License Expiry Bypass via system Clock Rollback

[muhammadayoub]

I am currently evaluating VMProtect v3.10.4 (Build 2650) for a Linux x64 console application. I have encountered a critical security concern regarding license persistence and system clock manipulation.

The Scenario:

• - I generate a serial number with a specific Expiration Date.
  - When the system clock is set to a future date (post-expiry), VMProtectGetSerialNumberState() correctly identifies the license as expired.
  - However, if I then manually set the system clock backward to a date within the original validity period, the same serial number becomes valid again. VMProtectGetSerialNumberState() returns 0 (Success), and functions marked as "Lock to Serial Number" execute without issue.

what is the recommended SDK-based method to ensure a license, once expired, cannot be re-validated via clock manipulation?

[Admin]

It's impossible to detect the system clock rollback without getting the real date from the Internet. We can recommenв to use VMProtectActivateLicense and the licensing system will also use the date from your activation server.

[muhammadayoub]

thanks for the confirmation.

We are very satisfied with how the SDK secures our binaries and handles licensing logic, and but before purchasing the license for VMprotect, we want to confirm and try to fully automate our workflow.

Our goal is to use vmprotect_con on Linux within a CI/CD pipeline (using Make/CMake) to perform two distinct tasks:
1- Automated Compilation: We have already automated the protection of our binaries using a command like:
./vmprotect_con [input_binary] [output_binary] -pf [project.vmp]
2- Automated License Generation: We need to generate customer serial numbers (license.key) dynamically using the same .vmp project file via the Linux CLI.

Our Questions:
Is direct serial number generation supported in the Linux version of vmprotect_con? or we will have to move the binary and project file to GUI and generate the license? Do not see anything in the user manual related to this.

[Admin]

You should read the user manual about serial number generators:
https://vmpsoft.com/vmprotect/user-manu ... generators

So you can implement own tool to make anything you need.

[muhammadayoub]

Thanks,

We have 2 more queries:

1- We integrated vprotect_con in our built steps to protect out binary, however, upon running we receive this error

error while loading shared libraries: libVMProtectSDK64.so: cannot open shared object file: No such file or directory

Do we need to ship libVMProtectSDK64.so along with our binary or we can skip it somehow? our customer might have reservations about running external library along with our binary, any wayaround or safer way?
Also, if it's not possible to run the protected binary without libVMProtectSDK64.so, can we have static version of same library for Linux? We do not see it in SDK.

2- When we protected binary using vmprotect demo version, it displays a GUI pop notification Message box with text about vmprotect demo version.
Apart from that, we also see some other notification messages are displayed in the pop-up Message box for example, if we lock a function, a message box displays about permission/missing license when we reach that function during execution.
Our question:

• can we expect that demo pop-up will go away once we have licensed version of protect?
  Can we totally disable all GUI elements such as message box somehow? we want our binary to stay totally independent of any GUI element after protection. Can we do that with vmprotect

regards,

[Admin]

Do we need to ship libVMProtectSDK64.so along with our binary or we can skip it somehow?

Don't need because VMProtect removes it from dependencies during protection.

can we expect that demo pop-up will go away once we have licensed version of protect?

The full version doesn't show such message at startup.

Can we totally disable all GUI elements such as message box somehow? we want our binary to stay totally independent of any GUI element after protection.

VMProtect uses installed zenity to show a message. Without senity it shows all messages in console.