Tutorial  Updated

Creating Backups of CDs Containing SecuROM New ≥ v4.8

This text will cover several ways of backing up CD-ROM¹ based software, mostly games, that are protected² with SecuROM New in version 4.8³ and higher. To keep this very long thing at least a bit little shorter, I’ll focus more on what has to be done, rather than why it is done and keep the technical background at a minimum:
The idea behind newer iterations of SecuROM is having a pattern (different for each title) of areas with lower linear density compared to the surrounding parts. This can be measured by observing the read speed/timings of reference points.
A CD-burner on the other hand, writes the data at a constant, defined size. This means, that a CD-R(W) copy will not have any deviations in linear data density across the whole spiral track and is thus easily revealed as a duplicate (and rejected of course).

I will not provide any of the needed software because of licensing questions. I have no idea if I am allowed to share all the stuff I used (not only talking about the demos of commercial software, I mean all the programs). If anybody wants to follow the TwinPeak method below, they will have to search up the stuff on their own. Most of it isn't too hard to find. Old versions of Blindwrite Suite can be found on the official VSO site with the help of the Wayback Machine.
I strongly advise against using slim (internal/external) “laptop” drives! They often have low quality, low reading capabilities, lower speed (physical limitation of the construction), fail extracting good quality DPM and generally perform poorer in any way compared to their full-sized counterparts. USB connected external drives without own power supply are the worst. I mean these things that get connected with a Y-cable, hoping they can get enough power for working more or less correctly.
The reason for writing this, is more keeping old information available at a single point, rather than any practical usecase. Since the demise of the forum club.myce.com (formally cdfreaks), a lot of interesting information is lost or at least much harder to find (the Wayback Machine has backed up a lot… if you know the old URLs).
CD protections relying on physical attributes (angles, density) have often been considered to be impossible to successfully replicate with consumer hardware. I want to make sure that the knowledge about possible approximations doesn’t get lost (TwinPeak and Plextor Premium)

When the following methods of copying SecuROM appeared, they did have practical use: As GBAtemp’s Backup Reminder, I want to emphasize the importance of backups once more at this point:
  • CDs can easily break… and if children were playing with them (using multiple games and changing discs), it was just a question of time until an expensive disc shattered or at least became unreadable.
  • For people playing online, which was already the often the case about 2002/2003, a crack/modification wasn’t ideal either: An update requires waiting for a new crack to come and caries the risk of being caught and banned. Having a backup CD-R in the drive which the protection will accept as original, should have been enough to be relatively save (theoretically improved detection of known backup methods could have been applied in updates – don’t know if this was the case.)
Long story short: If you find this text obsolete and outdated, you are somewhat right. To defend my approach a bit: It feels rewarding to fool disc based DRM and trying to look behind the scenes a bit – even without being a talented reverse engineer diving into disassembly.

Generally there are multiple ways of achieving the same goal: Running SecuROM infected software without having the original disc in the drive, thus defeating SecuROM. What I’ll not cover here is just downloading a No-CD crack. That is not backing up the original disc (and for purists: It is piracy according to the law, since you are downloading copyrighted stuff, normally the main executable in decrypted form). Arguably a crack is the most convenient thing to have, since neither additional software, nor hardware or any CD is needed. The game might work on newer operating systems where old, disc-based DRM sometimes causes trouble.
Still: This is about backing up, not downloading cracks:



Method 1 – RMPS (Removable Media Physical Structure) Emulation


The awkward density variations of SecuROM New discs can be measured. This is the first step of any method of creating a working copy. With the help of a DPM (Data Position Measurement) analysis file, emulation can be applied to both, a physical disc (drive), and a virtual disc (drive). The copying software does a detailed DPM before (or after) copying the normal data of the given CD. The resulting image can be inserted into a virtual drive which will behave 100% like the original disc. When using a physical CD-R(W), the emulation software intercepts (filter driver?) the reading and will alter the timings to simulate the density variations of the original disc.

The advantages of emulation are: Ease of use, high reliability/compatibility and the lack of any CD in case of virtual drive.

The downside of both emulation methods is (better say: was) the blacklisting cat+mouse game, that took place as protectionist tried to counter emulation. Not really important anymore since SecuROM (and other CD-based DRM stuff) is long dead and has been outlived by the emulators which will most likely not be detected anymore in new version (and/or can be hidden by helper applications). In addition to that, the resulting copy will never work on it’s own: In no drive it will produce the correct timings on a PC where the emulation software is unavailable. Think back in time again: Did you really want to buy multiple licenses for the emulator, just to have your kids play backups instead of expensive originals?

Usable software for this:
  • Alcohol 120% (physical and virtual)
  • Daemon Tools (physical and virtual)
  • Blindwrite Suite (physical, named Autoplay or EZ-Play)
  • VirtualCD (mostly virtual, but I think they support a special format for physical discs)
For the sake of completeness, I’ll show the very easy process with the example Alcohol 120%. I chose this program just because a free edition exists. Be warned that it has some adware bundled in the free version! I use it on offline PCs only… so I don't care. Current version of Alcohol 120% works on all Windows versions starting with XP (maybe even 2000). There are older versions compatible with Win98SE, but those didn’t have a free edition. The other mentioned applications will create emulation copies as well and the process is pretty straight-forward for any of them.



