I am currently evaluating VMProtect v3.10.4 (Build 2650) for a Linux x64 console application. I have encountered a critical security concern regarding license persistence and system clock manipulation.
The Scenario:
- I generate a serial number with a specific Expiration Date.
- When the system clock is set to a future date (post-expiry), VMProtectGetSerialNumberState() correctly identifies the license as expired.
- However, if I then manually set the system clock backward to a date within the original validity period, the same serial number becomes valid again. VMProtectGetSerialNumberState() returns 0 (Success), and functions marked as "Lock to Serial Number" execute without issue.
what is the recommended SDK-based method to ensure a license, once expired, cannot be re-validated via clock manipulation?
It's impossible to detect the system clock rollback without getting the real date from the Internet. We can recommenв to use VMProtectActivateLicense and the licensing system will also use the date from your activation server.
We are very satisfied with how the SDK secures our binaries and handles licensing logic, and but before purchasing the license for VMprotect, we want to confirm and try to fully automate our workflow.
Our goal is to use vmprotect_con on Linux within a CI/CD pipeline (using Make/CMake) to perform two distinct tasks:
1- Automated Compilation: We have already automated the protection of our binaries using a command like:
./vmprotect_con [input_binary] [output_binary] -pf [project.vmp]
2- Automated License Generation: We need to generate customer serial numbers (license.key) dynamically using the same .vmp project file via the Linux CLI.
Our Questions:
Is direct serial number generation supported in the Linux version of vmprotect_con? or we will have to move the binary and project file to GUI and generate the license? Do not see anything in the user manual related to this.