The way the other hardened copy protection schemes I have seen work is that they determine a set of parameters that likely vary on every machine. They then hash them to together to produce a signature. Each signature then has a complementary unlock key that can be generated by some sort of crypological process that will tell the program that it is valid. The program then looks for the unlock key at startup or it doesn't work. The unlock code is either a text file or written into the executable directly. It doesn't need to be a hidden file, as it only works on the machine it is set up for. The trick to making this work is finding unique enough parameters and preventing people from patching around the cross-check, which you do by having a bunch of sanity checks in various places to detect altered security code. Steve Cooper has suggested it is somehow locked to the machines hard drive in some fashion. Which could be by doing something like querying the OS for the manufacture ID and serial number of the HDA. Bypassing this would either require that you install a patched disk driver (yeah, bet on OS stability and your personal security after you install a device driver written by a cracker.) or editing the program to eliminate the security checks, which should be very difficult if it is correctly written.