Introducing DiscCheckEmu (DCE)

[Luca91]

DCE is now available to download.
Grab it here (download section): https://github.com/Luca1991/DiscCheckEmu
Make sure to read the ConfigurationDocumentation.md
If you are just looking for pre-made config files go to: https://github.com/Luca1991/DCEConfigs

----------- OLD THREAD -----------

Hi all,
I'd like to let you know about a project I'm developing and that is almost ready for its first release.
IT IS NOW RELEASED AND AVAILABLE TO DOWNLOAD!
As computers increasingly lack CD-ROM drives, accessing old disc-based games and software has become impractical.
It is ofcourse possible to buy an external cdrom drive, dump games to ISO format and keep the image mounted while playing such old games, but this will result in a waste of hdd space.
It is also possible to manually patch such disc checks in every game (and trust me, it is a fun activity ) but it requires asm comprehension skills (and a bit of winapi knowledge).

So........ let me introduce DiscCheckEmu: a tool designed to emulate disc checks found in many disc-based games and software without the need for physical media. By intercepting API calls and modifying their behavior on the fly, DiscCheckEmu provides a seamless experience for users looking to enjoy their favorite legacy software without the hassle of keeping CDs or ISOs mounted. The original game executable is left physically untouched.

Current featueres:

• Intercept API calls and modify their behavior without patching the executable.
• File redirection.
• Virtual Drive definition.
• Utilize a generic API hooking engine configurable through YAML files.
• Easy to use injector for automatically creating the target process and injecting the DLL.
• Fully open-source and customizable to suit individual needs.

DCE Components:

• DCELoader: Main executable responsible for creating target process and injecting the DCEAPIHook DLL.
• DCEAPIHook: DLL used to hook APIs and modify their behavior.
• DCEConfig: YAML configuration file tailored to specific software, used by both DCELoader and DCEAPIHook.

About DCE configurations files:
DCEConfig serves as the blueprint for configuring both DCELoader and DCEAPIHook. This file must be customized by the user for each target software, detailing API hooking and process creation parameters.

An example of a configuration file:

# DCE Configuratin file
# Title: MY_GAME
# Note: copy "DATA" directory from CD to the install dir


loader:
  target: "main.exe"


virtual_drives: ['L']


hooks:
  - api: "GetDriveTypeA"
    arg1: "L:\\"
    return: 5 # DRIVE_CDROM
  - api: "GetVolumeInformationA"
    arg1: "L:\\"
    arg2: "MY GAME DISC LABEL"
    return: true


file_redirections:
  - source: "L:\\DATA\\FILE1.DAT"
    destination: ".\\DATA\\FILE1.DAT"
  - source: "L:\\DATA\\FILE2.DAT"
    destination: ".\\DATA\\FILE2.DAT"
  - source: "L:\\DATA\\FILE3.DAT"
    destination: ".\\DATA\\FILE3.DAT"
  - source: "L:\\DATA\\FILE4.DAT"
    destination: ".\\DATA\\FILE4.DAT"
  - source: "L:\\DATA\\FILE5.DAT"
    destination: ".\\DATA\\FILE5.DAT"
  - source: "L:\\DATA\\FILE6.DAT"
    destination: ".\\DATA\\FILE6.DAT"

What do you think about DCE? Would you use it? Is it an interesting project for you? Is there any additional feature you would add in such software?

 

[KleinesSinchen]

What do you think about DCE? Would you use it? Is it an interesting project for you? Is there any additional feature you would add in such software?

It is a great idea. Will try it for sure.

What is the scope of this? "Simple" disc checks or even more sophisticated binding to a specialized CD/DVD? Something like this has been implemented as commercial software before, but I assume emulating complex DRM isn't easy to say the least.

Keep up the good work.
Keep old stuff alive.

Thanks for this.

 

[Luca91]

It is a great idea. Will try it for sure.

What is the scope of this? "Simple" disc checks or even more sophisticated binding to a specialized CD/DVD? Something like this has been implemented as commercial software before, but I assume emulating complex DRM isn't easy to say the least.

Keep up the good work.
Keep old stuff alive.

Thanks for this.

Hey K, thanks for the interest in this.

The goal is to avoid patching the game executable and trick it to think that the disc in inserted.
Many games released on cdrom also loads game files directly from the disc, so I implemented a file-redirection mechanism to redirect file access on the fly (from the hardcoded path to a custom path defined by the user in the configuration file).

