Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do software companies know if the serial number entered to use their software is a valid one or one created by a keygen?

Assume the keygen is generating a license number that can be entered into their program. The key will be accepted and gives the user full access to their software. After that, will they know the user is using an illegally licensed copy of their software?

share|improve this question

closed as not a real question by surfasb, Not Kyle stop stalking me, BBlake, slhck, Dave M Nov 17 '11 at 19:00

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Depends on the software. Is there a particular licensing question here? I'm not sure if we can discuss illegal tools. Perhaps you should reword your question to something specifically about licensing. – surfasb Nov 17 '11 at 17:52
@closevoters See this meta post. It's allowed to discuss DRM here. – AndrejaKo Nov 17 '11 at 18:40
up vote 4 down vote accepted

The most common way is to have the program enforce only part of the actual license algorithm. For example, say the license looks like this: UUUU-VVVV-WWWW-XXXX-YYYY-ZZZZ. The license algorithm might require the YYYY-ZZZZ part to have a particular structure. But as far as the program is concerned, any UUUU-VVVV-WWWW-XXXX part is permitted.

However, the manufacturer might choose the serial numbers in a testable way. For example,UUUU might identify the reseller, version, or product ID. VVVV-WWWW might be sequential to issue multiple licenses. But the XXXX part may be based on a secure hash of the UUUU-VVVV-WWWW part.

Since the secure hash is not implemented in the program or tested by it, it can be kept completely secret. All legitimate keys will have the correct secure hash, but keys with an invalid secure hash but a correct YYYY-ZZZZ part will work in the software, but must have been generated by a key generator.

Typically, the program will embed part of its key in things. In this example, likely the UUUU-VVVV-WWWW-XXXX-YYY part. This is enough to tell whose license it is (if it was legitimate) and whether it was generated by a keygen, but not enough to use the license to run the software.

share|improve this answer
If the program cannot find out about the use of a keygen then, how do software companies find out about its use? Either I don't understand your answer, or you didn't answer the question completely. – Daniel Beck Nov 17 '11 at 19:34
The software companies verify the XXXX part. The logic to do this is not contained in any software they ship to the user. See my last paragraph. – David Schwartz Nov 17 '11 at 20:23
So by having the software call home? That aspect isn't clear — where does it embed the key? – Daniel Beck Nov 17 '11 at 20:24
@DanielBeck That depends on the application. It may be in DNS queries it makes. It may be in documents it creates. – David Schwartz Nov 17 '11 at 20:26

Usually by spying on you. Today many companies expect users to have active Internet connection at all times. Usually software will try to automatically update itself or check for updates and notify user. At that time, it may also send it's serial number or whatever type of identification it uses to the main server and the server will notify the software if the number is made by a known keygen or if it's in use by several other computers and so on. Sometimes software may connect to Internet only to check if it's legit or not.

In some cases software installers themselves may connect to the Internet in order to get the latest patches and serial blacklists. In that case a race starts between groups who believe in (possibly) illegal sharing of software with their neighbors who usually try to make fresh keygens and software developers who usually try to determine how the keygens create the number itself and give their best to add all numbers possibly generated by the keygen to the blacklist.

Sometimes software may include blacklists o serial numbers in patches. Some software developers may try to incite users to have active internet connection or to download patches. For example many games often have patches that will bring various improvements or they may have additional downloadable content that may be accesses only with valid serial number by using in-game downloader.

Some more "serious" software may have additional features that only work with Internet connection. For example Mathematica 8 can use Wolfram|Alpha to do some calculations or to recognize natural language input. Software is usable without those extra features but user doesn't have the full experience.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.