Question

I’m making a Flash program to be downloadable and unlockable on one computer on receipt of payment. To do this, I was looking to create a UUID for a computer which could be checked to make sure that the program has not been moved to another computer but I don’t know of any way to access enough information about the computer to make it uniquely identifiable (or even close).

I have also considered having a separate program written in a different language which would have access to this information but I don’t know if I can even run it from Flash.

Any ideas or alternative solutions to the original problem would be greatly appreciated.

Answer 1

You can make a small external EXE (In AIR) that will run a native command and retrieve specific info about the persons computer. See my answer here for source code:

How can i on button press execute a command in the command prompt and get back the output in ActionScript?

So for example, on windows you can write an exe in C++ (use eclipse and mingw not microsoft C++ unless you wanna have to redistribute .net with your exe). Just use the System command:

#include <iostream>
#include <stdio.h>
#include <stdlib.h>

using namespace std;

int main() {
    std::cout << system("wmic csproduct") << std::endl;
    return 0;
}

That outputs this:

Caption                  Description              IdentifyingNumber  Name  SKUNumber  UUID                                  Vendor  Version  

Computer System Product  Computer System Product  OEM                OEM              00000000-0000-0000-0807-XXXXXXXXXX(Hidden cause it's mine :D)  OEM     OEM                   0

According to microsoft this command returns a S/N unique to the local machine. If that’s not satisfactory, you can always get one of the computers partition serial number, you’ll just have to google around for that.

Anyway regardless of what you use, just make it so that when the user first registers it takes this info, processes it into a digest using a the AS3CoreLib crypto package (maybe use the SHA256 class to convert to hash) and then send that data to the server along with their registration info. Whenever they launch the app just get the app to connect to the server and re-run this command, comparing the new hash (at launch) against the saved one on the server and if they don’t match you know they’ve moved it onto another computer or given it away to be pirated.

Sources:

http://support.microsoft.com/kb/558124

http://www.cplusplus.com/reference/clibrary/cstdlib/system/

https://github.com/mikechambers/as3corelib/tree/master/src/com/adobe/crypto