This is not "drive emulator", you don't have to keep the ISO file on your computer at all.

As you can image, this will not work for specialized DRMs (such SecuROM, Safedisc, Laserlock etc) as these protections rely on the disc (real or virtual) to read data used to decrypt the executable in memory and so on.
That said, in these cases, it is still possible to unwrap the DRM and then use DCE to emulate the disc checks (or disc accesses to load data).

Theorically it would be possible to emulate specialized DRMs without even a "drive emulator" (at least for older versions of Safedisc, SecuROM etc) but it requires in-deep knowledge o each version of that DRM and also obtaining and specifying the decryption key for each game (this can be read from the game). This is something interesting and I might check it out in the future. It is a lot harder and time consuming than simply removing old DRMs with x64dbg+Scylla (as I demonstrated in my technical papers) or creating an automatic unpacker/unwrapper (for example the semi-automatic SecuROM 2.9-4.68 remover script for x64dbg that I've released some time ago HERE).

If you have more questions, feel free to ask!

 

[KleinesSinchen]

Theorically it would be possible to emulate specialized DRMs without even a "drive emulator"

Let's name it: I was thinking of Game Jackal. Sadly discontinued (impossible to obtain license). It had an approach of storing only the needed parts, certain sectors, that are used during CD/DVD check. Full-fledged optical drive emulator, but needing a tiny fraction of the full image to satisfy the check.
A really interesting piece of software, but as all of these specialized things closed source.
Also: Notably one of the few applications featuring and automatic Tagés/Solidshield dumper (albeit it didn't work correctly when I tried it on "Beyond Good and Evil"). Emulating this one requires replication of the analog nature of the optical pickup positioning.

 

[Luca91]

It had an approach of storing only the needed parts, certain sectors, that are used during CD/DVD check.

IIRC these're called something like "Mini Backup Images", right? You just unlocked a memory of myself using one of these 20 years ago in my early teens (or maybe even earlier?!). Wow.

---

Anyway I'll soon release DCE and open the github repository. I just need to write some documentation about writing configuration files (DCEConfig.yaml) and we are good to go!

 

[DinohScene]

I admit I haven't fully read through this but this would be amazing for those early Windows/late DOS games that have stupid checks in place for physical presence.
At least I hope it would work :x


Nice to see you still active @Luca91

 

[Luca91]

DCE is now available to download
Please check the first post to get a link to the repository!

If you are going to give it a try please share your results

At least I hope it would work :x

Yeah, it should work

Nice to see you still active @Luca91

Thanks, time is less and less, but I still manage to do what I like from time to time

 

[KleinesSinchen]

Hmmhm. Better than late than never.
I said I'll look into it this week. Sunday… but yeah… kept the promise →

I've hit some problems and couldn't solve them – at least the last one.

First problem: My beloved Windows XP says no more than "Not a valid Win32 executable" What did I expect? → Solved by using newer Windows.​

Second problem: (Windows 7 and 10): Missing .dll files – solved by brutally installing some VCREDIST AIO package ​

Third problem is:
Error: Can't create the target process
I've just copied+pasted the first example configuration into the config file:

Spoiler

loader: target: "AG.exe" virtual_drives: ['L'] hooks: - api: "GetDriveTypeA" arg1: "L:\\" return: 5 # DRIVE_CDROM - api: "GetVolumeInformationA" arg1: "L:\\" arg2: "AWESOME_GAME" return: true

(of course it would not do anything since a game with that name is not present), but I thought the program would start up. Adjusting it to the correct names would be trivial.
What am I doing wrong? Something else missing that needs to be installed?

 

[Luca91]

I said I'll look into it this week. Sunday… but yeah… kept the promise →

Thank you very much

First problem: My beloved Windows XP says no more than "Not a valid Win32 executable" What did I expect? → Solved by using newer Windows.

I know, this should be fixable by building using v141_xp sdk. This is something that I want to have a look soon. XP compatibility is something that I want to achieve before the 1.0 release.

Third problem is:
Error: Can't create the target process
I've just copied+pasted the first example configuration into the config file:
...
(of course it would not do anything since a game with that name is not present), but I thought the program would start up. Adjusting it to the correct names would be trivial.

What am I doing wrong? Something else missing that needs to be installed?