Dumping the original disc​

Insert the original disc (you will need an original CD to get sensible DPM data – this is true for all methods. Thankfully this whole tutorial is useless for pirates not owning the legit CDs) and select the SecuROM New 4/5/7 profile as Datatype when dumping the disc. For the DPM analysis slower speeds are usually (not always!) more accurate on CDs. The results depend on the reading drive though. If the graph doesn't look good (or Alcohol 120% even aborts and tells you the current drive can't extract DPM), try different speed settings and different drives.
01_Main_Window.PNG 02_Datatype_SecuROM_4_5_7.PNG 03_DPM_Speed.PNG

After dumping the disc…
04_Disc_dumped.PNG

look at the DPM analysis before proceeding:
05_Check_DPM_analysis_a.PNG 05_Check_DPM_analysis_b.PNG 05_Check_DPM_analysis_c.PNG
This is an example of an "okay" DPM. It is not great or perfect. Could be smoother and contain less small errors, but it is usable for sure.
:!: Don't proceed writing to CD-R when the graph has very high/low spikes (I do not mean the characteristic SecuROM peaks that can be seen in my example – they are normal and needed), or if the line doesn't look at least a bit smooth.:!:

Burning to CD-R(W)​

Now that we have a usable image, including DPM data, it is time to write it onto a blank CD. We could just insert the image to a virtual drive, but this is even less fun than RMPS emulation on physical CD.
Just select SecuROM 4/5/7 as Datatype once again and Alcohol 120% should choose the correct write method. Make sure "Burn RMPS to media" is selected. The writing mode should be RAW-DAO (disc-at-once).
06_Main_Window2.PNG 07_File_Selection.PNG 08_Burn_Settings.PNG

Starting the game​

The copy will only work, if the emulator is installed to the system where you want to play. Make sure the feature is turned on in the settings, else the read timings will not match and SecuROM will reject the copy.
09_Emulator_Is_Off.PNG 10_Emulator_Settings.PNG 11_Emulator_on.PNG




Method 2 – TwinPeak Copy


Next possibility: Going beyond emulation, approximating the density deviations in a way that the resulting CD-R will start the game without helper software.

Since a normal CD-writer does not give us control over the size of pits/lands, somebody had the clever idea to simulate lower density by wasting space. How? By inserting some sectors (including subchannel which also contains the sector numbers) twice: Twin sectors! This can be written by any burner allowing RAW-DAO(+Sub96) writing mode (which means every writer available nowadays).
Problem is: Success in reading, which also means starting up a game with a TwinPeak copy on the other hand, depends solely on the capabilities of the drive used for reading. Some (ironically often the better) drives stop a brief moment when encountering the same sector number twice and – factually correct – report an error. As if the drive wanted to say: “What I’ve just seen here does not make sense!”

Many drives on the other hand simply ignore the second instance of the same number, which they saw a moment before, and continue normally. This introduces a tiny amount of delay, slowing down the reading in a very similar way the lower data density areas on the original disc do. Again: only the reading drive is responsible for success or failure. No background software/emulator is needed⁴. Sometimes the actual data becomes unusable (can't install the game from TwinPeak copy) while the disc authentication succeeds. This sounds acceptable when thinking back in time: Carefully install games from legit CDs, and have the children play with the copies afterwards. In many cases the TwinPeak copies are fully usable for installation though (especially on Lite-On drives).



Creating a TwinPeak copy is not fully trivial, especially since the TwinPeak tool (or TwinCreator) has never been updated to support newer MDS files (which contains the DPM data). Luckily we can also use BWA files created by “Physical Characteristics Dumper”, which is part of Blindwrite Suite (it does not even demand buying a license opposed to the reading/writing applications). TwinCreator will determine the peak ranges in the BWA files (the peaks represent lower density areas) and insert twin sectors into those spots. If the copy does not work with your drive, you can try inserting more or less twin sectors (lower, respectively higher step number).
Sadly the BWA creator of Blindwrite Suite isn't remotely as good at creating consistent, good measurements as the DPM function of Alcohol 120%. This is where I would need help: The initial version of TwinPeak tool is open source and the author(s) explicitly allowed improvements. If a developer would have a look at TwinPeak, they could easily improve it in a way that it works with MDS files produced by Alcohol 120%.
Documentation of the proprietary MDS format is inside the source of CDEMU. The authors revere-engineered this.
The TwinCreator (part of A-Ray Copy Protection Scanner) I used for the screenshots does support MDS – in theory – but it simply crashes or goes 100% CPU forever when providing files from current Alcohol versions.
This leaves us with the suboptimal BWA creator until a developer improves the situation.
In short, big advantage is: No need for any helper software/emulator
Disadvantages: Limited compatibility, suboptimal software (not really user friendly process)




Create source files​

Start by dumping the game disc. Either with Clone-CD or Alcohol 120%, but in Clone-CD format (ccd file, img file, sub file). Make sure to set reading to RAW+Sub96. Next is the trickiest part. Getting physical analysis from Blindwrite Suite. It might need multiple drives, attempts and a lot of time to get a usable file with Blindwrite Physical Characteristics Dumper.
01_BWA_Builder.PNG
Very bad. Inaccurate and not smooth. Useless.
01b_Bad_BWA_Errors.PNG

Also bad: Spikes!
01c_Bad_BWA_Spikes.PNG
A few spikes might be acceptable. This file would be usable since SecuROM usually checks in the first section of peaks.
Do not abort analysis when spikes appear: The software often automatically corrects some or all of them after finishing.
If you have patience, search and download BWAEdit. You can manually correct spikes with it (tedious!!)

