Add online licensing checks

Author: AlSch092

UltimateDRM.vcxproj

@@ -216,7 +216,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
     </Link>
     <Lib>
-      <AdditionalDependencies>ntdll.lib;wintrust.lib;crypt32.lib;lib/zlib.lib;lib/libcurl.lib;lib/brotlicommon.lib;lib/brotlidec.lib;lib/brotlienc.lib</AdditionalDependencies>
+      <AdditionalDependencies>ntdll.lib;wintrust.lib;crypt32.lib;lib/zlib.lib;lib/libcurl.lib;lib/brotlicommon.lib;lib/brotlidec.lib;lib/brotlienc.lib; ws2_32.lib;</AdditionalDependencies>
     </Lib>
   </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

include/HttpClient.hpp

@@ -7,16 +7,14 @@
 #include <vector>
 #include "Logger.hpp"
 
-using namespace std;
-
 struct HttpRequest
 {
-    string url;
-	vector<string> requestHeaders;
-    string cookie;
-	string body;
-    vector<string> responseHeaders;
-    string responseText;
+    std::string url;
+    std::vector<std::string> requestHeaders;
+    std::string cookie;
+    std::string body;
+    std::vector<std::string> responseHeaders;
+    std::string responseText;
 };
 
 struct MemoryStruct
@@ -26,7 +24,7 @@ struct MemoryStruct
 
 struct ResponseHeaders
 {
-    vector<std::string> headers;
+    std::vector<std::string> headers;
 };
 
 class HttpClient //a simple class for making web/http requests.

include/License.hpp

@@ -140,15 +140,15 @@ class License final
 			return LicenseStatus::WrongProduct;
 
 		// - plan in allowed set
-		static const std::unordered_set<std::string> kPlans = { "edu-floating","named-device","site" };
+		static const std::unordered_set<std::string> kPlans = { "trial", "monthly","ongoing", "infinite" };
 
 		if (!kPlans.count(c.plan)) 
 			return LicenseStatus::InvalidPlan;
 
 		// - seats rule: null for "site", present & >=1 otherwise
-		if (c.plan == "site") 
+		if (c.plan == "trial") 
 		{
-			if (c.seats != 0) 
+			if (c.seats != 1) 
 				return LicenseStatus::InvalidSeats;
 		}
 		else 
@@ -250,7 +250,8 @@ class License final
 			licenseResult.status = License::LicenseStatus::Expired;
 			return licenseResult;
 		}
-
+		//iat = 1756694840
+		//now = 1756683456
 		if (licenseResult.claims.iat > now + kSkew)
 		{
 			licenseResult.status = License::LicenseStatus::ClockSkew;
@@ -274,7 +275,57 @@ class License final
 		// TODO: look up in your store
 		return false;
 	}
+};
 
+using json = nlohmann::json;
 
+struct LicenseActivateRequest
+{
+	std::string license_token;
+	std::string machine_id;
+	std::string software_version;
 };
 
+struct LicenseActivateResponse
+{
+	bool ok;
+	std::string lease_id;
+	uint64_t lease_expires_in;
+};
+
+static void to_json(json& j, const LicenseActivateRequest& request)
+{
+	j = json{
+			{"license_token", request.license_token},
+			{"machine_id", request.machine_id},
+			{"software_version", request.software_version},
+	};
+}
+
+static inline void from_json(const nlohmann::json& j, LicenseActivateRequest& request)
+{
+	if (j.contains("license_token") && !j["license_token"].is_null())
+		j["license_token"].get_to(request.license_token);
+
+	if (j.contains("machine_id") && !j["machine_id"].is_null())
+		j["machine_id"].get_to(request.machine_id);
+
+	if (j.contains("software_version") && !j["software_version"].is_null())
+		j["software_version"].get_to(request.software_version);
+}
+
+static void to_json(json& j, const LicenseActivateResponse& response)
+{
+	j = json{
+			{"ok", response.ok},
+			{"lease_id", response.lease_id},
+			{"lease_expires_in", response.lease_expires_in},
+	};
+}
+
+static void from_json(const nlohmann::json& j, LicenseActivateResponse& response)
+{
+	j.at("ok").get_to(response.ok);
+	j.at("lease_id").get_to(response.lease_id);
+	j.at("lease_expires_in").get_to(response.lease_expires_in);
+}

include/LicenseManager.hpp

@@ -10,8 +10,7 @@
 
 #pragma comment(lib, "bcrypt.lib")
 
