0

I have create a web application which I want to sell to various clients with the source code. This application contains a DLL created by me having various methods outof which there is a method named ValidateLicenceKey(). I want this method to be called by each page for valid licence. To do this there are various ways ( as far as i know )-

  1. Create a BaseClass and call ValidateLicenceKey() method in baseclass and inherite this class on each page so that this method will be called on each page request.
  2. Call ValidateLicenceKey() method in Application_Start/Session_Start event of Global.asax file so that even if page is not inherited from Baseclass, this method will be called.
  3. Use of HttpModule and Call ValidateLicenceKey() method there and define that in web.config file

I am giving client the flexibility to add new pages/controls in the application as well as he can edit the existing code as per his requirement.

Now my question is- Since the client has the source code with DLL he can disable ValidateLicenceKey functionality by

  1. Removing the Baseclass inheritance from all the existing pages as well as do not implement Baseclass inheritance in the new pages created by him.
  2. Commenting the line that calls ValidateLicenceKey() method in Global.asax file.
  3. Commenting the line in web.config file that defines httpmodule

So how do i force them to call this method.

Is their any way to solve this? Please help.

Rowland Shaw
  • 37,700
  • 14
  • 97
  • 166
Amit
  • 194
  • 1
  • 6
  • 4
    If they've got the source, the only effective measures are legal, not code based. Various attempts are made to enforce licensing through code, and generally just end up annoying legitimate, licensed users. – Damien_The_Unbeliever Sep 07 '11 at 11:22
  • Oh, and in addition to your listed circumvention methods, they could decompile the DLL, make `ValidateLicenceKey` always return true, and recompile it, then used this modified version of the DLL instead. – Damien_The_Unbeliever Sep 07 '11 at 13:46

1 Answers1

0

I'll add another method: putting a static constructor in your class. So if your class is called, the static constructor will always be called before. In the static initializer you put your code.

class MyClass
{
    static MyClass()
    {
       if (!ValidateLicenceKey())
       {
           throw new Exception("Invalid License");
       }
    }
}

Clearly this won't protect you by source code tampering.

xanatos
  • 109,618
  • 12
  • 197
  • 280
  • Actually if licence key is invalid for the client by validating from ValidateLicenceKey() method then the application should not work/ display "Invalid licence key". The basic problem is that If we give the published code to various clients then it will be difficult for us to give them support or some sort of modification in the code as per client to client. In this case we have to maintain several versions of code per client basis so that we do the change in the respective client code, publish and upload on respective clients server. – Amit Sep 07 '11 at 11:40
  • @Amit modified the code to be clearer. If a `static constructor` throw an exception, the class can't be used anymore in the current execution of the program (read here http://stackoverflow.com/questions/4737875/exception-in-static-constructor) – xanatos Sep 07 '11 at 11:46
  • we have splitted the application into 2 parts - one the compiled DLL form containing the core business logic as well as the validationLicenceKey() method and the 2 part containing the source code and this part uses the DLLs generated from the first part. But this where i have problem i.e. if user removes the references from the second application then? – Amit Sep 07 '11 at 11:49
  • @Amit ANY first access to the class having the static constructor will trigger the static constructor. You don't have to call it anywhere. It's the .net that calls it. – xanatos Sep 07 '11 at 11:54
  • how to call this static constructor on each page request – Amit Sep 07 '11 at 12:02
  • @Amit Perhaps I wasn't clear. "**ANY first access to the class**" The **first** time you do **anywhere** in the code `new MyClass()` or you try to access its static properties, the static constructor is called. If it throws the class is unusable. Clearly if they don't use your classes, the static constructor won't be triggered, but then there isn't any problem. – xanatos Sep 07 '11 at 12:04
  • since the client has the source code he can comment the call of my class that contains the static constructor. We want this to be called on the page request – Amit Sep 07 '11 at 12:08
  • @Amit You have n classes in your business logic dll. Make each of them use `MyClass`. The first time any business logic class/method is used the key is tested. – xanatos Sep 07 '11 at 12:12