Very good analysis:
01a_Very_Good_BWA.PNG

Once you have all the files, it is time for TwinCreator​

02_Needed_Files.PNG

I used → A-Ray Copy Protection Scanner ← which is now available on the GBAtemp download section. You can also use the original TwinPeak tool or the TwinCreator in the program "Alcoholer" if you find them.
03_Array_Scanner_a.PNG 03_Array_Scanner_b.PNG

Select your CCD/BWA files you are ready to start. The only questions that is left, is the step size. Numbers that have been said to work are the default 15, but also 6 (very heavy modification on the image!), 30 and 50 (little modification).
Different drives might work with different numbers, which means trial and error. Some drives, especially a lot of the widespread LG, won't work with any TwinPeak copies regardless of the quality of the BWA file and regardless of the step size.
The same for old, “real” Plextor. Older Lite-On are by far the best and sometimes detect a TwinPeak copy faster(!) than the original CD which is funny to say the least.
03_Array_Scanner_c.PNG 03_Array_Scanner_d.PNG
After selecting your files and the step size, you can hit "Start" and will be informed about the areas that the tool will manipulate. It is not a bad idea to compare these values with the graph to see if they are plausible.
03_Array_Scanner_e.PNG

This gives us the following result:
04_Patched_Image.PNG

Writing to CD-R(W)​

All that is left now is burning the patched image in RAW-DAO mode. Clone-CD will do this very well, but you need a to buy license after 21 days. I used Alcohol 120% Free Edition again, which also does the job. Pay attention to the question it asks and choose the recommended option. This is the only one that makes any sense.
05_Burn_Image.PNG 06_Burn_settings.PNG 07_TOC_Lead-Out_mismatch.PNG
The resulting CD should start in twin sector friendly drives.

Closing Comments for this section​

Twin sectors violate the CD standard. You do everything on your own risk! I didn't encounter any hardware damage and tried more than 20 drives, some for hours, but please note that twin sectors are a crude thing and there is no guarantee for hardware to take it benevolent.

If you are curious to see the difference between the original CD and a TwinPeak copy: It is very hard to get full DPM analysis of a TwinPeak copy. Either the scanner aborts with an error, or it produces absolute nonsensical values. How can such copies work then? Well, SecuROM, as much of a pain in the a.. it is/was, didn't do full analysis each time booting the game. They didn't go that far, to have players wait 15 minutes each time. The brief look it has onto the structures, more or less seems to just validate the presence of changing data density. There is a huge amount of tolerance in order to not reject the legit discs (happened nevertheless sometimes).
I lost track of the number of write cycles on my testing CD-RW. After hours and hours of testing and slowly getting better values, I sacrificed one CD-R and finally obtained a TwinPeak copy with a somewhat sane DPM picture with very few measurement errors:
09_Legit_CD_compared_to_TwinPeak_Copy_a.PNG 09_Legit_CD_compared_to_TwinPeak_Copy_b.PNG




Method 3 – Almost(!) perfect copy with Plextor PlexWriter Premium (1)


There is one single drive model that can be used to create "perfect" (not really, but very good) backups: The Plextor Premium (not Premium 2). CD-R written this way should start in any drive and as fast as the legit CD.
As good this method is, it will rarely be helpful: I had a hard time getting that drive without paying a fortune. The prices are insane! Obtaining one of these isn't easy, that's for sure.
Other Plextor drives should be theoretically able to achieve the same results, but the firmware doesn't allow it. In order to (ab)use the GigaRec feature to write very good SecuROM copies, the Premium has to have at least firmware version 1.03. In older revisions GigaRec can't yet be used in "reverse mode" (less density; larger pits/lands), but that is exactly what we need. I upgraded the firmware to 1.05 and this works like a charm.

Anything related to VSO Blindwrite Suite assumes you to use a physical Windows XP (or older) machine. The version I used is Blindwrite Suite 4.5.2 (as far as I know the last from the 4.x series that allows at least a bit of control… and I completely failed to get newer versions to cooperate). I will try again to get newer versions to use the Premium for writing SecuROM New v4.8+.

Plextor Premium is an IDE drive, so you’ll need an older motherboard (which has good chances to be XP compatible). Note that PCI cards providing IDE ports often only support HDDs and not optical drives. An external USB→IDE case might make the drive somewhat work, but I’ve no idea if all the special Plextor functions can be used (and if this depends on the particular USB→IDE device).

Blindwrite implemented the TwinPeak technique from above as well and can insert the twin sectors automatically without patching an image file. Doing everything according to the screenshot below with any other drive, will result in Blindwrite automatically applying the TwinPeak technique. As always with Blindwrite Suite: The user has next to no control and doesn't even get any information about peak ranges and step size.

Big advantage of this method: High compatibility with high quality backup and no helper software.
Biggest (and only) disadvantage: You got to find a drive that is almost two decades out of production.
Plextor Premium.jpg





Disc dumping​

Since we are dealing with an old version of Blindwrite, we will need to dump the disc in it's native format (no support for anything else).
01_Dump_CD_Blindread.PNG 01_Dump_CD_Blindread_b.PNG 01_Dump_CD_Blindread_c.PNG
There is not much to take care of. I've no idea if density based SecuROM still needs the Subchannel dumped, but it doesn't harm. Your drive should support "sub Pw" (Sub-96) and not only "sub Pq" (Sub-16). The default settings (Nibble, Max read speed) will do fine.

