Licensing & Anti-Piracy
The commercial backbone. It has to be hard to bypass, resilient offline, and it must never lock out a legitimate paying user — three goals that pull against each other.
Threat model
The design constraint
Anti-piracy measures fail in two directions. Too weak and the product is copied freely. Too aggressive and a paying customer on a plane, behind a corporate proxy, or with a new dock loses access to software they bought — which costs a refund, a support ticket and a review.
Pixy resolves this with a signed client–server protocol using a pinned key, hardware binding, and a deliberately tuned offline policy.
Protocol
How validation works
-
RSA-signed responses. The server signs every validation response (SHA-256/RSA); the client verifies it against a 2048-bit public key pinned inside the obfuscated DLL via an X-Server-Signatureheader, defeating tampering and man-in-the-middle. Invalid signatures are flagged distinctly, so an unsigned response is never mistaken for “offline”. -
Hardware fingerprinting. A device fingerprint is derived from WMI CPU, motherboard, BIOS and disk serials plus the SMBIOS UUID, double-SHA-256 salted. MAC address is deliberately excluded because it changes with WiFi, VPNs and docks. There is no time component — because the same fingerprint is the AES-256-GCM key for the encrypted local license file, so it has to stay stable. A persistent device GUID in the registry and a hidden file augments it. -
Offline-first and non-blocking. Tool checks return instantly from a valid local license and revalidate fire-and-forget with a 30-second cache and in-flight dedup, so the UI never blocks on the network. Time-limited passes are validated against estimated server time, not the local clock, so rolling the clock back cannot extend them. A server REVOKED or BLOCKED verdict removes the license immediately. -
Seat management. Solo is two machines with one active, enforced with lease tokens (48-hour RS256 JWTs bound to the device fingerprint) and heartbeat presence pings. A Solo user gets a capped number of self-service seat releases before an admin is looped in.
Entitlement
Two independent ribbon gates
Two gates, opposite failure modes
Classic tools unlock through RibbonLicenseState; the AI Suite through AiSuiteRibbonState. They are separate on purpose — trials unlock the classic tools but never the AI Suite.
The classic gate fails closed: no verdict means no tools. The AI gate fails open: an unreachable check leaves the AI buttons enabled, because the server meters every pixel anyway, so there is nothing to steal by getting past the button. Matching each gate's failure direction to what it actually protects is the whole point.
Defence in depth
Hardening
The whole license manager is obfuscated ([Obfuscation(Feature="all")], with no-inline and no-optimize on security methods). The server URL is XOR-encrypted in the binary, secrets are stored with Windows DPAPI, and environment- and time-integrity checks run alongside validation.
None of this makes the client unbreakable — nothing running on a customer’s machine is. It raises the cost of a bypass above the price of a licence, while the server stays authoritative for anything that actually costs money.