Locking a C++ binary to the RPi serial number

Question

I see that each RPi has a serial number that is accessible by reading /proc/cpuinfo. How secure is it for me to tie such serial number to my C++ binary when I want to lock that binary to a single RPi board?

I know anyone will be able to alter the binary code to crack it (and stop checking for the SN), but can this be messed from the other side by letting the binary read something else from /proc/cpuinfo (I mean faking the /proc/cpuinfo itself)?

There is a post about editing the serial number - one comment on the question says "compile a custom kernel that returns whatever serial you like at /proc/cpuinfo". I guess this can be done quite easily since PRi kernel sources are widely available? Am I right?

Answer 1

Any security system you put in place can be circumvented. All that is typically needed is access to a debugger.

The only way to stop people using the software without paying is to make the software valueless.

It may be marginally better to grab the serial number from the mailbox interface rather than /proc/cpuinfo, as you say /proc/cpuinfo can be spoofed. The mailbox interface may be slightly harder to spoof.

https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface

Answer 2

It may be possible to unwind any locking scheme, but if it is complex, that takes man-hours. Few knock-off artists want to put work in. They either don't know how or they don't want to invest the time to crack a low value product. And don't forget: They have uncertainty about their success - that's discouraging.

The actual code, like a lock, can be made arbitrarily complex.Perhaps you seed the device with a number of files which are checked. You don't have to list the current ser number in your code - Your code could just check the number of 0's or the like. The point of that is that it hides the lock process. As the code checks the cpu ser num, it might look sideways at something else in the files. The point is to make disassempbly of your code difficult.

Another thing to consider is a special chip which has a number that is read. It can be put there as a dummy - does nothing, but they don't know that.

just a few ideas.

Answer 3

The following is a fragment of a bash script which accesses CPUID

MAC=$(cat /sys/class/net/eth0/address)
# NOTE the last 6 bytes of MAC and CPUID are identical
CPUID=$(awk '/Serial/ {print $3}' /proc/cpuinfo | sed 's/^0*//')

It would be possible to open the files in c and read the data.

I cannot comment on the likelihood of this being hacked, but I believe it is possible to enter a custom MAC.