DPM analysis​

Obtain a good BWA, just like above in the TwinPeak chapter.
01_BWA_Builder.PNG

Select Burner and Image​

02_Blindwrite_a.PNG 03_Select_Burner.PNG 04_Select_Image.PNG
Verify that the Plextor Premium is selected and has firmware 1.03 or higher.

05_Image_Analysis_a.PNG 05_Image_Analysis_b.PNG

The quick image check will tell you if the BWA file is found (should have the same basename as the image file)


Let's go!​

06_Start_Writing_a.PNG 06_Start_Writing_b.PNG
No idea if selecting 4x speed is needed. Blindwrite should reduce the speed to that value automatically. The Premium will write GigaRec discs at 8x with newer firmware, but Blindwrite insists on the older limit.
Answer the question for physically including BWA information with "Yes", and you should receive the best backup that is possible with consumer hardware.
Sorry for the Yes/No dialogue element being in German. I couldn't change this (seems to be Windows internal)

Sadly the user doesn't get informed about the technical side of things before starting the write process (and you can't use CD-RW here). After finishing, you can see a log.
***----- Image verification started -----***
HD image is OK
Sector: Bad headers 1 - Bad Edc 0 - Weak 0 - Status 1
File systems: Volumes 2 - files 5382 - folders 3658
Volume size 234690 boot 0 Vol ID YDKJ4 - 27.08.2003 13:41:40 Status 1
***----- Image verification ended -----***
Microsoft Windows XP Professional Service Pack 3 (Build 2600)
Patin-couffin version 14 in use
Blindwrite Version 4.5.7.92
***----- CD DEVICE INFO START OF REPORT -----***
CAUTION : Using unknown CD writer.
Unit String : "PLEXTOR CD-R PREMIUM "
***----- CD DEVICE INFO END OF REPORT -----***
Unit 0:0:0 - PLEXTOR CD-R PREMIUM 1.05 [E] (Ide)
Speed x4
VolumeId : "YDKJ4"
Hash : 866F22C92821F82F5338C9718035170BEE82A4DC
HD image "YDKJ4.BWT"
Physical media informations (BWA) found.

BWA support by Rate variation is used (1:1 copy)
Writing mode : DAO PW
Physical 1:1 copy is possible on this drive. Burnproof is disabled, writing speed is set to *4
Sectors read : 117645
Sectors built: 0
CD is complete
***----- Image verification started -----***
HD image is OK
Sector: Bad headers 0 - Bad Edc 1 - Weak 0 - Status 0
File systems: Volumes 2 - files 8672 - folders 38
Volume size 610958 boot 0 Vol ID CD2 - 28.06.2005 15:07:00 Status 1
***----- Image verification ended -----***
Microsoft Windows XP Professional Service Pack 3 (Build 2600)
Patin-couffin version 14 in use
Blindwrite Version 4.5.7.92
***----- CD DEVICE INFO START OF REPORT -----***
CAUTION : Using unknown CD writer.
Unit String : "ASUS DRW-24D5MT "
***----- CD DEVICE INFO END OF REPORT -----***
Unit 2:6:0 - ASUS DRW-24D5MT 1.00 [G] (Scsi)
Speed Max
VolumeId : "CD2"
Hash : A0BC7E416316206F2D0AF22657B436095EB49749
HD image "SONICCD2.BWT"
Physical media informations (BWA) found.

BWA support by TwinPeak technique is used
Writing mode : DAO PW
Sectors read : 306448
Sectors built: 0
CD is complete

Final picture​

Comparing the DPM data of legit CD and Plextor Premium copy. The structures (density changes) are virtually the same.
Plextor Premium copy compared to legit.png
Very good imitation (more measurement errors are normal on any CD-R). However, the absolute density is much higher on the copy (shifted down) than on the original. It is certainly possible to detect this.
I'm still waiting for a SecuROM v7.x CD. It is said to successfully tell apart Premium copies from the original. Can't confirm or deny at the moment. SecuROM v7.x CD arrived. Sad result is that they really upped the measurement precision. Premium copy worked only in two out of four tested drives. I have to emphasize that there has been frequent rejection of the legit CD as well on the drives where the Premium copy fails. The measurement tolerances seem to be very tight to the point, that unsuspecting, legitimate customers using original CDs might get detection errors.
My SecuROM v7.x disc (Lego Star Wars II) is pretty full (about 660MB) which means they average density is higher than on the example pictures above → The lines of original CD and Premium copy are not shifted this time. No idea how the protection detects Premium copies.
TwinPeak method seems to still work reliably – on the same drives as before; it was never working on all drives.

===
Another update on this: Got an older version of SecuROM 7 (surprise: Lego Star Wars I). It seems more aggressive from the software side (background service is installed without notice and runs all the time until you kill it). On the pro side: The lower version from the 7 series is fooled by Premium copies in all drives. Long story short: If you have Plextor Premium drive, just try regardless of the SecuROM version. In the worst case you waste one cheap CD-R.






