how can programs tell if you've used them past them demo period?

Question

On certain programs you can run them on a demo period for say 'ten tasks' or '5 hours' before you need to decide to purchase them to keep using them, but if you delete and uninstall the program then reinstall it, it knows that its been previously installed and wont let you run the demo again.

How does it do this ? When you download it does it send a identifiing number (ip ?) to the cdn to let it know youve downloaded it before, or when the program itself installed does it check to see traces of previous installation ?

Answer 1

There are many ways this can be implemented.

The easiest way to implement (and also the easiest way to bypass)

• On first run, create a registry (or text file) entry somewhere
• Add 1 to the counter every time the task (or the app) is run
• Do not include this file/registry in the installer app (so it will persist after uninstallation)
• If at any time the count is too high, notify the user that the trial has expired.

Using image diff tools this method is pretty easy to identify and overcome.

The hardest method to overcome or bypass is to use a server. On the first run, generate a hash code based on the users computer name, drive serial number, etc, and post this to your server. The server then tracks this as a unique installation, and allows the app to run. Each time you run the app, you update the server. This way, the user cannot find the breadcrumbs and delete them, since they are on your server. The down side, is that this method will require an Internet connection.

There are probably much more sophisticated methods to achieve this result, but the above are both implementations I've run across.

Answer 2

Most "demo" software does this by a feature borrowed from malware: Incomplete deinstallation. A file or registry key belonging to the software is not removed on deinstallation. On reinstallation the software sees the remainder and can act on it.

Often-used hiding places for such a remainder were the system directory (before UAC arrived), but many register some class GUID - nobody I know of has a real overview of which classes in the registry are or are not genuine.

Answer 3

My software drops breadcrumbs within the users system which is used to check for previous installations. This is a little harder to get around (assuming you don't know what you are looking for, or where) than an internet check against your IP. As you can always spoof your connection information, or just disconnect from the internet while installing.