Hi to all,

does somebody know how to read the serial number of an USB-Memorystick
(Flash-memory). This serial is told to be unique and can not be altered
after been written (along with the VID, PID etc) by the
stick-manufacturer to the stick's USB-controller .

Hello,

a few months ago I asked the same question, but I got the answer, that
this is not possible, since the USB keys do not have unique serial
number.

The reason why I was asking this is that I would like to protect my
software (basically a tool for the management of other programs) with
the serial number of users USB key - I would like to prevent copy
protection. I am not charging for this program, but this is a
dangerous tool if it falls into wrong hands. What is your reason?

SK

On Thu, 02 Feb 2006 03:01:27 +0100, Ulrich Korndoerfer
<ulrich_wants_nospam@prosource.de> wrote:

Show quoteHide quote

Hi,

SK schrieb:
It depends. Officially all USB devices which can be accessed as mass
storage device (acting as mass storage USB class) have to have an unique
id (see sub specs and window specs). This id is used to differentiate
between otherwise identical devices (say you have two sticks from the
same mfg, same product series) attached.

Now it may be that some manufacturers ignore this requirement. Which
would do no harm as long only one of their devices is plugged in. But I
don't care about those. I just select a mf who provides unique ids (just
a matter of buying some and test them).

I want to have a hardware token to which the software's registration is
bound to. Everyone who has the token can register (anonymously) the
software. No token, no registration. No registration, no running
software. After registration the software runs without needing the token
again.

On this behalf I am searching for either a client side user mode driver
which communicates with the (windows standard) kernel mode usb mass
storage class device driver (usbstor.sys I think) and gives me the
serial id by just calling one function (hiding the complexity of calling
the kernel mode driver by windows api). Or, if such user mode driver is
not available, how to get the id using the windows user mode apis in direct.

Btw, there are plenty of other ways for getting a hardware token.

Readily available including client side user mode driver software are
smart cards and their companion card readers (USB too). There are
versions of smart cards which can be programmed in Basic and can do eg
encryption inside the card. So one could add extra security when it
comes to authenticate the card. Costs are about 1-2$ for the smart card
and about 20-25$ for the reader.

Even the use of a ready made USB-serial converter (including its cable
and plugs) could be used as long as the devices use a eg FTDI252R chip.
Price is about 20$ or may be lower. For this chip the chip vendor gives
away a client side user mode driver.

Or just use one of the commercially available so called dongles. Price
is 20$ or lower.

Or build your own one. Basically a FTDI252R chip suffices. Make a small
pcb (the chip does not need any extra elements) and solder the chip and
a USB-plug on it. Chip costs ~3$, plug and pcb are about 1$. OK, add an
other 1$ for the housing and you end up with 5$.

Or buy a U3 smart USB stick. From the U3 org there is a client side user
mode driver available which allows to read the serial (U3 must have
unique serials too and in this case mfs must do it as otherwise they do
not get the U3 logo and could not sell their devices under this logo)
and much more (as securely writing data to hidden device memory and
reading it back). Principally those U3 variants of USB mem sticks are
not much more expensive than their simple counterparts. But as U3 sticks
are used to hold masses of big application software they usually have
high mem caps (0.5 GB and more). So their cost is about 40$ and above.
This will change in the near future (as flash chip prices will go down
and perhaps U3 sticks with lower mem cap will come to the market). But
as I do not need masses of mem (for me 1 MB or below would suffice), I
would rather avoid buying high mem cap sticks.

For me and my purposes all above solutions have one or two drawbacks.
For eg. building them myself the amount needed is to high. Also german
laws impose complicated and expensive duties to the mfs of electronic
devices.

Then there is the price. A simple USB stick of low mem cap (say 64 MB)
at this time is the cheapest of all (10$ and less). So I will stick to
the stick solution :-).