=====================================================================
Despite this topic being of no interest for the most people anymore,
I will of course answer any questions (if I can), comments and would
be happy for any corrections or improvements!
=====================================================================







__________________
¹ I have my doubts if SecuROM discs should actually be called “CD-ROM”, but that is off-topic. Let’s say CD-ROM like discs, that strangely are compatible with most optical drives.
² Since the inner workings of disc based DRM, or any DRM at all, often show non-desirable behavior, I tend to prefer the term “infected” as a more accurate description
³ There might be a few titles with lower SecuROM version numbers already using the density based detection instead of the previous, much weaker subcode based method.

⁴ Some 4.8x versions of SecuROM do an ATIP-check. ATIP hiding is needed for all drives capable of writing. Later v4.8x and 5.x dropped this additional check for unknown reason which means any twin sector friendly drive will boot copies without any helper software.
 
Last edited by KleinesSinchen,

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
OP
Member
Joined
Mar 28, 2018
Messages
4,648
Trophies
4
XP
16,536
Country
Germany
The tutorial is almost finished now. I've just added method 3, Plextor Premium (not that it really matters, looking at the rarity of the drive). The text above is certainly too long and too step-by-step with many screenshots. Any advanced or just intermediate user will laugh about it. The goal was to provide as much and detailed instructions as possible… to ensure anybody not having any experience will be able to follow the instructions.

Additionally: I forgot to give the obligatory "Thank you!" to @Alexander1970 for always listening (reading) in PM when I'm preparing stuff. Alex, without your encouragement, I wouldn't even be able to achieve tiny things like the tutorial above. This time even something outside of my blog.

I know not many people care. I just do not want this information to be lost. About 16 to 20 years ago this topic was of wide interest, but there still no reason for the information I have picked up last/this year to disappear from the internet.
 
Last edited by KleinesSinchen,

Alexander1970

XP not matters.
Member
Joined
Nov 8, 2018
Messages
14,971
Trophies
4
Location
Austria
XP
2,846
Country
Austria
Great Respect for your awesome Research,Sinchen...:bow:

I know not many people care. I just do not want this information to be lost. About 16 to 20 years ago this topic was of wide interest, but there still no reason for the information I have picked up last/this year to disappear from the internet.

Never too late,Sinchen,never too late.💖👌

Sadly,we live in a Society of "Forgetting"....or many Users/People reading here are too young to know this exciting Times where talented People can make No CD Cracks by "Do it yourself" and running working Backups with "Machines" like Plextor or Lite On.
This Stuff is still very interesting (or do you think,looking on the Age of the Wii U,your German Kumpel @Maschell developed Aroma in 1 Day...?)😉
and makes more Fun to read as this fucking Denovu Shit....

Carry on please,it is highly interesting.
Better for 2 -3 really interested People than 452.786 People with "Like"......😉


Awesome Work,Sinchen,bravo !!!! 💖😉👌
 

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
OP
Member
Joined
Mar 28, 2018
Messages
4,648
Trophies
4
XP
16,536
Country
Germany
Never too late,Sinchen,never too late.
Thank you. You are truly kind!

It might be a little early to say this, but I will anyway:
First experiments show that the the Plextor Premium method is applicable on ProtectDISC CDs as well (first result only in my status as of now). As you know, a modified and simplified twin sector method works very well on twin sector friendly drives.

Since the weather is cooler now, I'll continue my write-up and hope to bring "TwinStepper" into an actually usable state. What do you think, Alex, should I put ProtectDISC into this thread as well? It is very related.
 
Last edited by KleinesSinchen,

The Real Jdbye

*is birb*
Member
Joined
Mar 17, 2010
Messages
23,816
Trophies
5
Location
Space
XP
14,793
Country
Norway
I have no real use for the tutorial, but it was entertaining to read. I never knew SecuROM could be fooled with an ordinary CD-R, I thought it was one of those things where you needed a crack or emulator to make it work.
 
  • Like
Reactions: KleinesSinchen

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
OP
Member
Joined
Mar 28, 2018
Messages
4,648
Trophies
4
XP
16,536
Country
Germany
I contribute to Redump and we use Plextors to dump discs, and SecuROM's dumpable. I have a Plextor Premium but other Plextors work.

http://wiki.redump.org/index.php?title=CD_Dumping_Guide_(DIC_CLI)

Is SecuROM v4.8 a whole other scenario?
Right from the Readme of DiscImageCreator:
DiscImageCreator.png
Seems any DPM-based stuff is currently unsupported by this free program. Sad… I'm searching for a free DPM implementation and failed so far. Proprietary software supports it: GameJackal (not available anymore), VirtualCD, Alcohol 120%, Daemon Tools, Blindwrite Suite.

There are some problems with this readme file. Nothing really wrong, but incomplete:
  • SecuROM v4.x is too general. There are lower v4.x versions (which already have the name SecuROM New) that rely on manipulated subchannel and can be successfully ripped like v1.x up to v3.x. There might be a difference… completely unsure here and no source at hand: It could be the case that early v4.x require subchannel Pw (Sub-96) instead of Pq (Sub-16) only. Any modern drive, and the recommended Plextors, should do it (the Premium 1 does).
  • The readme mentions VOB ProtectCD ("[invalid sync]") as supported format. This is only correct for low versions. Starting with version 5, VOB ProtectCD (later renamed to ProtectDISC) relies on DPM as well. The DPM functions aren't very well implemented and easy to fool, without even having/measuring an original CD. Several ProtectDISC I snatched up, v6.x, v7.x, v8.x and v9.x, all have the same density (about 1.5% lower than normal CD-R) and came from the same mastering/pressing company.
==================