Ok this is interesting. I assume that you have placed both DCELoader, DCEAPIHook and DCEConfig in the same directory where the exe is located, right?
If that's not the case, then the error message is actually corret.
This is the code responsible to create the target process:

PROCESS_INFORMATION Injector::createTargetProcess()
    {
        STARTUPINFO startupInfo{};
        startupInfo.cb = sizeof(startupInfo);
        PROCESS_INFORMATION processInformation{};


        if (!CreateProcessA(
            targetName.c_str(),
            nullptr,
            nullptr,
            nullptr,
            false,
            CREATE_SUSPENDED,
            nullptr,
            nullptr,
            &startupInfo,
            &processInformation))
        {
            throw std::exception("Error: Can't create the target proccess");
        }


        return processInformation;
    }

if it will not be able to create the target process due to, for example a missing target executable, il will display that error.

Please note that this is not a GUI tool: DCELoader is an injector that will just create the target process (in a suspended state), inject the DCEAPIHook dll and check for a successfull injection (after resuming the main process).

Please let me know, thanks

 

[KleinesSinchen]

D*mn I've just turned off the Windows PC before seeing your message. Now to enter the key again and wait for Veracrypt to start up on the old machine

Windows is driving me insane. Completely unrelated to your program I ran into big trouble with normal Windows Update procedure (that will go into one of my rant blog entries in a few minutes).

Okay, I thought it would start up regardless of any existing game files. "Thou shall not ignore the readme file." RTFM problem. My bad.

I'll be right back at the Windows machine after finishing the short (or not so short) blog.
============

Okay. After making sure to put everything in the correct location and giving the real game exe file the error vanished. I've assumed some background task to start up regardless of the game and not an on-the-fly manipulation of the starting process. Again: RTFM problem. That what comes from skimming over stuff.

A step closer, but not quite there. Landing in this path of Injector.cpp

{
            throw std::exception("Warning: Failed to check for sucesfull process injection");
}

and the game won't start because of missing CD. I've not monitored any API or tried to find out if "GetDriveTypeA" and "GetVolumeInformationA" are the only things the game does. You might remember the game from our PM discussion with my naive first steps into debugging. Pro Pinball: Big Race USA. It was just a shot in the dark… since a changing a single JNZ to unconditional JMP removed the whole CD check, I thought the game might be a good candidate.

For today I'm exhausted. 30 to 60 minutes of concentrated work might be a record for the last few months. I'll continue tomorrow and won't wait another full week.

 

[Luca91]

@KleinesSinchen okay I just had a quick debugging session on that game and here is what I got:

1) This game is passing driver letter without the final \ to GetDriveTypeA, so in the config file you should put "L:" instead of "L:\\".
2) The game is using mciSendCommand. This API is already supported by DCE, so this isn't an issue (but you have to setup the hook in the config file)
3) The game is using GetDiskFreeSpaceA as an additional check to make sure that the disc is real. This is the actual issue: this api isn't supported yet by DCE.

Once I'll add support to GetDiskFreeSpaceA this game should be ok.

Sorry about that. DCE is still in early development, these things happen..

Side note: the game version that I have loads files from the disc (for example from \DAT\PC\V01\...), so you might want to setup file redirections in the config file too. I'll provide a working example once I'll fix the GetDiskFreeSpaceA issue.

 

[KleinesSinchen]

Side note: the game version that I have loads files from the disc (for example from \DAT\PC\V01\...), so you might want to setup file redirections in the config file too. I'll provide a working example once I'll fix the GetDiskFreeSpaceA issue.

Did you perform custom/full installation?
No additional files from CD were needed when I patched the exe. Read: Game ran without CD. I really played and not only started to title.

I'll try a few games tomorrow, but don't have high expectations in me being able to hunt down the needed settings.

Sorry about that.

What the f…? Why sorry? Version 0.0.1 – who in their right mind would expect a finished product?

The idea for this emulator is awesome. Even if not everybody is able to fulfill the requirements for creating configs – these configs can be collected and shared… without pirated content of course.
=============
=============

No dice. I've tried a few old CDs, but none of them was suitable for the simplest example (only check for drive type and CD name). Then I ran into the 16-bit installer issue preventing me from simply installing very old games on Windows 10 64 bit without hopping back and forth between XP and 10 (same PC).
Moving on to newer software resulted in more or less everything being infected with commercial disc DRM.

