Software protection running in a VM

[admin]

Morantex wrote:

Do VMware VM's have some other unique per-VM "ID" code that we can get at?

The closest thing we have is the "unique identifier," which is a bit of a misnomer.  See http://kb.vmware.com/kb/1541.  In addition to the SMBIOS interface discussed in the KB article, you can generally query this via the backdoor port, unless the isolation settings have been modified to disallow the query.  The attached program is an example of how to do this.

[Morantex]

What happens if I clone a VM following the standard rules for VMware?

Won't I be running umpteen copies of the same copy of Windows?

How does VMware prevent users from running umpteen copies of Windows when they have only paid for (say) one activation?

In other words - whatever is in place to prevent pirating Windows itself, can this be used as a basis for preventing piracy of an app running under an instance of Windows?

It seems from here that cloning gens a new UUID "in" the VM and that when that clone boots (or rather when Windows in that clone boots) the OS "detects" the changed UUID and forces you to re-activate.

So if this is the case then our apps (or rather our licensing logic) could - in theory - use the Windows activation code as the driver for this.

That is when we activate a product we just grab the Windows activation code (product code, that the user used to activate Windows) and associate that with our own activated product license.

Then whenever our app runs it can compare that saved code with the current code associated with the instance of the OS we're running under, if they differ then force user to activate our product.

The idea here is to simply rely on this uniform standard Windows activation key (product code??) and we're covered - whether we're running on a physical OS or virtual OS, the same simple logic can be used and we don't need to fiddle around or worry about constructing a unique ID from MAC address and BIOS UUIDs etc etc.

Of course we need to get the activation code associated with the running OS instance and that's its own challenge it seems...

Thoughts?

Hugh

[NoelC1]

Morantex wrote:

How does VMware prevent users from running umpteen copies of Windows when they have only paid for (say) one activation?

Does it do so at all?  I wasn't aware of that.

I have always guessed that the unique ID thing is tied to the "I copied it" vs. "I moved it" answer, which is why I mentioned it above.

I'm certainly running VMs I've moved from my prior workstations without reactivation.

-Noel

[admin]

Morantex wrote:

How does VMware prevent users from running umpteen copies of Windows when they have only paid for (say) one activation?

As far as I know, we do not attempt to enforce any third-party licensing restrictions except for those that apply to XP-mode nested VMs.

[Morantex]

Hi;

OK I'm researching the mechanism used by Windows for detecting platform changes - it seems that the hardware UUID that it computes (at boot time) and compares to the original UUID (computed and saved at activation time) is defined in Win32_ComputerSystemProduct.UUID a WMI property.

That same UUID also appears to be stored in the registry at HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid.

Like I say, I'm trying to get definitive confirmation that this is indeed the very same UUID used by the OS to detect changes and force a Windows re-activation (like when a VM is cloned).

I'd also like to know exactly what Windows does to compute this UUID but I guess that's intentionally secret or just never explained - I just need to prove that a Windows reactivation will always be forced if this UUID changes and that such a detected UUID change is the ONLY thing that forces a reactivation.

If this is what I hope it is, then we can simply save this UUID at the time our own product is activated and do a comparison of that with the current UUID every time our apps run, if a VM is cloned in this scenario then the user would need to reactivate Windows and then reactivate our product...

Hugh

[Morantex]

Well I'm obviously misunderstanding something.

I just shutdown and copied an entire VM folder for a Server 2012 VM, when I started it it asked me if I moved or copied - I chose copied.

The VM then booted and I logged in.

I now have two VMs running - the MAC addresses for the Ethernet cards are different but the machine name's the same.

The registry: HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid is the same too on each VM.

The cloned VM's copy of Windows appears fine and considers itself to be activated - so I have two copies of the OS running here.

I was expecting the cloned VM to start up and then tell me I had to reactivate (because hardware changed - MAC address) but it hasn't...

The OS incidentally is part of my MSDN subscription and I have so far claimed just one key, the one I used to activate the original, first VM.

What's going on here??

THx

Hugh

[NoelC1]

Most hardware identification / reactivation trigger schemes allow for a small amount of hardware change before triggering a reactivation.  This is to accommodate people who alter their computers - e.g., in the process of improving/replacing components.

With SoftwareKey's package we get to decide how similar the hashed ID is to the original one during activation before it triggers a reactivation.

Keep in mind that if you trigger a reactivation on ANY hardware change, your support costs will be high and customer satisfaction could suffer.

-Noel

[Morantex]

OK I was getting confused and going round in a circle, yes your right a simple change like a single MAC address will not force OS reactivation, that was silly of me.

I'm happy to consider a simple check - here is crude pseudo code:

IF license_is_valid THEN  /* i.e. already activated, not expired trial etc etc */

    IF running_in_a_vmware_vm THEN /* Soraco API supports this question */

        IF current_smbios.uuid != original_uuid THEN /* i.e. the uuid saved from when we did the activation */

            invalidate_license();

            prompt_for_activation_key();

In principle this will reliably trap cloned VMs that have licensed copy of our product installed.