I have no real use for the tutorial, but it was entertaining to read. I never knew SecuROM could be fooled with an ordinary CD-R, I thought it was one of those things where you needed a crack or emulator to make it work.
You'd be surprised: There is hardly anything a consumer CD drive can read/evaluate, but not imitate or approximate. SecuROM v4.8+ and other DPM based stuff is one of the most clever approaches in this regard.
For DVD, they took away the RAW reading/writing from consumer equipment which severely limits the possibilities. I guess it was to have the broken-by-design video "protection" CSS at least somewhat working. If you have some time and concentration to spare, well worth reading: https://debugmo.de/2022/05/fjita-the-project-that-wasnt-meant-to-be/ Shows, what could be theoretically be achieved with a writer under full user control.

Of course there are things that cannot be written by a drive, but the question is, if the feature can be distinguished beyond any doubt.
…there is no way to write physically defective sectors… So what if we write a session with a big useless dummy file. Then we scratch the protective lacquer with a needle from above in the area where we are sure to find the dummy file. Scan the damaged disc and note which sectors are physically defective. Lastly we write your app+data in the second session and tie it to the exact defects. Perfect, isn't it?
Well… no. RAW reading will tell us which sectors are bad. The attacker can just write invalid error detection/correction data so that the drive will report the appropriate sectors as unreadable on the copy. While this isn't physically a real copy (often called "1:1") of the scratched parts, there is no way for our app to distinguish actually bad sectors from garbage data written intentionally.
 

Dust2dust

Well-Known Member
Member
Joined
Jun 17, 2010
Messages
2,646
Trophies
2
XP
5,213
Country
Canada
It was an interesting tutorial to read, and it brought me back 20 years ago, which is cool. I certainly appreciate the effort of preservation displayed here. But as someone else mentioned, I don't really have any use for it. I have whole spindles of unused DVD-Rs bought more than 10 years ago. I wonder if they're still good, because of the rotting process. I will probably never find out, as I have no need to use them. It's more or less like a Macrovision removal tutorial to copy VHS tapes. Interesting read, and makes you travel back in time, but kind of irrelevant nowadays.
 

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
OP
Member
Joined
Mar 28, 2018
Messages
4,648
Trophies
4
XP
16,536
Country
Germany
It was an interesting tutorial to read, and it brought me back 20 years ago, which is cool. I certainly appreciate the effort of preservation displayed here. But as someone else mentioned, I don't really have any use for it.
Playing around with CD/DVD copy protection can be fun itself. It feels rewarding when succeeding in fooling the checks. Maybe it's just me, but I enjoy this (ongoing) research.

I have whole spindles of unused DVD-Rs bought more than 10 years ago. I wonder if they're still good, because of the rotting process. I will probably never find out, as I have no need to use them.
They should be still fine if stored good. Give them to me if you don't need them.:creep: I will certainly do something funny with them.
Just kidding!

It's more or less like a Macrovision removal tutorial to copy VHS tapes. Interesting read, and makes you travel back in time, but kind of irrelevant nowadays.
Although this goes off-topic: A step-by-step tutorial (for noobs like myself) how to build/solder a De-Macrovision machine would be awesome… would follow such a tutorial any time. I have a few original VHS with that crap for trying it out. Or copying DVD with the APS-flag set to VHS.

Back when DVD player were brand new and very expensive, occasionally people came to me having bought a disc while not yet having a player. Then they asked me to copy the movie to VHS in order to watch it. The S-Video out on the PC didn't send Macrovision so it was an easy task without such a neat box.
Fun times.
 

Dust2dust

Well-Known Member
Member
Joined
Jun 17, 2010
Messages
2,646
Trophies
2
XP
5,213
Country
Canada
Playing around with CD/DVD copy protection can be fun itself. It feels rewarding when succeeding in fooling the checks. Maybe it's just me, but I enjoy this (ongoing) research.


They should be still fine if stored good. Give them to me if you don't need them.:creep: I will certainly do something funny with them.
Just kidding!


Although this goes off-topic: A step-by-step tutorial (for noobs like myself) how to build/solder a De-Macrovision machine would be awesome… would follow such a tutorial any time. I have a few original VHS with that crap for trying it out. Or copying DVD with the APS-flag set to VHS.

Back when DVD player were brand new and very expensive, occasionally people came to me having bought a disc while not yet having a player. Then they asked me to copy the movie to VHS in order to watch it. The S-Video out on the PC didn't send Macrovision so it was an easy task without such a neat box.
Fun times.
I sure would give you my spindles if you were living close to me. I can't remember why I bought so many back then. Maybe it was a sale, or something. LOL, that's money well wasted. :rofl2:

I had (probably still have) a box designed to defeat Macrovision from VHS tapes. I remember it had two knobs to adjust, and it was powered by a 9V battery. I never used it much, as I never copied much VHS tapes after all. Macrovision was indeed present on early commercial DVDs, but it was so easy to defeat (just ticking the "Remove Macrovision" box). There was some really impressive copy protection on commercial movie DVDs later on. But usually nothing that the latest version of AnyDVD couldn't manage. These guys were awesome (Slysoft, devs of AnyDVD) but I think they got a cease & desist and stopped releasing updated versions of their app finally. Up to that moment, it was a fun to watch game of cats and mice. But this brings me back to my argument... Who copies DVDs nowadays, it this age of streaming? But i agree with you, it can be a fun way to spend some leisure time, just seeing how it works.
 