On Thu, 02 Feb 2006 07:27:08 +0100, Ulrich Korndoerfer
<ulrich_wants_nospam@prosource.de> wrote:

<snip>

<snip>

That was very interesting

You want a 'one time' dongle that you can physically distribute
- presumably the registration will involve some call back to momma to
make sure that the 'dongle' is not passed around

Will your users have floppy drives ?

If so you could use the old pin (or cigarette) trick to stuff a sector
on the floppy, then record the stuffed sector somehere at the base of
the floppy
- you would then check the sector using the Win equivalent of Int 25

You could possibly do something similar with a CD although it would be
a bit more tricky.  Incidentally you can get CDs that are cut down to
about the size of a credit card, a friend of mine got a batch some
years ago - from Sono Press (a German company)

I think he had them custom stamped, but someone is bound to supply
them nowadays.

A major problem I've found with memory sticks is that the
manufacturers discontinue the model - very annoying.

J.

Showing your age, most PCs now ship with no floppy drive. I can't actually
remember the last time I used a floppy, I swapped mine out for a USB/1394
breakout box ages ago, and my laptop only has one in the docking station, my
work laptop doesn't even have one there!

If a one-off registration process is needed, then an emailed code that only
works for a few days should be quite adequate and much cheaper.

For a similar problem I hash coded the date in different formats then did a
bit more mucking about to create a unique 16 character code. When the user
enters a code the program performs the same for that date and the preceding
6 days, if any of the seven results match the entered code then it is within
the 7 day window and thus valid. I use this as an emergency access code to
allow users to create a new administrator or to change the administrator
password on my application in case their administrator leaves or forgets
their password.

Dave O.


Show quoteHide quote

I remember 8" floppies  <g>

I'm not surprized about laptops, but I am surprized about
non-portables

That is a good idea
A sneaky user might twig, and of course they could pass the access
code around like crazy within a day
- but it is a simple solution

I ran into a problem where companies were worried that staff would
pinch the system and give it to their competitors
- the floppy trick worked quite well for that

Dave wrote:
I routinely flatten new machines on arrival, and clean install the OS of
choice.  Woe be the guy who orders a RAID setup (or any other non-customary
controller) but scrimps to save $7 on a floppy drive!

<g>
I'd glady pay more for decent quality, but seems they're all junk
anymore. I've lost track of how many I've had fail in about a year
even when rarely used.


-Tom
MVP - Visual Basic
(please post replies to the newsgroup)

Strangely, the only floppy drive I have that still works is the one that I
got with my old 486, lol (still goin' strong it is too). All the others have
lasted a max of 2-3 years before dying.

On Thu, 2 Feb 2006 19:28:16 -0000, "Steven Burn"
<somewhere@in-time.invalid> wrote:

Yup. "They don't make 'em like they used to" seems to apply here :-)

Another plausible explanation I've seen is with removable media drives
air (along with whatever is in it) gets pulled through the media slot
and eventually gunks up the innards regardless if it's used or not.
Newer systems invariably need large amounts of cooling air and the
drive chasis are not airtight. The recommendation was to seal up the
back side of the drive as best you can to minimize the leakage and
contamination. I'm not going to pull one out to test the theory, but
it might be worth a few minutes next time I replace one.


-Tom
MVP - Visual Basic
(please post replies to the newsgroup)

Show quote Hide quote imo, another reason floppies "just ain't the same" is.... there's no profit
for companies making them any more. Blank CDs are about the same price as
blank floppies.

Hi,

J French wrote:

Show quoteHide quoteNot a one time token. The token is sold with the software. When the
software is installed on a pc and shall be licensed, in this moment the
token is needed. Anyone who owns the token is authorized to license the
software. There is no need for the token *owner* to authenticate
himself. So no calls to momma ;-). Licensing is completely anonymous.
The data stored on the token for each licensing act are some of the pc's
data and the licensing date. But as the owner holds the token, those
data stay private.

After licensing the software can be used on the pc it was installed when
licensed. The software needs to be licensed only once. A then licensed
software runs without needing the token again. Anyone then can use the
software on the pc it was installed when licensed.

