Blue Soliel
Sunday, May 27th, 2007I bought a USB bluetooth adaptor for Vic to sync her phone with her desktop. The adapter shipped with Blue Soliel, used to run the adapter.
About 5 minutes after installing it, I got an error saying:
A pirate copy is in use!
BlueSoleil will run in evaluation mode!
This was interesting because I’d just bought it. After googling for the issue, I found the following forum posts. One of the problems they suggest is that the MAC address of your hardware is already in use (eg 11.11.11.11.11.11)
Now I have some sympathy for IVT in this situation. They write software, they want to ensure that people pay them for using their software. However it appears that their means for identifying pirates is pretty poor. It would seem to be similar to WGA, where it associates some sort of hardware hash with the MAC address of the bluetooth adapter. This breaks in numerous situations (moving between machines, change hardware etc). It assumes that people will not want to move between machines, which is certainly not true for us as I will probably “borrow” this from Vic. IVTs anti-piracy measures penalise legitimate customers, customers like myself.
You see, the adapter I bought certainly was licensed. However I think what may have happened is that someone at the store I bought it from tested it before selling it to me. The end result being it has turned up as pirated. In addition for many users they are buying the hardware and they see software like Blue Soliel tied to the hardware, not to one specific machine. In my case I would also want to use the adapter on my desktop as well as Victoria’s, which would likely flag the software a pirated again.
Undoing the damage
All in all this made me pretty annoyed. I installed a firewall on Vic’s desktop to find out what it was trying to connect to (in order to check whether it was pirated or not). It turns out this was the following IP address:
211.94.168.252
This closed down my first line of though, which was to add an entry to the hosts file, redirecting the domain name to 127.0.0.1. With a direct IP address this isn’t possible. I was also disinclined to run a firewall on Vic’s machine permanently (I think the security they add is minimal), and I don’t have anything set up to run egress filtering from my network.
My next approach was to consider patching the binary files to either bypass or redirect the online check. This isn’t something I have done before, however I was feeling annoyed enough to think it might be a good idea. I ran Filemon to see what handles it opened up and sure enough, at the point where it popped up its error message, there was a call to one of the winsock dlls. I ran strings (a tool on linux to pull out all human readable strings out of a binary file) to see if I could find the actual message. The fact that I couldn’t suggested to me that they may obfuscate the strings binaries. I also ran a quick search for the hex, int or dotted decimal representation of that IP address, which found nothing also. At that point I decided it might get a little hard to track down exactly where the problem lies.
I also toyed with the idea setting up a separate login account for BlueSoliel, one which denied permissions to the dll. I’d then set BlueSoliel to run on startup using runas.