Kirkbdz

New Member
Newbie
Joined
Nov 16, 2022
Messages
1
Trophies
0
Age
39
XP
26
Country
Ireland
Thank you for providing this article. I need to make copies of securom protected disks that are no longer sold/in general circulation for educational software.

The school spent a lot of money on software they cannot use because the original disk has gone missing. The company no longer operates (or no one replies to emails or updates social media).
 

GothicIII

Well-Known Member
Member
Joined
Jan 4, 2015
Messages
838
Trophies
0
Age
36
XP
2,393
Country
Gambia, The
This was a great read! Thanks!

I've yet to make a good dump for a securom 7 protected game disc (CD DS2BW). I tried 2 drives using Daemon Tools:
-the USB-CD drive I got is awful and it fails in taking DPM measurements.
-a LG IDE drive over a Sata adapter. It is pretty old but I know I used it back then successfully to make many many dumps.

I tried Securom new profile with max speed and a custom profile with high dpm precision and 10x speed (can't get lower!?).
All dumps I did have a pretty good DPM curve but are still not accepted by the game.

Can I somehow inject a 'working' DPM curve into the image? Where can I get those?
Is there anything else I can try? I can use iscsi to connect the drive to an Windows XP VM. So if there are old tools which can help making a good dump I am happy to hear/read which I can try. Thanks!
 
  • Like
Reactions: KleinesSinchen

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
OP
Member
Joined
Mar 28, 2018
Messages
4,648
Trophies
4
XP
16,536
Country
Germany
I've yet to make a good dump for a securom 7 protected game disc (CD DS2BW). I tried 2 drives using Daemon Tools:
-the USB-CD drive I got is awful and it fails in taking DPM measurements.
-a LG IDE drive over a Sata adapter. It is pretty old but I know I used it back then successfully to make many many dumps.
Which method are you trying?

Virtual drive should work. At least for Daemon Tools SCSI or IDE drive emulation, not "DT" drive (those are far too inaccurate and provide the speed of the HDD/SSD)
DPM emulation on physical CDs with SecuROM v7 seems to be a lost cause.
The search engine interpreted DS2BW as "Dungeon Siege II – Broken World". It is not one of the 99cent articles like many PC games (especially as it is an add-on for another CD), but I'm interested. Hope to get the game for a reasonable price.

Can I somehow inject a 'working' DPM curve into the image? Where can I get those?
There has been a site sharing BWA files, but it is down since eternity (and right now the name escaped me, so searching the Wayback Machine isn't possible).
If your measurement looks smooth it is probably not the cause of problem anyway. Later v7 seems to have very tight tolerances often enough rejecting my original CD (Lego Star Wars II).
Funny enough the Plextor Premium copy is rejected in some drives (including the Premium itself), but creating DPM data of the copy results in an MDS file which satisfies SecuROM in a virtual drive. I've not the faintest idea what later v7 even do in their check??
 

GothicIII

Well-Known Member
Member
Joined
Jan 4, 2015
Messages
838
Trophies
0
Age
36
XP
2,393
Country
Gambia, The
Which method are you trying?

Virtual drive should work. At least for Daemon Tools SCSI or IDE drive emulation, not "DT" drive (those are far too inaccurate and provide the speed of the HDD/SSD)
DPM emulation on physical CDs with SecuROM v7 seems to be a lost cause.
The search engine interpreted DS2BW as "Dungeon Siege II – Broken World". It is not one of the 99cent articles like many PC games (especially as it is an add-on for another CD), but I'm interested. Hope to get the game for a reasonable price.


There has been a site sharing BWA files, but it is down since eternity (and right now the name escaped me, so searching the Wayback Machine isn't possible).
If your measurement looks smooth it is probably not the cause of problem anyway. Later v7 seems to have very tight tolerances often enough rejecting my original CD (Lego Star Wars II).
Funny enough the Plextor Premium copy is rejected in some drives (including the Premium itself), but creating DPM data of the copy results in an MDS file which satisfies SecuROM in a virtual drive. I've not the faintest idea what later v7 even do in their check??
I don't need to burn it on another disc. I am happy if I have a digital copy, so I follow 'dumping the original disc', just with DT instead of Alcohol.

Later I'll try Alochol120% to take measurements. Even though the DPM curve looks smooth, there are small inaccuracies. I'll try taking a few more dumps in different ways and then combine the best sector areas using a hex editor. Hopefully this gets the job done.

I can personally recommend https://forum.daemon-tools.cc/forum. It is a gold mine when it comes to copy protection mechanisms and workarounds. ( I was very surprised that it was still reachable. I could login to my account from 15 years ago! )
For securom v7+ and other more modern copy protections I dig that out:
https://forum.daemon-tools.cc/forum/copy-methods-questions-daemon-tools/copy-methods/7422-

I already tried mounting the image as vIDE (with all SCSI drives removed), but I still can't pass the copy protection. So either the DPM curve is not good enough or it somehow detects all virtual drives. Using the original disc over iscsi does work though. At least the base game works but it uses SMARTE as copyprotection, so a SafeDisc profile was enough to get it working.

