Floating Licenses

Floating license versions of IDA use FlexNet License Manager from Flexera to ensure license compliance.

Table of Contents

• Guides
• License server
• Download links
• Installing the license server & Hex-Rays daemon
• Getting the Host ID
• Activating and Installing the license
• Configuring clients
• Firewall issues
• License borrowing
• Running the license server in a virtual machine or in the cloud

Guides

License server

A license server is required for floating license versions. It needs to be installed on a dedicated machine in your network which is accessible over TCP/IP from the workstations that will run IDA.

The license server consists of two parts:

1. The license server manager
   Called 'lmadmin', it is provided by Flexera. If you do not already have the FlexNet license server manager installed, download and install it from the links below.
   We also provide the now-deprecated, console-only 'lmgrd' server. This is the predecessor to 'lmadmin', and provide only a subset of its features.
2. The vendor daemon
   Called 'hexrays(.exe)', it is provided by Hex-Rays. This binary needs to be placed next to the license server manager executable, 'lmadmin(.exe)' (or 'lmgrd(.exe)')
   You also can use another path, but you will need to edit the VENDOR line in the license file sent to you during the activation.

Download links

Please choose the platform where your license server will be running. It does not have to be for the same platform as IDA; any license server can manage IDA versions for different OSes.

Platform	lmadmin (recommended) (web-based UI server)		lmgrd binary (command-line based server)	Hex-Rays daemon	Utilities
	interactive installer	package for manual install
Microsoft® Windows® x64	installer	zip package	lmgrd.exe binary	hexrays.exe binary	lmtools lmutil FNLS1
Linux x64 (LSB Certified™)	installer	tgz package	lmgrd binary	hexrays binary	lmutil FNLS1
macOS® (universal2)	installer	tgz package	lmgrd binary	hexrays binary	lmutil
All	License Administration Guide
Versions	11.19.1.0		11.18.1.0	11.18.1.0	11.18.1.0

1. FNLS is FlexNet Licensing Service, required when locking to a VM UUID.

Installing the license server & Hex-Rays daemon.

lmadmin server

The recommended server is 'lmadmin', which provides a web-based UI for configuring and managing the license server. If you do not yet have one installed (e.g. from using other FlexNet-bases software), please download the installer above and run it on the server machine.

- Installing on Windows
- Installing on Linux
- Installing on OS X

Post-install steps (common)

1. Download the hexrays daemon from the table above and put it next to the lmadmin executable. Mark it as executable ("chmod +x hexrays") on Linux/OS X.
2. Start lmadmin if it's not running
3. open a Web browser and go to http://<servername>:8090/
4. Click on "Administration", login with user "admin" and password "admin". Change password if requested or see next step.
5. Click on "User Configuration", then click "Edit" next to "Administrator", and change the password to a secure value (you can change the username too)

 

Getting the Host ID

Now that the license server & its companion 'hexrays(.exe)' are installed, it is time to request the FlexLM floating license that corresponds to the IDA license you possess.

That floating license needs to be locked to the machine the license server will be running on (not the machines IDA will run on). To request the license file for the first time, you will need a Host ID (an Ethernet MAC address).

You can use the following means of getting the host ID:

• Using lmadmin (recommended)
  1. Open the lmadmin UI (go to http://servername:8090 in the browser)
  2. Go to the Administration tab ? System Information
  3. Copy the string to the right from the "Ethernet Address" entry (pick a permanent one if there are several).
• Using lmutil
  1. Download the lmutil tool
  2. From console/command prompt, run "lmutil lmhostid"
  3. Copy the first entry from the list (without quotes)
• Using system utilities
  • On Windows: from command prompt, run "ipconfig /all | more", then take "Physical Address" value for the physical Ethernet card.
  • On Linux/OS X: from command prompt, run "ifconfig | more", then take "ether" value for the physical Ethernet card.

Please choose a MAC for a physical card which is always present.

If you want to use locking to a VM UUID, please download the FNLS package above and follow the directions in readme.txt.

Activating and Installing the license

Once you have the Host ID, submit it to our activation page together with the ida.key from an IDA install:

https://hex-rays.com/activate

You will receive the .lic file (it's a plain text file) by email. Save it on disk and use it the following way:

• If using lmadmin:
  1. Go to Administration tab, Vendor Daemon Configuration.
  2. Click "Import License" and browse to the saved .lic file.

  Make sure the "hexrays" daemon binary is installed in proper location (e.g. "hexrays.exe" in lmadmin's directory). If you are using another path, edit the VENDOR line in the .lic file before submitting:

  VENDOR hexrays <path_to_daemon>
  

• If using lmgrd:

  You will need to pass the filename to the .lic file on the commandline using the -c switch. See the License Administration Guide for details.

