Unique Hardware Id


andyw

Still Fresh
Joined
Jul 29, 2010
Messages
6
Hi Chaps,

Does anybody know if each Pandora device has a unique hardware ID?

Cheers,

Andy
 
The MAC address is supposed to be unique, particularly for a manufacturer, but as sebt3 stated above, it can be changed or spoofed.

I'm currently working on a multi-platform commercial game and we may consider porting to Pandora (I'm very keen on the idea). However, this will only happen if we can find a way to lock it down to help avoid piracy. Sure, there's plenty of problems that are associated with using a unique hardware ID, but it's a start.

We certainly wouldn't consider releasing a game or application for Pandora without a better understanding on how we can avoid the software being pirated. Yes, this is a very small userbase - but wouldn't it be nice if more commercial companies paid interest? If there was a solid standard for protecting software on Pandora then I'm sure other developers would embrace the technology more.

Any thoughts on this would be most appreciated.

//Andy
 
There is just no way to lock software down on Pandora .. the best you could do is ship your app on SD card and build it so that it will only run off that SD card .. you can obtain the SD card ID by reading it from somewhere in /proc or /sys, I seem to remember ..
 
The SD Card is a fairly simple solution (although not completely secure), but it's not great when you're aiming for digital distribution :(
 
I'd say you should take it up with Craig as an issue for future releases, but I don't think you're going to be happy. It *is* the Open Pandora after all ..
 
I'd start trolling all the old info for all previous handhelds (Palm OS, WinCE/PocketPC, etc) ..

I thought originally we could get a unique-id from the chip, but seems we can't (I had hoped to build it into libpnd as a core function to encourage commercial apps :/) -- for ebook readers, Palm OS, etc, it was common to get a 'reasonably unique' value. Heck, ereader still embeds the customers full credit card number in the file, so they can trace it back to the buyer (and no one is going to distribute their files with that in 'em!) Binding to the credit card name + mac-address might be unique-enough .. people could rename their devices to match the app, but it would be a pita for them to do that for multiuple pirated apps, and in a small community, showing someones name inthe intro 'sold to Jimmy Hand!' would get some roasted quick. (assuming you can crypt the file reasonably well, that they don't get unpacked really quickly. I leave that as an exercise to the reader, but a lot of successful systems exist. One of my tricks was to include the decrypter spread across several different ASM's with a few interpreters present, made it a right pita to crack)

(By the same token, hopefully the community will be large enough to support bigger indie or commercial offerings)

jeff
 
My CPUid is 0, so this feature is desactivated somewhere.
I don't know any hardware unique id.

why not taking the other way around : only produce unique PND for each paid download. So in the worst case scenario, you'll know who "share" his game.
By the way, pirate won't find any support here.
I for one will report every pirated copy I found.
 
Thanks for all the replies.

Well, I guess it was a bit of wishful thinking expecting a unique hardware ID - looks like I'll need to do a little experimenting before I can proceed :)

//Andy
 
GP32X in general is very welcoming of commercial endeavours. That's not to say that they don't get pirated but there is respect that we don't get that many commercial games and most efforts are supported.

I'd say making each copy unique with some personalised watermark would be the way to go.
 
Has anybody looked at CONTROL_FUSE_OPP1_VDD1 (physical address 0x4800 2380) yet? The manual says it "differs between devices". It could be the same for chips produced at the same time, though.
 
another good suggestion would be to create a PGP signed variant... where the pnd had an embedded PGP-like signature that would also be emailed to the purchaser noting that it is the "Unique PND-ID" of the game/software and copying is highly discouraged, as said "Unique PND-ID" can be tracked. But this begs the question: what does the company do if the purchaser decides to sell their digital property? Also, begs the question: how does the company respond to customers who's computers or even pandora's security is compromised online and their software happens to be something that was stolen? The problem with digital theft is that copying can hide the fact that the item is actually stolen. If I "borrow" or use your computer with permission, but copy files from there without your permission, this IS stealing, but you may never know because the files are still there when I'm done with your device. I was thinking that a form of "copy once" or "no-copy" functionality (similar to items created in the game Second Life... which would be PHENOMINAL if someone was able to make a pnd of one of the clients out there like Emerald or Imprudence... but I digress) could be embedded into the file, but that would eliminate the package being emailed to them as well as providing a download link by email (unless that download link was unique and only worked once, requiring the purchaser to request a new download link if the software was lost, deleted or stolen... still breakable though, because humans are capable of lying (and locally selling off the "legit" copies they illegally accquired)... so this is a tough and touchy subject.