Licensing enables the software to run and binds it to the pc it is
running on. Licensing is necessary when the software is newly installed
on a pc or when the hardware of the pc it runs on has changed
significantly. In this case the software stops running and requires
licensing again (for which one then needs the token again).

The token counts the number of licensing acts and allows a maximum
number of licensing acts only (say 5). When the maximum number of
licensing acts is reached, no further licensing act is possible.

The written license (the legalese stuff) authorizes the owner of the
token to install and use 1 or 2 copies of the software on 1 or two
computers. If two copies are installed, they must not be used in
parallel. The extra amount of licensing acts available allows the owner
of the token to relicense the software after a hardware change.

I think this method of licensing is a fair balance and least intrusive
or bothering to the user.

Benefits for the software manufacturer:

The software manufacturer has little work with it. No Website for
registration, no licensing web server, no emergency calls to the
manufacturer middle in the night when hardware has changed and
relicensing is necessary. No database tracking the given licenses. No
verification of registration data (are the data of the one who wants to
register real or a fake, is it a real name of a real person, is it
really this person or had he choosen the personal data of a neighbour
and so on). Regarding registration there is no more work to be done
after the software has been sold.

Illegal spread or use of the software is confined to a number of 3.

However, as the user is told that he has at max 5 licensing acts, he
will think twice wether he gives away licensing acts to "friends" or
licenses in parallel on 5 pcs of his own. Eg if he uses one license
himself and gives away four (which is illegal), he will not be able to
use the software when his pc's hardware has changed. Or he has licensed
in parallel 5 copies on different pc's of his own (which is illegal
again), he will not be able to use the software on one of its pcs when
hardware has changed.

On the otherside, if he uses one copy of the software a time, in
accordance with the written license, he can change hardware up to 4
times. As minor hardware changes to not call for relicensing, he can use
the software for 5 computer generations. This are say 5 * 4 = 20 years,
assuming he uses a computer for four years!

So this licensing model basically awards the honest owner and punishes
the dishonest one. And the dishonest user punishes himself :-)

Of course this number of maximum licensing acts is discussable. May be
6,7 would be fairer to the user without compromising the mf benefits too
much.

Benefits for customers are:

User can reinstall at any time. So changing hardware is no problem. He
is not forced to activate a software by giving away personal data. No
fear that during registration any kind of data from or about his pc is
transferred. No clumsy registration acts by phone, web server or the
like. Just attach the token and the software will do the licensing.

Ok, and when the customer used up his number of licensing acts, he can
demand for a new token, then charged with a reasonable fee. But then he
has to give away his personal data, like his adress to which the token
shall be send to. And he has to send the used token in prior to me. And
this token has to be intact and not manipulated in any way.

Then when the user wants to sell his license. Currently I am thinking
about how to handle it, but a decision has not been made until now.

I could just not allow that the license can be sold, but this has to be
justified by laywers. Or I could allow it but demanding the same
procedure as when the number of licensings act has been eaten up. Both
(the seller and the buyer) would have to give their personal data. And
the buyer would have to pay the fee.

Now, what's your and others oppinion to this licensing model? I am curious.

No problem for me. My method is not bound to a certain manufacturer. All
I need is a USB-memory stick having a serial id. Manufacturers and
models used may change over time.

On Fri, 03 Feb 2006 03:10:32 +0100, Ulrich Korndoerfer
<ulrich_wants_nospam@prosource.de> wrote:

<snip>

It is an interesting idea

I can see legal problems in certain countries, some legal systems
state that anything can be re-sold.

I'm also not sure how you will decrement a counter on the memory stick

Personally I'm not keen on 'hardware binding' except when it is to
prevent people pinching the customers data.

On my little used XP-Pro box I have two caddy drives and a whole load
of spare hard disks

Annoyingly when I swap a drive, XP detects the hardware change and
'calls back to momma' which I find annoying - and very worrying.

