Compiled Demos

I just got a request for Desaware's Version Stamper. I thought that this would be a good example of a different type of ActiveX licensing or rather an alternative to demo licensing.

When a programmer makes an app with an ActiveX control, the OCX file is distributed along with the program. Since this ActiveX control is a full version, they must keep people other than the original developer from using it in their own programs. In order to do that, they put something on the programmer's computer that will not exist on everyone else's computer. That's how they know if you are licensed to put that control in your program.

Most OCX files contain both demo and full versions of the control. This is the easiest way for a company to do manage their software releases. Before an instance of a control is created it must have a valid license string. If the control is created from an executable on the end user's machine, the executable will provide a license to display the control. The license string it uses is the same license string that the programmer used on his machine to compile the executable. In other words, the programmer's license is compiled right into the executable.

But in the development environment (i.e., Visual Basic) when a control is created the license string isn't known yet. In that case the environment requests an instance of the control but passes no license string in the request. By doing that it is telling the control to give me a license because I am a registered user. The control then looks on the programmer's computer to see if they really are a licensed user. If they are then it returns a development license string. If not it returns either a demo license string or causes an error.

The two most common ways of verifying the license are to look for a .lic file in the same directory as the .ocx file or look in the HKCR\Licenses key in the registry. Now there are variations to this but basically it is either going to look at a file or look at the registry.

When someone purchases a control, they can usually license it in several ways: - Enter a valid serial number or CD key in the installation program - Enter a valid serial number from the about box of the control - Enter a valid serial number from separate registration utility - Place a license file in the same directory as the OCX file - Update the registry with a .reg file - Install a whole new OCX file

Now the last one is interesting because several companies do this. With a traditional program it makes a lot of sense to compile two separate versions of the application. Anyone can download the demo from the internet but you mail the real one to paying customers.

But with an ActiveX control, it really doesn't make much sense. The problem is that the real version of your control is going to be distributed with every application and with every web page that contains the control. That real version is still going to need some kind of licensing protection like I mentioned above. And since you spent so much time making two versions of your control, the protection is usually weak on the real one.

Here is an example: Janus Systems makes a control called GridEx. It is a MS Outlook style grid control. They have a demo version that you can download and evaluate. But on their software updates page they have the real control. These two controls are two separate controls with two separate CLSID's. So what do we do? We download the real one and crack the simple licensing it uses.

Usually it is not that difficult to find the real control and once you have it is usually simple to crack. Needless to say, however, it doesn't make much sense trying to license the demo version of the control. All you can really do with those is suppress the nag screens.

But back to Desaware. They are different. In fact, although I assume that they have different versions of their control, I am not completely sure. I will have to do some more in depth research to know for sure.

Here are some clues that usually indicate that two versions of a control are available: - Regmon shows no registry activity and Filemon shows no file activity - Sample compiled executables that came with the demo also pop up the nag screen - The name hints to a demo version (e.g. it ends with a "d") - The class name (look in the components dialog in VB) contains the word "Demo" - The class name appears twice (hence two CLSID's) - The company web site has two separate downloads (and one is password protected) - The file resource information contains the word "Demo" (look at the file version properties from Explorer - If the control was made with Visual Basic, open the OCX file in a hex editor and look for the original location of the project file. The directory may indicate a demo version (for example, if it was compiled from D:\MyControl\DemoVersion\Demo.vbp then it is probably a demo).

Now the Desaware demo has many of the above elements but looking at the source, I am not completely convinced that they have two versions. And if they have two versions, they make it very difficult to find the real one.

This is where I usually look for the real one: - Password protected downloads on their web site - Product updates on their FTP site - Online or compiled demos of their controls - Other programs (sometimes their own) that use their controls

Desaware has none of these. If they have two versions of their control, they protect the real one very well.

So before you start looking for a way to license a control, first make sure you are working on the right control.