-
-class LicenseManager final //Not finished yet
+class LicenseManager final
 {
 public:
 	LicenseManager(std::string LicenseServerEndpoint, bool bAllowOfflineProductUsage, std::string LicenseFileName) 
@@ -21,46 +20,62 @@ class LicenseManager final //Not finished yet
 
 	~LicenseManager()
 	{
-		if (RSAPubKeyPinned != nullptr)
-			delete[] RSAPubKeyPinned;
+		if (DEFAULT_PUB_KEY_X != nullptr)
+			delete[] DEFAULT_PUB_KEY_X;
 
-		if (PINNED_PUB_KEY_X != nullptr)
-			delete[] PINNED_PUB_KEY_X;
+		if (DEFAULT_PUB_KEY_Y != nullptr)
+			delete[] DEFAULT_PUB_KEY_Y;
 
-		if (PINNED_PUB_KEY_Y != nullptr)
-			delete[] PINNED_PUB_KEY_Y;
-	}
+		if (PublicKeyX != nullptr)
+			delete[] PublicKeyX;
 
-	bool SendLicenseInfo(__in const bool bUsingEncryption);
+		if (PublicKeyY != nullptr)
+			delete[] PublicKeyY;
+	}
 
-	static bool Sha256_CNG(const void* data, size_t len, std::vector<uint8_t>& out32);
-	static bool DerEcdsaToP1363(const uint8_t* der, size_t derLen, uint8_t out64[64]);
+	bool SendLicenseInfo(__in const bool bUsingEncryption, __in const std::string& machine_id, __in const std::string& software_version, __out std::string& leaseId);
 
-	BCRYPT_KEY_HANDLE import_es256_pubkey(__in std::vector<uint8_t>& x, __in std::vector<uint8_t>& y);
     bool VerifyLicenseJWT_ES256(__in const std::string& token);
 
-	const uint8_t* GetPubX() const  { return PINNED_PUB_KEY_X; }
-	const uint8_t* GetPubY() const { return PINNED_PUB_KEY_Y; }
+	void SetPubXY(__in const uint8_t* arrX, __in const uint8_t* arrY)
+	{
+		if (this->PublicKeyX == nullptr)
+			this->PublicKeyX = new uint8_t[32]{ 0 };
+
+		if (this->PublicKeyY == nullptr)
+			this->PublicKeyY = new uint8_t[32]{ 0 };
+
+		for (int i = 0; i < 32; i++)
+		{
+			this->PublicKeyX[i] = arrX[i];
+			this->PublicKeyY[i] = arrY[i];
+		}
+	}
+
+	const uint8_t* GetPubX() const { if (this->PublicKeyX == nullptr) return DEFAULT_PUB_KEY_X; else return this->PublicKeyX; }
+	const uint8_t* GetPubY() const { if (this->PublicKeyY == nullptr) return DEFAULT_PUB_KEY_Y; else return this->PublicKeyY; }
 
 	bool IsOfflineUsageAllowed() const { return bAllowOfflineProductUsage; }
 
+	void SetLicenseToken(__in const std::string& jwtToken) { this->LicenseToken = jwtToken; }
+
 private:
 
-	char* RSAPubKeyPinned = nullptr;
-
-	std::string LicenseKey;
-	std::vector<uint8_t> LicenseSignature; //grabbed from file or registry or w/e
+	std::string LicenseToken;
 	std::string LicenseFileName;
-
 	std::string LicenseServerEndpoint;
-
 	bool bAllowOfflineProductUsage = false;
 
-	std::vector<uint8_t> LoadPublicKeyContents(const std::string& pubKeyText);
-	BCRYPT_KEY_HANDLE LoadRSAPublicKey(const std::vector<uint8_t> derData);
-	bool VerifySignature(BCRYPT_KEY_HANDLE hKey, const std::vector<uint8_t>& licenseData, const std::vector<uint8_t>& signature);
+	static bool Sha256_CNG(__in const void* data, __in  const size_t len, __out std::vector<uint8_t>& out32);
+	static bool DerEcdsaToP1363(__in  const uint8_t* der, __in  const size_t derLen, __out uint8_t out64[64]);
+
+	BCRYPT_KEY_HANDLE import_es256_pubkey(__in std::vector<uint8_t>& x, __in std::vector<uint8_t>& y);
+
+	uint8_t* PublicKeyX = nullptr; //32 length byte array
+	uint8_t* PublicKeyY = nullptr; //32 length byte array
 