Now the puzzle is how to get (via managed code) the smbios.uuid value for any OS. I've checked and found that the .vmf field (as explained earlier by JMattson) "uuid.bios" is NOT the same as the Win32_ComputerSystemProduct.UUID value found with WMI.

The .vmx file has:

uuid.bios = "56 4d c3 19 84 ec 04 86-1d 31 39 ca 2b cb 8a 55"

and the WMI field is:

Win32_ComputerSystemProduct.UUID = {FAF76B96-798C-11D2-AAD1-006008C78BC7} (Note, numerous other WMI class also contain this identical UUID value - Win32_OperatingSystem, Win32_ComputerSystem, Win32_Bios.....)

So I'm unsure of how to get that smbios value from managed code, it may be some other WMI field, but its not obvious at this stage.

Thanks

Hugh

PS: I had to logout and login in order to get past a constant posting error, was unable to post any replies until I did that.

PS: How does one "quote" another post in this forum?

[WoodyZ]

Morantex wrote: PS: How does one "quote" another post in this forum?

By clicking the Quote icon on the editor's tool bar!

(Click image to enlarge.)

[Morantex]

WoodyZ wrote:

Morantex wrote: PS: How does one "quote" another post in this forum?

By clicking the Quote icon on the editor's tool bar!

(Click image to enlarge.)

OK Thanks - I was looking at the bottom left where the options are "Report Abuse", "Like", "Reply" etc.

Thx

[Morantex]

Morantex wrote:

OK I was getting confused and going round in a circle, yes your right a simple change like a single MAC address will not force OS reactivation, that was silly of me.

I'm happy to consider a simple check - here is crude pseudo code:

IF license_is_valid THEN  /* i.e. already activated, not expired trial etc etc */

    IF running_in_a_vmware_vm THEN /* Soraco API supports this question */

        IF current_smbios.uuid != original_uuid THEN /* i.e. the uuid saved from when we did the activation */

            invalidate_license();

            prompt_for_activation_key();

In principle this will reliably trap cloned VMs that have licensed copy of our product installed.

Now the puzzle is how to get (via managed code) the smbios.uuid value for any OS. I've checked and found that the .vmf field (as explained earlier by JMattson) "uuid.bios" is NOT the same as the Win32_ComputerSystemProduct.UUID value found with WMI.

The .vmx file has:

uuid.bios = "56 4d c3 19 84 ec 04 86-1d 31 39 ca 2b cb 8a 55"

and the WMI field is:

Win32_ComputerSystemProduct.UUID = {FAF76B96-798C-11D2-AAD1-006008C78BC7} (Note, numerous other WMI class also contain this identical UUID value - Win32_OperatingSystem, Win32_ComputerSystem, Win32_Bios.....)

So I'm unsure of how to get that smbios value from managed code, it may be some other WMI field, but its not obvious at this stage.

Thanks

Hugh

PS: I had to logout and login in order to get past a constant posting error, was unable to post any replies until I did that.

PS: How does one "quote" another post in this forum?

OK disregard some this - I was looking at a different UUID exposed in the wbemtest.exe tool I'm using to see the WMI data, those other classes don't have a UUID at all.

Also the UUID in Win32_ComputerSystemProduct is empty, a null string - this is the case for the VMs I'm looking at and for the physical host (a very very powerful i7-3960X desktop).

All very odd....

[WoodyZ]

BTW... There are additional controls, as shown in the image below, if you choose "Use advanced editor" in the upper right corner of the normal editor window.

(Click image to enlarge.)

[admin]

This may be helpful: http://blogs.technet.com/b/aaronczechowski/archive/2012/01/04/using-smbios-guid-for-importing-comput....  It discusses differences in the way Windows and VMware represent the UUID.  I haven't actually tried the conversion script.

[Morantex]

jmattson wrote:

This may be helpful: http://blogs.technet.com/b/aaronczechowski/archive/2012/01/04/using-smbios-guid-for-importing-comput....  It discusses differences in the way Windows and VMware represent the UUID.  I haven't actually tried the conversion script.

OK Looking good.

I wrote some simple code and I can get and see the UUID from WMI - it looks fine (its format/ordering differs a bit from SMBIOS but that's unimportant).

I can use and store this WMI UUID as-is now and apply the simple algorithm I outlined above.

Doing this test specifically when running in a VMware VM and trapping changes to UUID is probably enough for my immediate needs.

Thanks to all of ya.

Hugh

PS: Does anyone know off-hand if other virtualization options also do a similar thing when cloning/creating a VM? by which I mean is this system UUID set/altered as it is when doing this through VMware?

Thanks