Hiding a Secret in Windows Registry

I know registry is not a best place to hide something.

Right now I'm writing a Licensing software that require to save trial usage information like first install date on registry, etc.

What hive in Windows Registry that meet this criteria :

1. Not easily discovered by accident by the Users.
2. The value can be shared amon开发者_JAVA百科g Windows Users.
3. Didn't mess up Windows and Registry Cleaning Utility not consider this value as a garbage.
4. If can, it work without administrator privileges on Windows Vista and Windows 7

Edit : I have excluded items # 4 because it is not possible with item # 2, based on answers from David Heffernan

---

There are no shared locations in the registry that can be written to without admin rights. So your conditions 2 and 4 cannot both be fulfilled. You need to do this with a file I believe.

If you are prepared to drop condition 4 then you need to store it under HKLM so that it is shared. The obvious place is HKLM\Software\YourCompanyName\YourProductName. Naturally you would encrypt the data to avoid tampering. Once you have done that then you don't really care whether or not your users discover it.

---

What are you trying to defend against? It sounds like you're putting a lot of effort into "don't let people change their system clock to extend their trial" but none at all into "don't let people edit the Registry key to extend their trial" or "don't let people share Registry keys between machines to turn trials into full keys for free". I actually think those are far more likely. Any software that yelled at me for changing the clock on my own machine would get uninstalled in a hurry.

I recommend you don't try to do this yourself. There are licensing libraries you can use that have thought of the various ways people try to trick software. But if you must, because you want to try it, then take some time to distinguish what happens at install, which might require admin rights, from what happens while you're running and checking, which should not. An app that has to run elevated for no other reason than writing license info to HKLM once a minute would also be uninstalled in a heartbeat from my machine.

So at install, write something obscure/encrypted to a Registry key under HKLM. Make it something that's not super helpful to copy from machine to machine, while you're at it, by combining say a date, an email address, and some other information. At runtime, your code should look partly at the unchanging Registry entry or entries and partly at something else that can change easily, like a file under AppData, an HKCU key, or the current date, to decide whether it's ok for the app to run. (At runtime, if the HKLM key is not there or fails a checksum or whatever, refuse to run and ask for a reinstall. Reinstall can worry about whether the person is trying to get infinite free trials.) Focus on the main ways people try to trick licensing schemes and also on being a usable application. Insisting on elevating or preventing general use of the machine fails on the usability side.

---

You can, on install, change permissions of somewhere in HKLM so that all users have write access.

If you choose a place other than HKLM\SOFTWARE\Your Company Name\something than you're being foolish.