Introducing DiscCheckEmu (DCE)

[4d1xlaan]

That's sick actually

 

[Luca91]

Luca, I feel guilty for having been unable to do tests. My little work performance went into securing my computers and trying GrapheneOS on the only Pixel device in price range (4a).

Hey K!
Don't feel guilty at all Good luck with these interesting projects !

PhenoProtect crossed my path only once: On Carrera Grand Prix -- which I bought for that exact reason. Several hundred MB on the CD are intentionally bad sectors and it seems the protection checks for this on installing the game only (still a CD check present for starting the game).
Copying the CD is trivial though. It takes half an hour or so to quickly skip over the bad sectors with CloneCD or Alcohol 120% (with old Plextor drives Blindread should be able to dump the disc as if there weren't any bad sectors).

Yeah Carrera Grand Prix is actually the only known game that employ phenoProtect and you are right: the protection is actually triggered in the installer. The game is working in DCE on you copy a file from the disc, here is the DCEConfig file if you want to have a look.
When I'll have some free time (I've been so busy at work lately) I'd like to reverse engineer the installer to document how these bad sectors are actually checked by the DRM. This catches my interest.

I really have to kick myself into the butt and get to continuing tests. Your project is awesome and deserves more attention.

Haha thank you very much, but as I said, please no rush and take your time

That's sick actually

Thank you very much @4d1xlaan !

Post automatically merged: Jun 8, 2024

-----
@KleinesSinchen I had some fun with phenoProtect today: I was able to completely bypass the DRM check (that take place during game installation) by manually extracting InstallShield cab files (using UniExtract v2) and using a debugger to just patch the registry apis and cd-check in the launcher.

Next time I'll try to decompile the installshield script and completely remove phenoProtect from the installer.

Quite a funny DRM, not a good one, but at least using some original ideas!

 

[Luca91]

@KleinesSinchen today I sucessfully patched the inx file, skipping the phenoProtect check from the installer. I'll wirte a technical paper about this, as it was an interesting adventure.

 

[KleinesSinchen]

Quite a funny DRM, not a good one, but at least using some original ideas!

That is what happens if somebody tries building DRM themselves… and has no idea what they are doing.

On the other side: If you want to do this:

I'll wirte a technical paper about this, as it was an interesting adventure.

It has to be better than the following example.
Of course everything below the line goes somewhat off-topic. But in the end I just want to bring in possible examples that might be possible to emulate at some point with DiscCheckEmu.
↓↓↓

---

There is a children' TV series called Löwenzahn [en.wikipedia.org].
End of the 1990s, time of the "Interactive CD-ROMs" (often with QuickTime 3 → ). They produced a series of educational games(?) based on the educational TV series. From part 3 on they are "protected". Part 1 and 2 are just standard CDs. 3 and 4 have one of these custom bad sector ring protections. Nothing CloneCD couldn't handle back then already with default settings.
For the later parts I don't know exactly what they contain (I found only 1,2,3,4 on flea market).


I would love to link the source, but it would be linking piracy.
Somebody uploaded these things to the internet archive as standard ISO images, which will trigger an error screen when trying to start the game after installation (ccd/img or mds/mdf image would work). For Löwenzahn 7 there is an explanation how to get rid of the protection:

After installation, simply delete the file “optgraph.dll” from the installation directory. Usually under-> C:\Terzio\Löwenzahn7
...and off you go!

If that is true, this is some really high security copy protection.

Spoiler: Screenshots and photos

From my Windows XP computer ("Optical Drive Beast") with Plextor Premium, Rawdump compatible DVD-ROM and modern (SATA) DVD-RAM.

Trying to start Löwenzahn 3 without a CD gives a generic "Please insert CD" error


Here Löwenzahn 3 image is mounted by WinCDEmu, not by Alcohol 120%.


The simple emulator isn't good enough (that was my goal). To be honest it was pretty hard to trigger the protection since it is satisfied with pretty much everything else.

This CD is copy protected.
Please insert the original.

The program will end now.

No problems when mounted with Alcohol 120% or inserting a clone copy.



Hard to capture with camera, but the ring is visible on the outer part.


Last note: Think back to end of 1990s. HDD space was a concern and a full interactive CD-ROM with video and audio material usually didn't install all data. The installer only transfers a minimum to start the program and all data is loaded from CD on the fly.

 

[linuxares]

Will it support Starforce? :3

 

[KleinesSinchen]

Will it support Starforce? :3

Satisfying CD-COPS and StarForce requires accurate measurement of absolute data position.
Not even talking about the troublesome behavior of StarForce. For this infamous thing complete removal with a crack is the preferred method to make games compatible with newer Windows.

 

[Luca91]

Hi,

a bit off topic: I just released phenoProtect reverse engineering technical paper HERE.

3 and 4 have one of these custom bad sector ring protections.

Hey @KleinesSinchen do you know if this DRM has a name? Or is it just a custom in-house one?
Anyway that face in the disc covers is so fking creepy

Will it support Starforce? :3

Sadly no. I have yet to reverse engineer a Starforce sample. I bought a couple of protected games (starforce 3) a while back, but I haven't had a chance to try them yet. It is in my TODO, as for ProtectDVD.

 

[KleinesSinchen]

Hey @KleinesSinchen do you know if this DRM has a name? Or is it just a custom in-house one?