I also have a number of machines on one KVM switch, and expect to have
copies of all utility software etc on each machine
- not unreasonable as they are not used simultaneously, I simply need
to test my code under 95/98/2k/XP
- also the machines provide a degree of backup

Your licensing approach would probably work for a lot of users, but it
would be loathed by programmers and by people who upgrade their
machines frequently (and some do).

Personally I reckon that putting the name of the licenced user on the
screen and all printouts is a way of protecting certain types of
software,
- and for other types I would not mind some sort of generic dongle
(which is not legal in the USA I believe) that all my packages
recognize

You might well have a market
- it will be interesting seeing how you get on

Hi,

J French wrote:

A memory stick has plenty of room for encrypted files which eg can hold
the sticks serial ID, a counter and more.

It depends how restrictive the software is to hardware changes.
Checking only the HD holding the OS should suffice.
One makes a "fingerprint" of many available hardware characteristics. A
severe hardware change should be considered as being detected only when
substantial changes to vital parts of the pc are made.

My target market has typical office hardware and tends to stick to this
hardware as long as possible (conservative people :-)). Also they are
rather technical ignorant (about pc hardware) and see their pcs as plain
working horses needed to get their jobs done (they are not eg gamers
hunting for the latest features). No professional programmers among them.

I am more concerned of virtual machines (VMWARE, XEN etc). They are
getting cheaper and cheaper (or are free like XEN). They are more and
more simple to use. And more and more people learn about them as they
get impact for security reasons. Eg surfing with a browser inside a
virtual machine is much more safer. So in the future more and more
people (the technical ignorant too) will use them. But the software
installed on to a virtual machine runs without new installation on any
computer, while the software will not recognize that the physical host
has changed. Ok, this will kill many licensing systems, I think. So at
least I would not be the only one who's licensing system breaks ;-).

Wonder why You do not use them? A typical application for VMs is
software testing under different OSes or version of Oses.

But that would mean that the dongle is present when the software runs?
This would bother me. A dongle can get lost or damaged. Then being able
to use the software would stop immediately. With my approach the user
has plenty of time to get a new one.

Also a dongle that has to be present when the software runs eats up
ressources. Lets say the dongle is a CD (which can have licensing info
on it). So whenever I use the software, one CD-drive would be blocked.
Or I want to use the software and then: hey, where is that dongle?
Searching starts ;-)

On Fri, 03 Feb 2006 15:33:57 +0100, Ulrich Korndoerfer
<ulrich_wants_nospam@prosource.de> wrote:

<snip>

Fair points

- also I've been thinking about VMWare

My ideal dongle would be an ISA card
- preferably linked to something like a PCMCIA slot on the front

Of course, very soon, we will be able to carry our entire systems in a
matchbox and the hardware will be 'dumb'.

Inevitable really, that way it will match most users.

Ulrich,
Seems this conversation has gone a bit off course to your original
question.

Here's is a simple ooRexx script that could easily be converted to VB
(if you don't mind using the FileSystemObject). :-)

/* drive_sn.rex */

objFSO = .oleobject~New('Scripting.FileSystemObject')
colDrives = objFSO~Drives
do objDrive over colDrives
  if objDrive~DriveType = 1 then  --USB Flash Drive
    do
      say 'Available space: 'objDrive~AvailableSpace
      say 'Drive letter:    'objDrive~DriveLetter
      say 'Drive type:      'objDrive~DriveType
      say 'File system:     'objDrive~FileSystem
      say 'Free space:      'objDrive~FreeSpace
      say 'Is ready:        'objDrive~IsReady
      say 'Path:            'objDrive~Path
      say 'Serial number:   'objDrive~SerialNumber
      say 'Share name:      'objDrive~ShareName
      say 'Total size:      'objDrive~TotalSize
      say 'Volume name:     'objDrive~VolumeName
    end
end


Results:
c:\!Rexx_Trials>drive_sn.rex
Available space: 376471552
Drive letter:    E
Drive type:      1
File system:     FAT
Free space:      376471552
Is ready:        1
Path:            E:
Serial number:   1374416650
Share name:
Total size:      512573440
Volume name:

c:\!Rexx_Trials>

Note: Without error checking this will fail on DVD/CD drives if there
is no media inserted.

