Best Way to Protect Commercial AutoLISP Applications – High-Level Security and Licensing

[Sathar]

Hello everyone,

I am an AutoLISP developer, and I am developing several AutoCAD MEP applications that I plan to sell commercially.

My applications include:

Drainage Piping System

Chilled Water Piping System

fire fighting Piping System

Water Supply System

Other MEP automation tools

I want to protect my software professionally before distributing it to customers.

I already understand that compiling LISP into FAS/VLX provides some source-code protection, but I am looking for a much stronger commercial security solution.

My requirements:

Strong source-code protection against reverse engineering and decompilation.

Secure software licensing with unique activation keys for each customer.

Online/cloud-based license verification.

Trial management (7-day or 14-day trial).

License expiration and renewal management.

Ability to deactivate or revoke a license remotely.

Hardware or machine-based activation to prevent unauthorized sharing.

Protection against system date manipulation and trial resetting.

Offline usage with a secure grace period when there is no internet connection.

Protection against users copying the application to another computer or sharing it with others.

My questions:

What is the strongest protection method currently available for commercial AutoLISP applications?

Is FAS/VLX compilation sufficient, or should I use a combination of AutoLISP, .NET DLL and an external licensing system?

Is cloud-based licensing more secure than local license verification?

Are there any professional commercial protection tools or DRM solutions specifically suitable for AutoCAD plugins?

How do experienced AutoLISP developers protect and distribute their commercial applications?

I am looking for a professional, reliable and commercially suitable solution, not just basic password protection or simple computer-name checking.

I would really appreciate advice and recommendations from experienced developers who have successfully sold commercial AutoCAD applications.

Thank you!

[mhupp]

@VicoWang might have a solution.

[VicoWang]

Thanks for @mhupp recommendation.

 

@Sathar

 

These issues you raised, I should have solved them all on VedaCAD, but all the technologies are developed specifically, without using any mature commercial solutions or public libraries, so there is no way for me to provide you with my technical implementation.

But I have an idea that might be easier to achieve, perhaps it could provide you with some ideas:

 

Notion can actually be accessed through API, all operations in Notion are graphical, such as creating a table accessible through API, when your users verify through the client, check if there is corresponding authorization information in the table. At this point, the Notion table functions like a database, avoiding the trouble of creating a database (designing a database from scratch is really Trouble, the database in the development of vedacad has been adjusted for at least over 100 rounds).

 

You need a server (even a dedicated domain is not necessary, but it needs to connect the client and the Notion API, and storing the Notion token on the server instead of hardcoding it on the client is a safe isolation strategy), let your client access your server, let the server access your Notion table, and return true/false and time to the client, and set a reasonable reconnection time interval, which should be able to implement a certain degree of online authorization verification system.

 

As long as you master how to make the client connect to a specific server endpoint, the above pattern should be achievable, unlike VedaCAD, which also needs to transmit the file itself, which is the easiest part to crash.

 

Although protecting our intellectual property is our business strategy, this forum is more open to discussions on the open-source of some simple/free plugins, hoping the above ideas can help you.

 

---

 

I have a WhatsApp group related to CAD: https://chat.whatsapp.com/BsM62YEol9SHdKoWxaeW1D

There's even a hidden expert in the group who write an AutoLisp IDE, where you might get more ideas.

Edited 17 hours ago by VicoWang

[Steven P]

For pure LISP, FAS and VLX are generally OK - commercially these are used. Unless you are selling thousands of copies for thousands each time to make it worth while to break the coding, perhaps selling a few copies to each company doesn't make it worth breaking them. It is possible but the forums (including this one) are very quick to stop any such requests.

 

I'd be happy to sell these in formats. Then of course you have sent your file out into the wild, it can be copied and sent around an office as fast as an email.

 

You could hard code each file with details specific to the computer / user (www.cadtutor.net/forum/topic/34596-computer-name/) - perhaps check (getenv "ComputerName") and (getenv "UserName") and test these against a (unique) hard coded variable in each file that you sell. Down side is you have to trust them when they want an updated file if they update their computer (Limit this to '1 updated computer every 4 years is allowed') - though you could also do a check that the AutoCAD version has also increased when requesting a new LISP file. That does mean extra work for you or your team though, and not a fully automated process.

 

These 2 should be enough to protect yourself from legitimate business stealing your code.

 

After that your protection has to come out of AutoCAD and LISP and into professional file hosting solutions - not my thing there - but one solution was to again hard code their LISP file to link to a cloud based LISP file that will return a code to the first LISP - this, computer name, user name can validate that they are in their license period and LISP can run. Benefit here is you have complete control if they can get access and of course, the date / expiry is hard coded into the remote / your LISP. I'd have one remote LISP file for each licensed File you send out. Downside here is a financial cost to maintain a web presence, with firewall and authentication systems. Since it is just a file most commercial thing should do what you want, and you need internet access for that initial validation in each CAD instance.