For some very obscure learning software I think it might be possible to satisfy them with a lot of file redirections… but it goes over my head and concentration is on the low side once again. Interesting part is that Tivola included some kind of protection (visible ring and lots of read errors) but seemingly never checks for the presence of this. This means I was unable to create bad copies – either physical or virtual – which do NOT get accepted. Any copy is accepted.

BinaryObjectScanner has "Tivola Ring Protection" on the list, but doesn't find anything on my Tivola CDs with rings.
These kind of children's games would be as nice for kids now as they were back then – so having such usable would be really cool.
For licensed material Tivola went further and bought the highly dangerous ProtectDISC, which disqualifies such titles from being used on newer Windows at all (at least if you don't want to risk killing your Windows installation).

@Luca91 – This is the point where I want to push some old original CDs into the Ethernet cable for them to come out on your end. Copyright laws are really standing in our way here.

 

[Luca91]

Hi @KleinesSinchen
yesterday I implemented the missing hook and the game is now working
Here is a working config:

## Game: BigRaceUSA
## Note: During game installation select "CUSTOM" for a full install
## Requires DCEAPIHook >= v0.1.0


loader:
  target: "BigRaceUSA.exe"


virtual_drives: ['L']


hooks:
  - api: "GetDriveTypeA"
    arg1: "L:"
    return: 5 # DRIVE_CDROM
  - api: "GetVolumeInformationA"
    arg1: "L:"
    arg2: "BRUSA"
    arg4: 0xCFF8F9D1
    return: true
  - api: "GetDiskFreeSpaceA"
    arg1: "L:"
    arg2: 0x1
    arg3: 0x800
    arg4: 0x0
    arg5: 0x53476
    return: true
  - api: "mciSendCommand"
    arg2: 0x803 #MCI_OPEN
    return: 0
  - api: "mciSendCommand"
    arg2: 0x814 #MCI_STATUS
    status_return: 1 # SUCCESS
    return: 0

The mciSendCommand hooks are needed to avoid a (non critical) error at startup. I played for some mins, everything seems ok.
Please note that this DCEConfig requires the latest patches pushed to the repo that will be available in the next release (v0.1.0): if you can't or dont want to build from sources, please let me know and I'll send you a private build.

Did you perform custom/full installation?
No additional files from CD were needed when I patched the exe. Read: Game ran without CD. I really played and not only started to title.

I was in a rush when I installed the game and completely missed the CUSTOM flag. You are right, using custom install you can install the full game, so no file redirections needed

@Luca91 – This is the point where I want to push some old original CDs into the Ethernet cable for them to come out on your end. Copyright laws are really standing in our way here.

I would pay for protected original discs... sadly a lot of times when I pruchase games protected with interesting DRMs I end up receiving re-releases protected by... nothing xD

If you can give me a list of these games, I can try to purchase them and test them in DCE.

Post automatically merged: Mar 6, 2024

To help users figuring out what's wrong with their DCEconfig, upcoming releases of DCE will be available in two flavors:
- Release: regular, performance optimized version
- Debug: featuring a debug prompt with logs of each intercepted API

This should make life easier for users who want to write a custom configuration but can't use a debugger or don't want to install an API monitoring tool.

Example:

("--->" = data coming from the executable
"<---" = data passed to the executable)

 

[Luca91]

DiscCheckEmu v0.1.1 RELEASED:

[0.1.1] - 2024-03-07​

Fixed​

• Crash in Debug build (API Logging)

[0.1.0] - 2024-03-07​

Added​

• GetFileAttributesA hook
• GetDiskFreeSpaceA Hook
• The debug version now features a debug prompt with logs of each intercepted API

Changed​

• Refactored code for better readability.
• Various code optimizations.
• Improved project structure.

Fixed​

• Bug in GetVolumeInformationA hook

Download: https://github.com/Luca1991/DiscCheckEmu/releases/tag/v0.1.1

 

[KleinesSinchen]

Pro Pinball: Big Race USA confirmed working on my end.

Even more: I've just copied the config file and replaced "BRUSA" with "Timeshock!" and this worked for the older game. This was a threefold test: Windows 10, DiscCheckEmu and Timeshock.exe

Spoiler: Side note for Windows and the game error handling

The files on the CD date back to 1996. At this point I have to say I'm impressed Windows 10 just runs it! Really: 32 Bit software going near the 30 year mark just works unmodified on current Windows! The installer is thankfully not some legacy 16 bit thing (but for older computers there is a DOS version on the CD as well!)

