Serial Number as Password

[duanef]

I'm evaluating InstallAware to replace my current Wise Installation System version 9.

In the installation expert, under Password, there is the ability to create a list of individual serial numbers that can be used as installation passwords.

How would I do this in InstallAware?

BTW, I use Kagi for online sales. Thanks! - Duane

[CandiceJones]

InstallAware lets you create unique serial numbers for each individual customers - see the Serial Validation sample for an example of getting this going - instead of a pre-defined, predictable list.

The project level password setting is for a global password only and is not intended for use as a serial mechanism.

[duanef]

I sell primarily to corporations, who purchase several units (serial numbers) at one time. One person may install my software on several computers.

How would this work? - Duane

[CandiceJones]

It depends on what you want to do. The Serial Validation is just a sample that illustrates what you can do with the powerful InstallAware MSIcode. Where you actually go with that is up to you.

[duanef]

So, you don't have a good example of generating a list of codes ahead of time?

CodeGear uses InstallAware for Delphi 2007. When you get the DVD, there is a Serial Number stamped inside. So, I have a serial number before I register the product or anything.

They must be creating a big list and storing it somehow within the installation, correct? That is essentially what I would like to do.

Any help would be appreciated... Thanks! - Duane

[CandiceJones]

Like you confirm, InstallAware provides the tools which let you do that. We just don't have a pre-built sample for it. Our pre-built sample is more versatile in that each user is given a unique key, but if that is actually less useful for your case, take a look at it and customize it.

[stevep]

Attached is a screen shot of some code I wrote that can give you exactly the same results as Wise Installer does.

The question is can a compiled InstallAware EXE be opened or decompiled to where someone could read this code and figure out your serial number from it?

File Attached:

2007.04.24_16.12.51.PM.png

[Gizm0]

Attached is a screen shot of some code I wrote that can give you exactly the same results as Wise Installer does.

The question is can a compiled InstallAware EXE be opened or decompiled to where someone could read this code and figure out your serial number from it?

File Attached:

<a>2007.04.24_16.12.51.PM.png

Yes it is a possibility, if someone knows how to read assembly code to be able to find the algorithm behind the serial verification and produce a tool that creates only valid serials. It will be nicer, to create and online authentication service and pass your serial there. Although this is not also completely bulletproof, it's far more better that your current solution.

[duanef]

The code snippet is not exactly like what Wise does, but it's close. Wise will skip numbers and sort of randomize a list. But no matter...

What I had assumed that I could do, based on the Delphi 2007 install, was have a fixed list of long string serial numbers that were all random. Delphi 2007 has a 20 digit string of letters and numbers as a pre-determined serial number.

Our software is pre-registered, meaning we either sell it directly to the end user or we ask for end user information from the reseller up front. If they buy from Kagi or directly from us, a serial number is handed out to the customer per unit purchased. Physical shipments include a serial number in the package.

We do not use the internet for registration or validation or anything like that, because many of our customers are installing software on computers that are not on the internet (mission-critical, fixed purpose). We have to give the customer a complete EXE, then they use the assigned serial number as an installation password (today, using Wise).

So, Codegear did this somehow, does anyone know how they did it?

[CandiceJones]

You can call a DLL, build a custom plug-in, or implement your serial validation in MSIcode, as I have already described.

If you are looking at the strongest security standpoint, build a plug-in or an external DLL. To add even more security, call a webpage to authenticate users live. We have another pre-built sample for that.