Install Program on only one USB Drive

[Ron Weller]

I wrote a VB2005 utility that must run from a USB drive. I need to write an installer that can install the utility onto a USB Drive so that the program will only run on that one USB Drive.

The idea is that once installed onto the USB drive, if you move the program onto another drive it should realize that it is no longer on the correct drive and not run. But if it is on the correct drive and you move the USB drive onto another system then that is fine, so it should run.

I can get the VolumeSerialNumber of the USB drive but how do I get the installer program to modify the utility program to look for just that particular VolumeSerialNumber. I need the Installer to write the VolumeSerialNumber into the .exe file.

In the old days you could use a special string literal value that you could search for in the compiled program and simply replace it with a new string and so long as they were the same number of characters it would work.

Any Help Would Be Greatly Appreciated!!!
Thank You!

[Phil Weber]

If you can require that the USB drive be formatted as NTFS, you can use an alternate data stream to store hidden information in the .EXE file. For more information on alternate data streams, see http://www.think-techie.com/2010/04/...a-streams.html. For sample code to read and write alternate data streams, see http://www.codeproject.com/KB/cs/ntfsstreams.aspx.

[Ron Weller]

That sounds very interesting. But I don't think I can force the NTFS format. Also it does not sound very secure, to anyone who knows about alternate streams, plus if Microsoft pushes out an update to explorer that allows you to see alternate streams then the jig is up in one fell swoop.

But still it's a very interesting Idea. I'll pass it on the the boss, and see what he thinks.

[tech5563]

Is it possable to use the code below and just change adjust it to use the serial instead of the label ??

Public Class Form1

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
Dim counter As Integer
Dim driveusb As String = (My.Computer.FileSystem.Drives(counter).Name)
Dim driveNames As New List(Of String)
For Each drv As System.IO.DriveInfo In System.IO.DriveInfo.GetDrives
If drv.DriveType = IO.DriveType.Removable AndAlso drv.IsReady Then
Dim drvLetter As String = drv.Name
Dim drvVolume As String = drv.VolumeLabel
If drvVolume <> "LABEL" Then
MsgBox("Wrong Drive inserted")
Else
MsgBox(drvLetter & " " & drvVolume)
End If
End If

Next
End Sub
End Class

[Ron Weller]

Nice Idea, in fact it was one of the one's I thought of as well.

In fact that worked well when my customer was selling the software packaged with a removable drive. He sets the serial number for the drive in the code, recompiles the program and installs it onto the drive.

Now if you try to move the program to another drive it won't work because the serial number does not match.

The new problem is now the customer want's to sell the software by itself. Which means the user must download and run the installer program. So how do you get the installer program to modify an already compiled program, to somehow store the serial number of the install drive into the already compiled code.

Another problem is how to keep the user from running the installer again, but with a different removable drive plugged in. Thus getting multipule copies of the program out of only one purchase.

I can stop the installer from installing another copy by using a KeyCode, which is e-mailed to the users at the time of purchase. The installer both checks and updates a record on my customers web server that tracks the installs of the program.

So now the only problem is getting the Installer to store the Install Drives serial number into my compiled program. It can't be stored in the registry, because the program is supposed to work on the removable drive no matter which windows computer it is plugged into.

[tech5563]

problem i see is that not all usb drives have a serial number, i would really rethink the idea and maybe use the approach getting the serial number of the customers mainboard and computer name from a web app at the time of purchase and then encode that into the software so they can download and install only on that machine. and if they want to be a resseller you can sell them the webapp or tell them to link through your site so you can keep track of all sales.
just a thought

[Ron Weller]

Not using Serial Number, Using Volume Serial Number, which all removable drives have. Although it changes if they reformat the drive, so if they do they can contact support and they will help them get it reinstalled.

[JBourgeois]

With all the security features built into the framework, I would be surprised if it would let you overwrite part of the .exe once it is compiled.

I know for a fact that this would definitively be impossible if your assembly is signed, because signing an assembly automatically mark it with a CRC code to prevent tempering.

But I would not be surprised to learn that it is also impossible with an assembly that is not signed.

Here is an idea.

The installation program gets the Volume Serial Number, encrypts it and saves the result in a file that must be kept with the application.

When the application starts, it reads the file, decrypt the contents and compare it to the Volume Serial Number it finds on the current drive.

If they match, they are on the installation drive. If not, the program was copied to another drive along with the validation file.

[Ron Weller]

I would like it to be part of the program. Someone could take a copy of the file and try to break the encryption. As part of the program it would be much more difficult to locate the encrypted code since you have no idea what to look for.

My installer is going to download the program from a web server. What would be nice would be a way to pass the serial number to the web server and have it plug it into the source and recompile it on the fly. After compiled it would name the program with a unique name and pass that back to the installer. Then the installer downloades the uniquie filename and renames and installs it and then informs the web server that it has been installed.

[JBourgeois]

You could also hide the number somewhere in the middle of garbage inside of an encrypted file. Knowing where it is hidden in the garbage, you are the only one to know what it is and where to look for it.

It would be even harder to find than in recompiled program, because anybody with a little knowledge of the framework is able to use ildasm.exe to decompile an application. Decrypting a file withouth having the decryption code would be a lot harder.

You would also be less dependant on a few trips back and forth to the web server, which is also somewhat that is quite easy to intercept and break for anybody who has the proper knowledge.