The Timeshock! game is fault tolerant and works normally without CD. Since the music is normal CDDA, a real CD (or a full optical drive emulator) is required for playing music. It was a brilliant idea back then to have the CD drive do the work for providing music and not use CPU for decoding – we are talking about compatibility to 80486DX2 CPUs running at 66Mhz¹ with 8MB RAM and 1MB of graphics card memory for playing an outstanding pinball simulation.

My original Timeshock! CD is damaged (discoloration in the music area) but was fully working two years ago when I burned a copy.




____________________
¹In far worse quality (resolution) Timeshock! is available for the even weaker PlayStation 1

So far DiscCheckEmu looks convincing →

I need to search the original CD of "The Web" which is the first one in the series. This is not compatible to Windows NT operating systems and requires setting compatibility mode to Windows 95 or Windows 98 to start. Will this cause problems?

 

[Kwyjor]

Seems like it would certainly have its uses, but it looks to me like one of those diminishing-returns things. Yes, it might be inconvenient to mount a disc in a virtual drive all the time, but it looks like it would also be inconvenient to hammer out a configuration file and debug inevitable issues with the configuration file.

 

[KleinesSinchen]

Yes, it might be inconvenient to mount a disc in a virtual drive all the time

CD images are big. Doing a full installation of a game and keeping the same data as CD image doubles the required storage. This is a huge waste and anything but elegant. And yes, this *is* still important nowadays – especially on laptops with smaller SSDs. On older systems it is even more important. Back then I tried to have everything on physical CDs to save HDD space.

The commercial solution Game Jackal was a brilliant compromise in this regard even emulating many protections.

 

[Luca91]

Pro Pinball: Big Race USA confirmed working on my end.

Even more: I've just copied the config file and replaced "BRUSA" with "Timeshock!" and this worked for the older game. This was a threefold test: Windows 10, DiscCheckEmu and Timeshock.exe

YAY

Seems like it would certainly have its uses, but it looks to me like one of those diminishing-returns things. Yes, it might be inconvenient to mount a disc in a virtual drive all the time, but it looks like it would also be inconvenient to hammer out a configuration file and debug inevitable issues with the configuration file.

Hey, thanks for your feedback. Well, I agree that writing a DCEConfig file requires some technical knowlegde. This could be solved by having a repository where storing DCEConfig files (without any other binary file or copyrighted stuff): that way the only required thing is having the original game disc, installing the game and grab a pre-made config. Someone already asked for this and I'm not against it, if someone want to do it

Post automatically merged: Mar 8, 2024

I've just copied the config file and replaced "BRUSA" with "Timeshock!" and this worked for the older game

You can probably remove the "arg4: 0xCFF8F9D1" line from the configuration targeting Timeshock! then

 

[Kwyjor]

This is a huge waste and anything but elegant. And yes, this *is* still important nowadays – especially on laptops with smaller SSDs.

But in cases like that you'd probably want to have a gigantic external drive anyway. Looks like you can get a 128 GB thumb drive for something like $15 these days? Sure, that's not large enough for every game ever made, but I am perpetually baffled by those who seem to think they absolutely need to have access to every game ever made all the time wherever they go. But that's just me.

This could be solved by having a repository where storing DCEConfig files (without any other binary file or copyrighted stuff): that way the only required thing is having the original game disc, installing the game and grab a pre-made config. Someone already asked for this and I'm not against it, if someone want to do it

Sounds lovely – but then someone's going to have to maintain that repository and respond to requests to fix problems in the repository and do things like figure out when there's multiple versions of a game with mutually-incompatible requirements, and so on. Not something I'd like to volunteer for. :-/

By the way, does _inmm.dll already support redirecting these API calls? Would it be worth integrating this functionality with _inmm.dll or vice-versa? (Do people even still use _inmm.dll?)

 

[Luca91]

do things like figure out when there's multiple versions of a game with mutually-incompatible requirements

That's why I suggested (not on this forum) to put a comment at the top of the config file specifing the exact ISBN of the target game! This should be enoug to avoid this kind of problems. But yeah, someone still have to manage a repository, that's 100% correct!

By the way, does _inmm.dll already support redirecting these API calls?

Uhm, IIRC _inmm.dll is for audio playback, am I wrong?