like me, and some free programs on the web (Sysinternals RegMon).
|
| 1a) If you do put a key into the registry, modify some key that
| _looks_ highly important (Anything regarding Windows/IE* seems
| important to me, no doubt someone was crafty enough to slip
| something like that by me), but it isn't (i.e. delete it, and nothing
| noticable happens). This'd throw me off :)
|
| 2) If you're good with executables, particularly win.com or even
| VxDs, toss into their headers, wherever unused, the date code.
| Deleting any such system file could cause the OS to cease
| function/retire life, and it'd be VERY hard for just anyone to crack
| such a eval deal. (I _might_ be able to do it - again, with a couple of
| free programs, SysInternals FileMon and Hackman, and even VC++
| debug, perhaps)
|
| 3) Put a bug on the HD. With Filemon, its easy to track something
| like this down.
|
| 4) Self-modifying executable. Can't be done in Euphoria, however.
| (So I've heard).
|
| So, any way you do it, you're screwed, it'll be cracked. But when
| you do implement such a deal, be very very crafty about it, and
| remember: It will be cracked. Oh well.
|
| HTH,
|
| --"LEVIATHAN"
|
If you implement a rather large sequence of deeply nested numbers
and based the chosen number on a certain date or maybe time of day
thereby creating self modifying code so to speak
I dont see how anyone could crack it.
8. Re: Get time difference without time()
Nah...
The best way to do it (the way most '2m4rty-422
c0rder2', as Jay Slash Kay would say...), is to
reserve a byte at the end of the program's main
executable, and every day that goes by, you increment
it.
So even if a guy turns back his clock, your app still
knows X days have elapsed.
Who's gonna look at the last byte in an executable
anyways?
You?
Mike The Spike
PS. yeah yeah, I know, I'm good...
--- Kat <gertie at PELL.NET> wrote:
>
>
> On 15 Mar 2001, at 5:40, Ted Fines wrote:
>
>
> > >> Let me guess, You are wanting to do this to
> prevent the
> > >> following scenario:
> > >>
> > >> Joe Blow downloads your shareware
> (time-limited) software.
> > >> Joe Blow sets his computer clock to 5 years
> ahead.
> > >> Joe Blow installs your software.
> > >> Joe Blow sets his computer clock back to normal
> time...
> > >> ... thus defeating your time-limit.
> >
> > As long as we're talking about this...Here's a
> solution:
> > You have a company, supersoftware.com. On your
> server, you run an NTP
> > server, tick.supersoftware.com. Your time-bombed
> software could compare
> > the current date, as reported by your NTP server,
> to the installed date,
> > and act accordingly.
> > Problems:
> > 1) User has to have Internet connection to use
> software
> > 2) Sophisticated user could setup their own
> local NTP server, and spoof
> > yours.
> >
> > The fix for #2 is to access the server using SSL
> with a Verisign-signed
> > certificate. I don't know if NTP can actually be
> tunneled through this, so
> > you might just have to have your program access a
> secure HTTP server, the
> > URL of which simply shows the current date & time.
> I don't see how this
> > could be spoofed...
> >
> > I don't have a fix for #1. You'd just have to
> tell users that they'd have
> > to be connected...
> >
> > Didn't say it was practical (though it seems
> pretty practical if you're
> > talking about millions of dollars in revenue :) ),
> didn't say you'd want to
> > do it. But it seems pretty simple, and workable,
> really. I guess whether
> > #1 is a problem depends on the type of software,
> and client expectations...
>
> Have the server that sent the software hard code the
> current date and the crash date
> into the software in an encoded form, before sending
> it. Then have the software check
> the system date on the puter, and calculate the time
> till crash and/or running time.
> Sooner or later, the crash date will be hit and the
> software will erase itself.
>
> Kat
>
>
>
> http://www.topica.com/lists/Theinsidedeal/
>
>
>
9. Re: Get time difference without time()
Actually, you would need to save which day was the day that you last
counted. If some one were to freeze their time, be resetting it to the very
same date everyday at boot-up, your program wouldn't even count more than
one day.
> Mike The Spike
> PS. yeah yeah, I know, I'm good...
Ralf N.
nieuwen at xs4all.nl
10. Re: Get time difference without time()
I would go so far as to record latest date AND time... if the date/time ever
falls behind the recorded one, WHAMMO!!! Instant Hard drive vaporization!!!!
> Actually, you would need to save which day was the day that you last
> counted. If some one were to freeze their time, be resetting it to the
very
> same date everyday at boot-up, your program wouldn't even count more than
> one day.
