> Yeah, it is. There are very few programs out that track changes though,
> and they are usually "security" type things, like one called scoty (or
> something like that), which watch dog they thing, so look for odd
> changes, like something adding a new startup program some place (it
> catches everything doing that, so even legit stuff gives a pop-up, which
> can be interesting...)

A quick google for "registry watcher" gives millions of results, and the 
WinAPI even has a function RegNotifyChangeKeyValue that you can easily 
use to watch the whole registry if you can write a few lines of code. I 
just doubt they use this method as I have tried it before and failed, 
and if they did there would be simple registry hacks all over the web to 
get full versions of software (which there very rarely is).

> Other cases may be hidden files, in odd places,
> etc.

Maybe, but again that is easy to detect if they use standard API calls 
(there are plenty of "file watcher" type programs, or you can easily 
write your own). Again, if this were the case there would be simple 
instructions available online like "delete this file to restart the 
trial", but you don't often see that.

> One of the kind of interesting ones is a "give away of the day"
> thing, which doesn't actually demo, its installer actually registers it,
> within the 24 hours of the give away, and flat refuses to install it as
> a working application, if the server says "no".

Indeed, nowadays it's easy to do if you assume internet access is 
available, you just check with the server with some key generated from 
the machine (using mac address) and refuse to run if the server says no.

> But, in general, adding some sort of flag to the registry, with a date,
> or the like, is the simplest solution. So, in principle, if you knew
> what changed, you could undo it.

Of course it is the simplest, but does any real software actually use 
only that method? IME not, for example try www.bobstrackbuilder.net - 
even a low-budget program from a single coder does not use that method, 
so I highly doubt more "commercial" programs like PhotoShop etc would 
use such an easily hacked method.

Post a reply to this message