NOTE: If you have multiple .key files and want to activate them with the same host id, submit each of them for activation. Our server will keep track of all licenses activated for the same host id and will prepare a combined .lic file for them. In other words, just use the latest .lic file you received from the server. There is no need to install multiple .lic files.

NOTE: once a Host ID is submitted, it is fixed in our database and can be changed only by a manual request to support@hex-rays.com. You can, however, request the .lic file again by entering the same Host ID.

Configuring clients

Windows

On Windows, you can just run IDA and open a file. On the first run this will produce an interactive dialog where you can enter the license server's name. You can also set the environment variable like for Linux and OS X.

Linux/OS X

To tell IDA the location of the license server you can either use an environment variable:

export HEXRAYS_LICENSE_FILE=@servername

or a settings file:

echo "HEXRAYS_LICENSE_FILE=@servername" > ~/.flexlmrc

Firewall issues

Checking out a license requires two TCP connection: one to the license server, and one to the vendor daemon. If you're using a firewall, you need to make sure that both connections are not blocked both on the server and the client (IDA workstation).

The default port range used by the license server is 27000-27009. The vendor daemon uses a dynamic port by default, so it changes on every run. To change or fix the ports, you can use the Web UI, or edit the .lic file.

Web UI (lmadmin)

The port for the license server can be changed in "Server Configuration" tab, "License Server Configuration" section. The vendor daemon port can be changed in the Vendor Daemon Configuration tab, settings for the "hexrays" daemon. You may need to restart the vendor daemon and/or license server for the changes to take effect.

.lic file

The license server port can be specified on the SERVER line, e.g.:

SERVER this_host 001122334455 29000

The vendor daemon port can be specified on the VENDOR line, e.g.:

VENDOR hexrays PORT=30000

You will need to re-import the .lic file (for lmadmin) or restart the server (for lmgrd) after editing it.

If you change the license server port from the default, you will need to specify it in IDA's server path, e.g.: 29000@servername.

License borrowing

By default our licenses allow borrowing for offline use for up to 4320 hours (this can be disabled or limited by the server administrator).

Since IDA 7.2, borrowing can be performed directly in IDA (menu Help, Floating Licenses), but you can also use the below procedure.

To borrow a license, run the lmborrow utility on the client before running IDA:

lmutil lmborrow hexrays <enddate> [time]

enddate is the date the license is to be returned in dd-mmm-yyyy format. time is optional and is specified in 24-hour format (hh:mm) in the local time. If time is unspecified, the borrow period lasts until the end of the day.
For example:

lmutil lmborrow hexrays 20-may-2014 13:00

Note: make sure to actually check out the necessary license(s) before disconnecting from the network. For example, open a file in IDA (to check out IDA's license) and decompile a function (to check out the decompiler's license).

To check the status of borrowed licenses, run:

lmutil lmborrow -status

To perform early return of the borrowed license at the end of your offline work, reconnect your system to the network and run:

lmutil lmborrow -return [-c @servername] <feature>

Where feature is the name of the borrowed feature that is listed in the "lmborrow -status" output. For example:

lmutil lmborrow -return -c @myserver IDASTAFW

You can also set the LM_BORROW environment variable manually instead of using lmutil. Please see the License Administration Guide for more information.

Running the license server in a virtual machine or in the cloud

You may run the license server in a virtual machine. We do not recommend it, because the MAC address of the VM network adapter is often changed when moving or cloning the VM. However, some cloud providers offer more permanent identifiers:

Amazon EC2

It is possible to lock the license server to an Amazon EC2 instance. For this please attach an Elastic Network Interface (ENI) to the instance and specify its MAC address as the host ID. Locking to the EIP is not supported at this time.

Other providers

If the cloud provider offers a permanent MAC address or a public IPv4 address, you can use it as the host ID. The IP must be exposed directly to the guest OS (no NAT/VPN or similar translation) and be the first in the adapter list.

Use lmutil lmhostid -internet to confirm that the global IP is exposed to the guest before using it for activation.

See also the License Administration Guide(Chapter 16: Licensing in a Cloud-Computing Environment) for more info.

On-premises VM (VMWare ESXi, Microsoft Hyper-V etc.)

Use the FNLS package to enable VM UUID locking. Make sure you use output of lmutil lmhostid -uuid for locking.

Containers (Docker)

Running the server in Docker is not supported.

Further information

Please see the License Administration Guide. Contact us if you have any questions or problems.