In the end, my fall-back is always to consider pricing that limits the desire to pirate (similar to the humble indie bundle "experiment" where more Linux users bought the software than Mac and Windows. Also, since you could pay whatever you wanted, it was also interesting to see that Linux users paid almost double, on average, than Mac and Windows users. Which leads me to believe that if the pricing seems fair to the masses, they will be more than willing to pay and rarely willing to pirate. Similar thing happened back when MP3s first became individually purchasable for 99 cents. Music pirating dropped drastically because the price seemed fair enough to "most". Just my two cents about the whole concept here... hope it makes change. :D
 
skeezix said:
I thought originally we could get a unique-id from the chip, but seems we can't
Are you sure? When uboot starts, it prints the CPU die ID number to the UART console which I thought was unique to each chip. Is that not true?
 
Last edited by a moderator:
MWeston said:
skeezix said:
I thought originally we could get a unique-id from the chip, but seems we can't
Are you sure? When uboot starts, it prints the CPU die ID number to the UART console which I thought was unique to each chip. Is that not true?
only one CPU per die?.... B)
 
Last edited by a moderator:
MWeston said:
skeezix said:
I thought originally we could get a unique-id from the chip, but seems we can't
Are you sure? When uboot starts, it prints the CPU die ID number to the UART console which I thought was unique to each chip. Is that not true?
a quick browse in the 2.6.35 kernel repo shows that the feature might be available in hw, as it was present in older OMAP generations, but currently is not utilized for OMAP3/4 in the kernel.

older gen omaps:

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/arch/arm/mach-omap1/id.c#L148

current gen omaps (die ID referenced only in the context of 24xx):

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/arch/arm/mach-omap2/id.c#L120
 
Last edited by a moderator:
AndyW said:
The MAC address is supposed to be unique, particularly for a manufacturer, but as sebt3 stated above, it can be changed or spoofed.

I'm currently working on a multi-platform commercial game and we may consider porting to Pandora (I'm very keen on the idea). However, this will only happen if we can find a way to lock it down to help avoid piracy. Sure, there's plenty of problems that are associated with using a unique hardware ID, but it's a start.

We certainly wouldn't consider releasing a game or application for Pandora without a better understanding on how we can avoid the software being pirated. Yes, this is a very small userbase - but wouldn't it be nice if more commercial companies paid interest? If there was a solid standard for protecting software on Pandora then I'm sure other developers would embrace the technology more.

Any thoughts on this would be most appreciated.
//Andy

a USB or SDIO encryption/decoding/key dongle might work somewhat if its not possible to simply crack the game code:
put lots of game data into the dongle so cracking the code wont provide the data.
but then you can't update, its expensive, it can be cracked with enough motivation and it prevents digital distribution.

unique hardware IDs wont work:
mac addresses can be changed
SD card IDs can be changed
CPU serial numbers can be changed: simply recompile the linux kernel & drivers so they return the value of your choice.

it'll just piss off the non-pirating users.

its like using those huge unbreakable steering-wheel locking devices on your car, not realizing it takes less time cut the steering wheel itself with a powertool than it takes you to remove the lock with your key, and/or they'll just come with a towing truck if its really that popular of a car.

but hey, if it helps you sleep a night, good for you :D
 
Last edited by a moderator:
I'm guessing that releasing a game with DRM to this community is not going to go over well. I also think its going to be nearly impossible to lock it down.
 
pder said:
I'm guessing that releasing a game with DRM to this community is not going to go over well. I also think its going to be nearly impossible to lock it down.
It depends on the DRM.
Something like Steam might be too much for a single game, on a system where I wouldn't want any more processes running than necessary.
An SD card key wouldn't be a problem, but they said digital distribution.
A CPU keylock would be fine, but if just one person bothers to re-compile a kernel that can fake its CPU ID, then any number of pirates willing to swap out their kernel for an unsupported one will be stealing your game.

Just do your best
, and remember that digital copies are easy to make, you only have to keep the download / authentication servers running, so don't overcharge for the game and piss off your customers.

I can't imagine running a console and paying $60 for a game. It's a bit of plastic in a case. It costs them electricity to copy and plastic to print. There's not even servers involved. Usually. They always screw up and close them down, eventually. I heard Halo 2's servers died...
 
Last edited by a moderator:
Hi Chaps,

Thank you for all your responses.

After some deliberation, we've decided to stick to our current target platforms. If we obtain sufficient monetary reward from these then we will definitely produce versions for Pandora.

Considering the size of the Pandora community (and the fact that you're all lovely honest chaps!) we won't use any form of DRM (although watermarking may happen).

These aren't AAA games and we're not looking to charge a huge amount for them. Rather, we're aiming for pocket money - just enough to help us pay the bills and continue to do what we know and love.

Cheers,

Andy
 
Back
Top