HTH
Lee

On Thu, 02 Feb 2006 03:01:27 +0100, Ulrich Korndoerfer
<ulrich_wants_nospam@prosource.de> wrote:

Show quoteHide quote

Hi,

Lee Peedin wrote:
thanks for your input. Unfortunately this script does read the 4 Byte
volume serial number (the same one one gets when using the API
GetVolumeInformation).

This is not the one I am searching for, as it is written anytime the
drive or volume is formatted and so can change.

I search for a method to read the device id (the device serial number)
of an USB device, which is burnt into the USB device by the USB
manufacturer and can not be altered afterwards. Also this serial (stored
as an UNICODE string) should contain (according to the USB specs) hex
digit characters (0 to 9, A to F) only, at least 12 of them.

Did you have any luck with finding the way to recover serial number?

SK

On Sun, 05 Feb 2006 02:12:32 +0100, Ulrich Korndoerfer
<ulrich_wants_nospam@prosource.de> wrote:

Show quoteHide quote

Hi,

SK schrieb:
We are on the way (currently there is an ongoing thread on
microsoft.public.de.vb, in german of course).

We have been able to read serials with the USBView Tool from the MS-DDK
and also by using some VB code. But there is plenty of room for
enhancements.

If input comes in this group, I will go deeper into the details.
Otherwise you will have to wait until we have finished some "stable"
version and I have more time.

I had a look into this group (using bablefish online translator) and I
noticed that you made quite a progress on this issue.

I have also downloaded your ReadHardware app and I have a question. I
made an executable and tested it on two of my coputers. I used the
same USB key and got the same PNPDeviceID:

USBController Caption                   : SiS PCI to USB Enhanced Host
Controller
USBController Availability              : <NULL>
USBController Caption                   : SiS PCI to USB Enhanced Host
Controller
USBController ConfigManagerErrorCode    : 0
USBController ConfigManagerUserConfig   : False
USBController CreationClassName         : Win32_USBController
USBController Description               : SiS PCI to USB Enhanced Host
Controller
USBController DeviceID                  :
PCI\VEN_1039&DEV_7002&SUBSYS_04801558&REV_00\3&267A616A&0&1B
USBController ErrorCleared              : <NULL>
USBController ErrorDescription          : <NULL>
USBController InstallDate               : <NULL>
USBController LastErrorCode             : <NULL>
USBController Manufacturer              : Silicon Integrated Systems
USBController MaxNumberControlled       : <NULL>
USBController Name                      : SiS PCI to USB Enhanced Host
Controller
USBController PNPDeviceID               :
PCI\VEN_1039&DEV_7002&SUBSYS_04801558&REV_00\3&267A616A&0&1B
USBController PowerManagementCapabilities: <NULL>
USBController PowerManagementSupported  : <NULL>
USBController ProtocolSupported         : 16
USBController Status                    : OK
USBController StatusInfo                : <NULL>
USBController SystemCreationClassName   : Win32_ComputerSystem
USBController SystemName                : KLEMEN
USBController TimeOfLastReset           : <NULL>


Is this the unique number that we are looking for?

SK

--------------------------------------------------------------------------------

On Thu, 09 Feb 2006 12:59:08 +0100, Ulrich Korndoerfer
<ulrich_wants_nospam@prosource.de> wrote:

Show quoteHide quote

Hpw to make a VB6 form appears and gets focus every 15 seconds
Do we have such a container control?
www Link in VB 6...
Writing to .TXT file question
Need help regarding the program... Please help me.. It's very Urgent
Book for web dev with VS2005?
missing reference
Connection
Run-time error 3706
MSComm application hangs - comEventRxOver