DeviceLicense.cs

using Microsoft.Win32;
using System.Management;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.Json.Serialization;

namespace SolidMatrix.DeviceLicenses;

public class DeviceLicense
{
    [JsonPropertyName("iss")]
    public required string Issuer { get; set; }

    [JsonPropertyName("aud")]
    public required string Audience { get; set; }

    [JsonPropertyName("sub")]
    public required string Subject { get; set; }

    [JsonPropertyName("uid")]
    public required Guid DeviceGuid { get; set; }

    [JsonPropertyName("iat")]
    [JsonConverter(typeof(DateTimeOffsetConverterUsingUtc))]
    public required DateTimeOffset IssueAt { get; set; }

    [JsonPropertyName("exp")]
    [JsonConverter(typeof(DateTimeOffsetConverterUsingUtc))]
    public required DateTimeOffset ExpireAt { get; set; }

    public DeviceLicense() { }

    public static string Encode(DeviceLicense license, string privatePem)
    {
        ArgumentNullException.ThrowIfNull(license);
        ArgumentNullException.ThrowIfNull(license.Issuer);
        ArgumentNullException.ThrowIfNull(license.Audience);
        ArgumentNullException.ThrowIfNull(license.Subject);

        var json = JsonSerializer.Serialize(license);
        var payload = Encoding.UTF8.GetBytes(json);

        using var rsa = RSA.Create();
        rsa.ImportFromPem(privatePem);

        var signature = rsa.SignData(payload, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var pubkey = rsa.ExportRSAPublicKey();

        var sb = new StringBuilder();
        sb.Append(Convert.ToBase64String(pubkey));
        sb.Append('.');
        sb.Append(Convert.ToBase64String(payload));
        sb.Append('.');
        sb.Append(Convert.ToBase64String(signature));
        return sb.ToString();
    }

    public static string Encode(DeviceLicense license, byte[] privateKey)
    {
        ArgumentNullException.ThrowIfNull(license);
        ArgumentNullException.ThrowIfNull(license.Issuer);
        ArgumentNullException.ThrowIfNull(license.Audience);
        ArgumentNullException.ThrowIfNull(license.Subject);

        var json = JsonSerializer.Serialize(license);
        var payload = Encoding.UTF8.GetBytes(json);

        using var rsa = RSA.Create();
        rsa.ImportRSAPrivateKey(privateKey, out _);

        var signature = rsa.SignData(payload, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        var pubkey = rsa.ExportRSAPublicKey();

        var sb = new StringBuilder();
        sb.Append(Convert.ToBase64String(pubkey));
        sb.Append('.');
        sb.Append(Convert.ToBase64String(payload));
        sb.Append('.');
        sb.Append(Convert.ToBase64String(signature));
        return sb.ToString();
    }

    public static DeviceLicense? DecodeVerify(string licenseString)
    {
        try
        {
            var res = SplitedLicenseStringToBytes(licenseString);
            if (res == null) return null;
            (byte[] pubkey, byte[] payload, byte[] signature) = res.Value!;


            using RSA rsa = RSA.Create();
            rsa.ImportRSAPublicKey(pubkey, out _);

            if (!rsa.VerifyData(payload, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1))
                return null;

            var license = JsonSerializer.Deserialize<DeviceLicense>(payload);
            return license;
        }
        catch
        {
            return null;
        }
    }

    public static DeviceLicense? Decode(string licenseString)
    {
        try
        {
            var res = SplitedLicenseStringToBytes(licenseString);
            if (res == null) return null;
            (_, byte[] payload, _) = res.Value!;

            return JsonSerializer.Deserialize<DeviceLicense>(payload);
        }
        catch
        {
            return null;
        }
    }

    private static (byte[], byte[], byte[])? SplitedLicenseStringToBytes(string licenseString)
    {
        try
        {
            if (licenseString == null) return null;

            var tokens = licenseString.Split('.');

            if (tokens.Length != 3) return null;

            var pubkey = Convert.FromBase64String(tokens[0]);
            var payload = Convert.FromBase64String(tokens[1]);
            var signature = Convert.FromBase64String(tokens[2]);

            return (pubkey, payload, signature);
        }
        catch
        {
            return null;
        }

    }

    public static string GeneratePrivatePem()
    {
        using var rsa = RSA.Create(4096);
        return rsa.ExportRSAPrivateKeyPem();
    }

    public static byte[] GeneratePrivateKey()
    {
        using var rsa = RSA.Create(4096);
        return rsa.ExportRSAPrivateKey();
    }

    private static readonly byte[] HASH_SECRET = Encoding.ASCII.GetBytes("iOiJTb2xpZE1hdHJpeCIsImF1ZCI6Ilx1N0VDRFx1NTE3NFx1NzM4OVx1NjYwNlx");

    public static Guid GenerateDeviceGuid()
    {
        var windowsId = GetWindowsMachineId();
        var cpuId = GetCPUId();
        var baseBoardId = GetBaseBoardId();

        if (windowsId is null) throw new Exception("Failed to get device guid");
        if (cpuId is null) throw new Exception("Failed to get device guid");
        if (baseBoardId is null) throw new Exception("Failed to get device guid");

        var combinedId = $"{windowsId}{cpuId}{baseBoardId}";

        using var hmac = new HMACSHA256(HASH_SECRET);
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(combinedId));

        return new Guid(hash.AsSpan(0, 16));
    }

    private static string? GetWindowsMachineId()
    {
        const string REG_PATH = @"SOFTWARE\Microsoft\Cryptography";
        const string REG_NAME = "MachineGuid";

        using var key = Registry.LocalMachine.OpenSubKey(REG_PATH);
        var ko = key?.GetValue(REG_NAME);
        if (ko is null) return null;

        if (ko is string id) return $"<OS-BEGIN>{id}<OS-END>";

        return null;
    }

    private static string? GetCPUId()
    {
        const string PROPERTY = "ProcessorId";
        const string QUERY = $"SELECT {PROPERTY} FROM Win32_Processor";

        var sb = new StringBuilder();

        using var searcher = new ManagementObjectSearcher(QUERY);

        int index = 0;
        foreach (var mo in searcher.Get())
        {
            var value = mo?.GetPropertyValue(PROPERTY);
            if (value is null) return null;
            var id = value.ToString()?.Trim();
            if (id is null) return null;

            sb.Append($"<CPU-{index}-BEGIN>");
            sb.Append(id);
            sb.Append($"<CPU-{index}-END>");
            index++;
        }

        if (sb.Length > 0) return sb.ToString();
        return null;
    }

    private static string? GetBaseBoardId()
    {
        const string PROPERTY = "SerialNumber";
        const string QUERY = $"SELECT {PROPERTY} FROM Win32_BaseBoard";

        var sb = new StringBuilder();

        using var searcher = new ManagementObjectSearcher(QUERY);

        int index = 0;
        foreach (var mo in searcher.Get())
        {
            var value = mo?.GetPropertyValue(PROPERTY);
            if (value is null) return null;
            var id = value.ToString()?.Trim();
            if (id is null) return null;

            sb.Append($"<BASEBOARD-{index}-BEGIN>");
            sb.Append(id);
            sb.Append($"<BASEBOARD-{index}-END>");
            index++;
        }
        if (sb.Length > 0) return sb.ToString();
        return null;
    }
}