Never found any name for that and scanning programs output nothing.

I've more of those CDs with a ring. Some Tivola discs. (thrown out by the public library a while ago), but BinaryObjectScanner does not detect them as Tivola Ring Protection despite that name being on the list of detected protections.
And this piece of trash.

If you are seaching for something obscure you could try Kreed (3PLock). One of the two CDs consists over 50% of bad sectors.

 

[Luca91]

Never found any name for that and scanning programs output nothing.

I've more of those CDs with a ring. Some Tivola discs. (thrown out by the public library a while ago), but BinaryObjectScanner does not detect them as Tivola Ring Protection despite that name being on the list of detected protections.
And this piece of trash.

If you are seaching for something obscure you could try Kreed (3PLock). One of the two CDs consists over 50% of bad sectors.

Hi Sina,
do you have the barcode for Kreed protected by 3PLock?
Also, some a couple of months ago (25th of March), I sent you a PM with 4 ebay links. These items are sold by Medimops (but on ebay) and I was asking you, if these are the ones protected by ProtectCD.
Since I haven't had a chance to get my hands on a ProtectCD game (I only have a ProtectDiSC game), I was hopping to get one of these. Can you confirm that these are indeed the version of the "games" I'm looking for?
I know that from your point of view, ProtectCD is complete crap, but I really wanted to analyze it (that's why I insist on this).
Sadly, the seller (medimops) have increased the price of these items by a lot (the first item was about 5€ back in March, not it is about 20€...).
Thanks

 

[KleinesSinchen]

Also, some a couple of months ago (25th of March), I sent you a PM with 4 ebay links.

Ah, shit. Somehow I must have overlooked this. You know I'm really not myself since last year.

Sadly, the seller (medimops) have increased the price of these items by a lot (the first item was about 5€ back in March, not it is about 20€...).

Medimops is indeed making prices like throwing a few dices and adding the up numbers. Up and down like a roller coaster. → Assolutamente folle!
The Laura games are an interesting case because the CD1+CD2 and CD3+CD4 respectively are almost completely identical.

After installing for example CD1 the user can play half of games on the disc. Installing CD2 afterwards takes a second (no data files have to be copied) and just unlocks the missing games. Works the other way round as well.
There is an option to activate the missing games by purchasing the other part online (no idea if this still works) – in any case ProtectDISC (CD version) accepts both discs for authentication on starting the program.

Since I haven't had a chance to get my hands on a ProtectCD game (I only have a ProtectDiSC game),

This part is not fully clear. (VOB) ProtectCD is the old name replaced by ProtectDISC (CD and DVD versions) in newer instances.
An unfinished overview of my findings about this DRM is in the German group (I've added an English version). The post is unfinished due to a lack of interest/feedback. A table in a reply below contains the version numbers and lists a few games under the old "VOB ProtectCD" name.

I know that from your point of view, ProtectCD is complete crap, but I really wanted to analyze it (that's why I insist on this).

It is malware in my opinion. But since it wasn't mainstream and not internationally successful all the fame for being *censored* went to StarForce and SecuROM.
Documenting it would be a good thing.
===============

Kreed EAN…
*Unpacks big moving box full of worthless PC games.*
*Says a lot of bad words while taking every single one out… not finding Kreed.*
*Throws all games on the floor*
*Shouts bad words!!*

3455199437231

Spoiler: Picture

 

[Luca91]

Ah, shit. Somehow I must have overlooked this. You know I'm really not myself since last year.

Don't worry at all, I've been very busy with real life too.

Assolutamente folle!

Sehr richtig!

This part is not fully clear. (VOB) ProtectCD is the old name replaced by ProtectDISC (CD and DVD versions) in newer instances.

Sorry for the confusion, I'll try to make it clear:
I have a ProtectDISC protected game (Mata Hari) but I still have to really analyze it. IIRC when I disassembled the main executable, I found a sort of "warning" (put there by the authors) to reversers/crackers stating that the executable was packed with Themida. I can confirm that the game was bootable from the debugger, but I didn't continue my analysis due to lack of time (I was in the middle of moving at the time).
Anyway, given the presence of Themida, I was looking for an older version of ProtectDISC to analyze first. That's why I'm looking for "ProtectCD" protected games.
I hope it's a little clearer now.

An unfinished overview of my findings about this DRM is in the German group (I've added an English version). The post is unfinished due to a lack of interest/feedback. A table in a reply below contains the version numbers and lists a few games under the old "VOB ProtectCD" name.

I've read it, very very interesting article, thanks (it is also better than my technical papers! )
I've seen the table and I've just purchased from medimops (ebay) the game called

Wiggles

≤v4 (VOB ProtectCD)¹

that according to redump (http://redump.org/disc/42648/) it is protected by VOB ProtectCD 3.56.
While I was at it, I decided to go ahead and buy, in the same order, also "Lauras Vorschule 4" (it was the cheapest one and it should be ok since as you told it should be identical to the 3rd one for example). According to your table it should be protected by v7.7.1

Kreed EAN…
*Unpacks big moving box full of worthless PC games.*
*Says a lot of bad words while taking every single one out… not finding Kreed.*
*Throws all games on the floor*
*Shouts bad words!!*

3455199437231

hahahah I can totally relate and I really appreciate the effort I'll buy this next month.

danke schön Sina.