 

Taking that a step further, the file you sell could be a simple "appload" command linking to your remote files, once validated apploaded into that CAD instance - offline use will be OK s long as there was internet to connect and download initially for that CAD instance.

 

Noting that any remote file is not copied to their system and to access it / read it needs the user to break the encoding to get the file path, to copy it to break the coding again to copy the programming.

 

Good question - I might be out tomorrow with a systems architect and this is his thing - if I remember I'll see his thoughts, but that is who you want to talk to. It might be possible to host it all yourself.

 

 

Of the developers on here Tharwat sells his work commercially and is up to speed with protecting his stuff, he might be around to give a few pointers.

 

 

 

 

Final part - reverse engineering - if it is being used, not a lot you can do about that, just got to hope that whoever buys it realises the time and cost to remake it and that yours is a lot better value.

[BIGAL]

Like the idea of using a cloud address that is yours.

 

There is mentions in some forums of un-encrypting but how many really no how to do that.

 

Yes people do give your code to friends, for me had security so eventually worked out the code was given to some one else. So no install.

 

Some methods all lisp based.

USB

IP address on pc network card etc

Hard disk ID

Username

CAD serial number

Read registry

Read a file from a web server. Some internet providers allow you space on their site at no cost.

 

Re updating there is an old DOS command "Copy File1+file2 file3". so file1 is a lisp file with the correct security code checks, file2 is your normal lisp program code without security. You would compile file3. Pretty easy to make a BAT file for the task, did use this method very extensively. Do around 50 lisps in one go.

 

One grey area is I do custom lisps for clients so who owns the code ? Unless you have some form of right to use contract. They are provided with source code.

 

Last comment I have a Install.lsp that does all the hard work, unzips a file to correct directory with all the code dwg mnu cuix etc, adds support paths and new menu's, toolbars etc, Can do as a Bundle if needed. just ask if want more detail, saves making a MSI or EXE etc.

 

Edited 19 hours ago by BIGAL

[Danielm103]

I have a couple apps on the autodesk store. here's one XLSX field evaluator.

https://apps.autodesk.com/ACD/en/Detail/HelpDoc?appId=4867035866745163447&appLang=en&os=Win64

 

Anyway, I use Autodesk's entitlement API. All you need to do is register your application , they give you an Application id. you can see the ID in the link

all you need to do is query the server with the ONLINEUSERID. You need to be able to let the user use your application offline, my app checks at the beginning of each month 

 

here's a quick lisp sample 

 

(defun c:IsEntitled (/ http response) 
  (setq appId (getstring "Enter AppId "))
  (setq userId (getvar "ONLINEUSERID"))
  (setq url (strcat "https://apps.autodesk.com/webservices/checkentitlement?userid=" 
                    userId
                    "&appid="
                    appId
            )
  )
  ;https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms759148(v=vs.85)
  (if (setq http (vlax-create-object "MSXML2.XMLHTTP")) 
    (progn 
      (vlax-invoke-method http 'open "get" url :vlax-false)
      (if 
        (not 
          (vl-catch-all-error-p (vl-catch-all-apply 'vlax-invoke (list http 'send)))
        )
        (setq response (vlax-get http 'responseText))
      )
      (vlax-release-object http)
    )
  )
  (cond 
    ((> (vl-string-search "true" response) 0) (princ "\nTrue"))
    (t (princ "\nFalse"))
  )
  (princ)
);def

 

Quote

Command: (LOAD "C:/Users/Dan/Desktop/lisp/entitlement.lsp") C:ISENTITLED
Command: ISENTITLED
Enter AppId 4867035866745163447
True
Command:

 

 

Edited 7 hours ago by Danielm103

[SLW210]

Like @Danielm103, I was also going to suggest Autodesk Store and/or what @BIGAL stated would be my choices.

 

It really depends on what you are comfortable/familiar with.

 

Personally, unless your LISPs are really making difficult and/or complicated work easy and a lot faster, I wouldn't believe they would be big sellers since they seem targeted at AutoCAD MEP, I haven't looked at any numbers lately, but a lot of those users are slowly rolling over to Revit, I was using AutoCAD MEP occasionally, but haven't had any of that type work to do in a good while, perhaps an occasional user such as myself would be a potential customer, I am not sure what percentage of AutoCAD users "do a little of everything" like I do.

 

That is not meant to deter you, just to give an insight on what $$$ and effort you need to spend getting them secure and keeping them up. 

 

What future plans do you have on providing support? I see a lot of for purchase apps that end up having the publisher lose interest or other issues and the support goes away.