Jump to content
@~thehung

How does uninstalled then reinstalled software know that my trial period has expired?

Recommended Posts

As per the title. I've long wondered about this.

 

Rootkits? Anonymous cache data stuffed into some forgotten corner of your computer?

 

Back in the day you could just adjust your clock to fool an application that your demo time had not yet expired.

 

Increasingly that wouldn't work, and you would have to uninstall and reinstall the application in order for a countdown to begin anew.

 

Pretty soon the latter would only work if first you manually eradicated all mention of the software from Window's registry.

 

Nowadays, it seems even the smallest independent developer is capable of writing apps that stick themselves in there for good. They have every right to protect their interests from the plundering of cheap bastards — and good luck to them in that endeavour. But the method...

 

I cant help taking offence at the idea of software taking liberties in this way — storing unknown data on my computer with the explicit intention that it remain undetectable and nigh impossible to remove. If an uninstall link is provided upon install, I should be able to take it on good faith that the thing will wipe all the damned data it has previously written.

 

Now, if I want to be a cheap bastard with the next 500kB shareware LAN chess game with a 10-day trial I download, I can always run it Sandboxed, or within a VM. But I just really want to know, how is this kind of protection achieved? Is there any level of sophistication to it, or do I just not know some really obvious stuff about Windows (XP)?

Share this post


Link to post
Share on other sites

Generally there is a registry entry written by said program that doesn't get deleted when the program is uninstalled.

As far as I know. This.

Share this post


Link to post
Share on other sites

Generally there is a registry entry written by said program that doesn't get deleted when the program is uninstalled.

As far as I know. This.

 

Would work as long as there was no way to associate the entry with the software in question. As the OP mentioned, he took to deleting all registry keys.

 

I've no idea how it works. I guess a they buy 3rd party copy protection stuff. I would.

 

You could take a snapshot of the registry prior to install. Install and uninstall. compare state of registry with snapshot.

Share this post


Link to post
Share on other sites

I know of one application that writes a code into the some unused space at the front of the hard disk

Flex LM is the licencing system that does this

Edited by clockworkman

Share this post


Link to post
Share on other sites

I must say… people are surprised by this? There wouldn't be much point in having the trial period there if the application could just be re-installed to reset it.

 

Then again, some applications (Paint Shop Pro 4 comes to mind) take a long time to work out they're not supposed to be working. (PSP4 has been known to run over 700 days before it finally realises, "Whoopsie, my trial period is over".)

Share this post


Link to post
Share on other sites

You could take a snapshot of the registry prior to install. Install and uninstall. compare state of registry with snapshot.

A better way is by using something like Process Monitor or Regmon, and watch what keys the application queries.

Share this post


Link to post
Share on other sites

Just reinstall windows every 30 days, hahaha.

 

Basic idea is when you uninstall the program, whatever copy protection files/reg keys were installed are simply left there. Quite often these are in folders with names that have nothing to do with the original program. The true smart programmers write a date somewhere into the installer itself, on the web server or as part of the software update cycle.

 

I love the ones where you just set to date back and it works again, not all programmers know how to write this sort of code.

Share this post


Link to post
Share on other sites

I must say… people are surprised by this? There wouldn't be much point in having the trial period there if the application could just be re-installed to reset it.

 

Then again, some applications (Paint Shop Pro 4 comes to mind) take a long time to work out they're not supposed to be working. (PSP4 has been known to run over 700 days before it finally realises, "Whoopsie, my trial period is over".)

I had a demo of psp 7 that never expired. It was fantastic!

 

-X

Share this post


Link to post
Share on other sites

Trouble with setting the date back is it breaks things.

 

Emails are sent with the wrong date and are rejected (my server rejects emails that are older than 2 weeks or newer than 2 days), and cryptography certificates stop working because they're outside their validity range.

 

So no, not a solution.

Share this post


Link to post
Share on other sites

You could take a snapshot of the registry prior to install. Install and uninstall. compare state of registry with snapshot.

A better way is by using something like Process Monitor or Regmon, and watch what keys the application queries.

 

interesting.

 

I know of one application that writes a code into the some unused space at the front of the hard disk

Flex LM is the licencing system that does this

ah ha! thats the sort of thing i'm talking about.

 

I must say… people are surprised by this?

why must you? who has expressed surprise?

 

:)

Share this post


Link to post
Share on other sites

You could just build a virtual box, back it up, install your trial software on there, 30 days later use the backup and reinstall.

 

I do exactly that, but not really for trial software, for software testing purposes.

 

XP Mode is pretty convenient for this sort of thing and you don't need another Windows license.

 

As Squall said, you could also use Process Monitor, (just grab the whole SysInternals Suite): http://technet.microsoft.com/en-us/sysinternals/bb842062

 

I use it when pretty much all other troubleshooting options fail.

Edited by Periander

Share this post


Link to post
Share on other sites

You could take a snapshot of the registry prior to install. Install and uninstall. compare state of registry with snapshot.

A better way is by using something like Process Monitor or Regmon, and watch what keys the application queries.

 

I'm not convinced this is a better way, but it certainly is a good alternative.

Share this post


Link to post
Share on other sites

I think all the recent versions of Adobe Acrobat (6.0 or higher) to do this enforce their Nazi license checking.

Share this post


Link to post
Share on other sites

Lots of ways to hide a file somewhere in your install that can be read back to determine the original install time. The other tool to look at is filemon to determine what files the application opens.

 

Of course you could just buy the piece of software.

Share this post


Link to post
Share on other sites

If you knew a SOE systems engineer (like me) you could fire up Flexera Adminstudio and kickoff installation monitoring and it will show EVERYTHING that is going to happen during the install when you analyze the package.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×