-	//pinned public key -> replace with your public key X/Y from dump_xy.py  (we originally generate an ECDSA keypair with openssl, then make a license.jwt file which embeds license details)
-	const uint8_t* PINNED_PUB_KEY_X = new uint8_t[32] { 0x0e,0x8a,0x31,0x1e,0x93,0x8d,0xc5,0x14,0x8e,0xb7,0x9c,0xb1,0x70,0xd9,0xca,0x35,0x3a,0x44,0x9b,0xb9,0xe1,0x65,0xa0,0xc3,0xfb,0xc6,0xb8,0x73,0x2b,0xd8,0xcd,0xc8 };
-	const uint8_t* PINNED_PUB_KEY_Y = new uint8_t[32] { 0xfe,0x24,0xf5,0x84,0xeb,0x0e,0x20,0x39,0xd3,0x66,0xbe,0x76,0x14,0x3c,0xdb,0xc0,0xc1,0x97,0xca,0x96,0x83,0x55,0x99,0x0f,0xc1,0x18,0x5b,0x1d,0x7d,0x94,0x48,0x67 };
+	//pinned DEFAULT public key -> replace with your public key X/Y from running `python dump_xy.py`  (we originally generate an ES256 keypair with openssl, then make a license.jwt file which embeds license details)
+	// If you're just using default license from github, use the fixed key below, otherwise if you use your own license/keys use `SetPublicXY(your_x, your_y)`
+	const uint8_t* DEFAULT_PUB_KEY_X = new uint8_t[32] { 0x0e,0x8a,0x31,0x1e,0x93,0x8d,0xc5,0x14,0x8e,0xb7,0x9c,0xb1,0x70,0xd9,0xca,0x35,0x3a,0x44,0x9b,0xb9,0xe1,0x65,0xa0,0xc3,0xfb,0xc6,0xb8,0x73,0x2b,0xd8,0xcd,0xc8 };
+	const uint8_t* DEFAULT_PUB_KEY_Y = new uint8_t[32] { 0xfe,0x24,0xf5,0x84,0xeb,0x0e,0x20,0x39,0xd3,0x66,0xbe,0x76,0x14,0x3c,0xdb,0xc0,0xc1,0x97,0xca,0x96,0x83,0x55,0x99,0x0f,0xc1,0x18,0x5b,0x1d,0x7d,0x94,0x48,0x67 };
 };

include/MapProtectedClass.hpp

@@ -4,8 +4,6 @@
 #include "Definitions.hpp"
 #include <stdexcept>
 
-using namespace std;
-
 /*
     ProtectedMemory - Protects the memory of a class object by memory mapping it, then remapping it with SEC_NO_CHANGE
     should be used as follows:

include/NAuthenticode.hpp

@@ -5,15 +5,14 @@
 #include <wincrypt.h>
 #include <wintrust.h>
 #include <mscat.h>
+#include <string>
 #include "Logger.hpp"
 
 #define ENCODING (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING)
 
 //#pragma comment(lib, "wintrust.lib")
 //#pragma comment(lib, "crypt32.lib")
 
-using namespace std;
-
 typedef struct
 {
 	LPWSTR lpszProgramName;
@@ -27,12 +26,12 @@ namespace Authenticode
 	BOOL VerifyCatalogSignature(__in const LPCWSTR filePath, __in const  BOOL checkRevoked);
 	BOOL HasSignature(__in const LPCWSTR filePath, __in const BOOL checkEndCertRevoked);
 
-	wstring GetSignerFromFile(__in const wstring& filePath); //get the 'subject' field of the certifcate (often the company which published the software file)
+	std::wstring GetSignerFromFile(__in const std::wstring& filePath); //get the 'subject' field of the certifcate (often the company which published the software file)
 
 	//https://learn.microsoft.com/en-us/previous-versions/troubleshoot/windows/win32/get-information-authenticode-signed-executables
 	BOOL GetProgAndPublisherInfo(__in PCMSG_SIGNER_INFO pSignerInfo, __out PSPROG_PUBLISHERINFO Info);
 	BOOL GetDateOfTimeStamp(__in PCMSG_SIGNER_INFO pSignerInfo, __out SYSTEMTIME* st);
-	wstring GetCertificateSubject(__in PCCERT_CONTEXT pCertContext);
+	std::wstring GetCertificateSubject(__in PCCERT_CONTEXT pCertContext);
 	BOOL GetTimeStampSignerInfo(__in PCMSG_SIGNER_INFO pSignerInfo, __out PCMSG_SIGNER_INFO* pCounterSignerInfo);
 	LPWSTR AllocateAndCopyWideString(__in LPCWSTR inputString);
 }

include/Process.hpp

@@ -12,8 +12,6 @@
 
 #pragma comment(lib, "ImageHlp")
 
