Validating licenses when importing DLL's with MEF, .NET C#

Question

1.00/5 (1 vote)

See more:

I need advice on how to design a licensing system when I am importing DLL files using the MEF. So, my program would run and on startup would begin to load all the DLL's from a specific map into the program. First of, I want to make sure that the program would only load DLL's that are allowed by me, so let's say the original set of DLL's.
Other people can buy a license to also make these DLL's. So there must also be a way to validate this.

What I have tried:

I have absolutely 0 experience on the licensing topic. I have read a lot of articles but nothing really seems to fit my problem.

Posted 18-Apr-17 22:13pm

erik schouten

Updated 22-Apr-17 12:12pm

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

bling · Answer 1 · 2017-04-22T12:12:00

Understand than ANY approach you take is vulnerable to reverse engineering. The most you can hope for is to make it difficult but not impossible for someone to break your licensing mechanism.

The best way to enforce licensing is to run everything on a server - forcing the clients to connect to a server that your control.

Back to your proposal - some low effort things you can do to validate a DLL is check the assembly attributes.

var self = System.Reflection.Assembly.GetExecutingAssembly();

var assembly = System.Reflection.Assembly.LoadFile("suspect.dll");

Assembly Class (System.Reflection)[^]

Next level up would be a hash function on the DLL file. Compare the hash result to a list of known good hash values - eg. an "allowed" list of DLLs.

Better still, use code signing as a way to authenticate each DLL. You application stores a public key which can be used to validate the signature of the DLL.

You must protect the private key by not sharing it with anyone.

None of these are foolproof. It's all about raising the difficulty level where it is actually cheaper to pay for a license than spend the time to crack it.