Registration plug-in: Difference between revisions

From NSIS Wiki
Jump to navigationJump to search
No edit summary
 
(12 intermediate revisions by 5 users not shown)
Line 2: Line 2:


== Description ==
== Description ==
The Lazarus Registration components lets you add a serial number/registration key dialog to your script. Downloadable from [http://www.lazarusid.com/registration.shtml www.lazarusid.com].
The Lazarus Registration components lets you add a serial number/registration key dialog to your script. Downloadable from [http://www.lazarusid.com/registration.shtml www.lazarusid.com]. (NOTE: This plug-in is not free)


Version 2 of this package was released on November 3, 2005 as open source softwareA commercial version is also available which provides greater security and resistance to decompilers who go looking for your registration code.
'''Version 2.3''' was released on December 8th, 2007This version features an improved custom serial screen for your installer, the ability to generate custom libraries from the desktop registration tool, and installer templates that give you a polished script right out the gate.  Full details available at [http://www.lazarusid.com/registration-release-v2.3.1.html Version 2.3 Release].


'''Version 2.2''' of the Lazarus Registration Plugin was released on July 15th, 2007.  Version 2.2 features serial number generation and decoding routines.  The enhanced graphical registration program now logs serial numbers that are registered.  An improved packing of the demo version now clearly identifies itself as a demo, to avoid accidentally using the demo version of the plugin when you meant to use the production version.


----
'''Version 2.1''' of this plugin was released on March 10, 2007.  The new version includes a graphical client for generating registration keys and stdcall wrappers around all DLL functions so that it may be used from languages that don't understand the cdecl calling convention used by NSIS.  Special thanks to '''Michel Danjou''' for helping me test the library against Visual Basic.


Serious vulnerability of installer, created by Clay:
'''Version 2''' of this package was released on November 3, 2005 as open source software. A commercial version is also available which provides greater security and resistance to decompilers who go looking for your registration code.
user can bypass registration code input by launching silent install
example:
download http://www.lazarusid.com/download/Registration-Commercial-2.0.2.exe
and launch it with silent install command line switch: /S
you'll get full version.
I'm currently investigating code generation/validation, but as I can see, there is no encryption or strong cryptography, so Clay's method is very weak.
In fact, the better way is to use user password as decryption key for packed data.
--[[User:GAG|GAG [Jaguar]]] 05:19, 22 December 2005 (PST)


Although I'm not happy that my installer has a vulnerability, I am glad to see that somebody was good enough to point out the one that I did have.  As an immediate stop-gap solution to get around the silent installer problem, dropping the following code into the .onInit function might do the trick:
-----


    Function .onInit
Some viewers have pointed out that there is a "flaw" in this component that fails to encrypt the included package. This is not a flaw, but a limitation of the free version.  The registered version is designed so that the program itself must also check the registration code.  This prevents one user from installing the program and simply copying the binaries to another machine, and allows for the distribution of "feature-reduced" copies that change their behavior depending on whether or not the registration code is present. 
   
 
      IfSilent nosilent safetoproceed
For instance, simply by using the silent installer option you can get the full commercial version of the registration component, without entering a serial number or key.  Without the serial number and key though you won't get the features of the commercial program, but the more limited features of the free version.
   
 
    safetoproceed:
Instructions are included with the package to help you add these features to your program. 
      Return;
   
    nosilent:
      Quit;
   
    FunctionEnd;


This hack is completely untested and should be taken with a grain of salt.  I need to look further into GAG's suggestion of encrypting the payload and will post an update here when I get something useful.
--[[User:clay|Clay Dowling]]
--[[User:clay|Clay Dowling]]


http://www.lazarusid.com/images/registration-screenshot.jpg
== Screen Shots ==
 
=== Installer Screen ===
http://www.lazarusid.com/files/images/serialno-screenshot.png
 
=== Registration Tool ===
http://www.lazarusid.com/files/images/register-screenshot.png


[[Category:Plugins]]
[[Category:Plugins]]

Latest revision as of 03:22, 15 June 2008

Author: clay (talk, contrib)


Description

The Lazarus Registration components lets you add a serial number/registration key dialog to your script. Downloadable from www.lazarusid.com. (NOTE: This plug-in is not free)

Version 2.3 was released on December 8th, 2007. This version features an improved custom serial screen for your installer, the ability to generate custom libraries from the desktop registration tool, and installer templates that give you a polished script right out the gate. Full details available at Version 2.3 Release.

Version 2.2 of the Lazarus Registration Plugin was released on July 15th, 2007. Version 2.2 features serial number generation and decoding routines. The enhanced graphical registration program now logs serial numbers that are registered. An improved packing of the demo version now clearly identifies itself as a demo, to avoid accidentally using the demo version of the plugin when you meant to use the production version.

Version 2.1 of this plugin was released on March 10, 2007. The new version includes a graphical client for generating registration keys and stdcall wrappers around all DLL functions so that it may be used from languages that don't understand the cdecl calling convention used by NSIS. Special thanks to Michel Danjou for helping me test the library against Visual Basic.

Version 2 of this package was released on November 3, 2005 as open source software. A commercial version is also available which provides greater security and resistance to decompilers who go looking for your registration code.


Some viewers have pointed out that there is a "flaw" in this component that fails to encrypt the included package. This is not a flaw, but a limitation of the free version. The registered version is designed so that the program itself must also check the registration code. This prevents one user from installing the program and simply copying the binaries to another machine, and allows for the distribution of "feature-reduced" copies that change their behavior depending on whether or not the registration code is present.

For instance, simply by using the silent installer option you can get the full commercial version of the registration component, without entering a serial number or key. Without the serial number and key though you won't get the features of the commercial program, but the more limited features of the free version.

Instructions are included with the package to help you add these features to your program.

--Clay Dowling

Screen Shots

Installer Screen

serialno-screenshot.png

Registration Tool

register-screenshot.png