-using namespace std;
-
 namespace ProcessData
 {
 	typedef enum _PROCESS_INFORMATION_CLASS 
@@ -35,15 +33,15 @@ namespace ProcessData
 
 	struct MODULE_DATA
 	{
-		wstring baseName;
-		wstring nameWithPath;
+		std::wstring baseName;
+		std::wstring nameWithPath;
 		MODULEINFO dllInfo;
 		HMODULE hModule;
 	};
 
 	struct Section
 	{
-		string name = "";
+		std::string name;
 		unsigned int size;
 		uintptr_t address;
 
@@ -113,28 +111,28 @@ class Process final
 
 	bool FillModuleList();
 
-	static list<ProcessData::Section> GetSections(__in const string module);
+	static std::list<ProcessData::Section> GetSections(__in const std::string& module);
 
 #ifdef _M_IX86
 	static _MYPEB* GetPEB() { return (_MYPEB*)__readfsdword(0x30); }
 #else
 	static _MYPEB* GetPEB() { return (_MYPEB*)__readgsqword(0x60); }
 #endif
 
-	static wstring GetProcessName(__in const DWORD pid);
-	static DWORD GetProcessIdByName(__in const wstring procName);
-	static list<DWORD> GetProcessIdsByName(__in const wstring procName);
+	static std::wstring GetProcessName(__in const DWORD pid);
+	static DWORD GetProcessIdByName(__in const std::wstring& procName);
+	static std::list<DWORD> GetProcessIdsByName(__in const std::wstring& procName);
 
 	static DWORD GetParentProcessId();
-	static BOOL CheckParentProcess(__in const wstring desiredParent, __in const bool bShouldCheckSignature);
+	static BOOL CheckParentProcess(__in const std::wstring& desiredParent, __in const bool bShouldCheckSignature);
 
-	wstring GetParentName() const { return this->_ParentProcessName; }
+	std::wstring GetParentName() const { return this->_ParentProcessName; }
 	uint32_t GetParentId() const { return this->_ParentProcessId; }
 
-	void SetParentName(__in const wstring parentName) { this->_ParentProcessName = parentName; }
+	void SetParentName(__in const std::wstring& parentName) { this->_ParentProcessName = parentName; }
 	void SetParentId(__in const uint32_t id) { this->_ParentProcessId = id; }
 
-	static bool HasExportedFunction(__in const string dllName, __in const string functionName);
+	static bool HasExportedFunction(__in const std::string& dllName, __in const std::string& functionName);
 
 	static FARPROC _GetProcAddress(__in const PCSTR Module, __in const  LPCSTR lpProcName); //GetProcAddress without winAPI call
 
@@ -144,7 +142,7 @@ class Process final
 
 	static DWORD GetModuleSize(__in const HMODULE module);
 
-	static list<ProcessData::ImportFunction> GetIATEntries(const std::string& module); //start of IAT hook checks
+	static std::list<ProcessData::ImportFunction> GetIATEntries(const std::string& module); //start of IAT hook checks
 
 	static bool IsReturnAddressInModule(__in const uintptr_t RetAddr, __in const  wchar_t* module);
 
@@ -168,14 +166,14 @@ class Process final
 
 	uint32_t _ProcessId = 0;
 
-	wstring _ProcessName;
-	wstring _WindowClassName;
-	wstring _WindowTitle;
+	std::wstring _ProcessName;
+	std::wstring _WindowClassName;
+	std::wstring _WindowTitle;
 
-	wstring _ParentProcessName;
+	std::wstring _ParentProcessName;
 	uint32_t _ParentProcessId = 0;
 
-	list<ProcessData::Section*> MainModuleSections;
+	std::list<ProcessData::Section*> MainModuleSections;
 
-	list<ProcessData::MODULE_DATA*> ModuleList; //todo: make routine to fill this member
+	std::list<ProcessData::MODULE_DATA*> ModuleList; //todo: make routine to fill this member
 };