[thelist] Need to add a serial number system to my ASP script.

Ken Schaefer ken.schaefer at gmail.com
Sun Sep 12 06:45:08 CDT 2004


Hi,

Are you still trying to protect your "source code"? If so, instead of
thinking up schemes yourself, I suggest you use attempt to implement
tried and tested systems.

However, the ultimate stumbling block you will run into is that your
application is running on a system that you yourself do not control.
In this case, it means that the user can attach a debugger to your
code (eg the one is Visual Studio) and step through each line of your
ASP code as it executes, and find the place where the code looks up
the serial number. The user can then:
a) comment out that line of code
   -or-
b) determine what a valid serial number is (based on your verification
logic), and simply supply it.
 
Now, in the real world, you get around (b) by using asymmetric key
encryption. You encrypt a config file (eg containing the the server's
IP address) using your private key, and the application decrypts that
with a public key, and verifies it. Since only you have the private
key, only you can generate valid encrypted config files.

However, this generally requires that you have some kind of compiled
code - plain text ASP code can be subverted trivially (by using (a)
above)

Cheers
Ken


On Sun, 12 Sep 2004 15:43:38 +0930, Craig <cd-ml at aardvark.net.au> wrote:
> Hi all,
> 
> I need some help with something I know nothing about.  I have a ASP script that I want to use a serial number to make the script run.
> 
> Something like this.  The user downloads my ASP script.  I give the user a "serial number" that the user can enter into the ASP file, and is then able to run that ASP file.  without the serial, it won't run.
> 
> Do you have any links regarding serial numbers for ASP files?
> 
> Any thoughts or help is appreciated,
> 
> Thanks,
> Craig.


More information about the thelist mailing list