OT:
Dungeon Siege, especially the sequel is a childhood game for me. It is a diablo-like clone, but more casual and very relaxing. I got the deluxe edition from medimax on amazon a few days ago, the Broken world expansion is not officially available digitally.
If you are interested or need help, I heavily modded the game myself (UI improvements, QoL, Difficulty scaling etc) and also found out how to play it online over VPN (the game uses UDP broadcasts on the lowest metric interface for communications, but fails to send the correct IP-Address so the game drops all foreign UDP packets => Noone sees a hosted game).


EDIT: I've got it working! I took another image with my very crappy USB dvd drive (it took forever!). The DPM curve looked like crap but the game started! Then I realized I mounted the image in a SCSI drive.

So for whatever reason SecuROM v7 was not happy with the DT driver (expected), also vIDE did not work but SCSI did work. So it was not a DPM problem. For reference I added the DPM curves of both (working) images:
 

Attachments

  • DPM.jpg
    DPM.jpg
    132.1 KB · Views: 62
  • DS2_BW_Modded.jpg
    DS2_BW_Modded.jpg
    1.6 MB · Views: 57
Last edited by GothicIII,
  • Like
Reactions: KleinesSinchen

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
OP
Member
Joined
Mar 28, 2018
Messages
4,648
Trophies
4
XP
16,536
Country
Germany
I've ordered the game and the add-on now and hope it doesn't take too long until it arrives.
SecuROM v7 CDs are pretty rare – almost all games already came on DVD at that time (rather than multiple CDs). This severely limits the possibilities for physical copies missing (semi-)RAW data writing consumer writers.
Good to know another title now, so thank you for mentioning this.

Some emulated drive working and some not isn't unusual. On Windows older than 10 Daemon Tools should be able to attach an image to a real drive (as far as I know this is blocked on newer Windows). This is the most sophisticated emulation method beating pretty much every anti-emulation.
I would have expected newer SecuROM to prefer IDE over SCSI, but trying them all never harms. ProtectDISC (based on acedrv11.sys) for example will error out with "Emulator aktiv" for virtual Daemon Tools IDE drives, but start from SCSI and DT(!) type emulation.

The DPM curve looked like crap but the game started! Then I realized I mounted the image in a SCSI drive.
The left one is indeed very crappy. Surprising this starts.
On the other hand really bad TwinPeak copies also start:
legit-twincopy-png.266051


I can personally recommend https://forum.daemon-tools.cc/forum. It is a gold mine when it comes to copy protection mechanisms and workarounds. ( I was very surprised that it was still reachable. I could login to my account from 15 years ago! )
It is more or less an archive only. No new registration allowed.
 

GothicIII

Well-Known Member
Member
Joined
Jan 4, 2015
Messages
838
Trophies
0
Age
36
XP
2,393
Country
Gambia, The
It is more or less an archive only. No new registration allowed.

This is true, but I coudn't find any other ressources for circumventing optical disc copy protection mechanisms. That forum is not crawled by google so I was happy I remembered it.
Also there won't be any major breakthroughs anyway since this topic is very dead. At least for CD/DVD.

Anyway I am done with my personal image archive and my good old friend supermulti LG IDE Drive can get some rest again for the next 10-20 years or until I find another old CD to dump xD

P.S. I need to check it but if you are looking for other SecuROM protected CDs: Spellforce 1 is one. No clue if it is SecuROM7+, though. Also I do not mean the platinum rereleases, they are on DVD.
Gothic 2 Gold Edition is also SecuROM protected I believe and maybe Herrscher von Atlantis - Poseidon but that is so old, I don't think it is SecuROM7.


EDIT: They are all too old to be SecuROM 7 protected.
 
Last edited by GothicIII,
  • Like
Reactions: KleinesSinchen

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
OP
Member
Joined
Mar 28, 2018
Messages
4,648
Trophies
4
XP
16,536
Country
Germany
This is true, but I coudn't find any other ressources for circumventing optical disc copy protection mechanisms. That forum is not crawled by google so I was happy I remembered it.
I've been collecting all sorts of information in this regard. But I'm too weak to finish the write-up. This thread is more or less a preview of what I'm planing to eventually post in form of a PDF file.
The results are promising: I've hardly encountered PC CD-ROM, which I was unable to copy in a way that they starts without helper software at least on some drives. The hardest nut to crack in this regard is CD-COPS or Starforce. The absolute position of reference sectors can't be easily predicted.
I'd need expensive specialized software and a lot of time to create a copy – probably on CD-RW.


========

Anyway: Dungeon Siege II – Broken World arrived yesterday. While I'm still waiting for the main game, SecuROM is so nice to perform the decryption of the provided executable file for the add-on (which then aborts with critical error missing the base game).
For testing the protection (accepting or rejecting discs) this is enough. I've found nothing special on this version. It doesn't even demand using physical IDE drives over physical SCSI/SATA drives like on Lego Star Wars II. The measurement precision is one of the tighter type, but emulation with Alcohol 120% works like a charm. Plextor Premium copy is a hit or miss depending on the reading drive. The better the reading/measurement of a drive, the more likely SecuROM will reject the copy.

No idea what it is with this CD, it is fairly hard to get accurate DPM analysis. I needed multiple tries to get a fairly good one… and still needed to manually repair some errors.
BrokenWorld1.PNG BrokenWorld2.PNG


P.S. I need to check it but if you are looking for other SecuROM protected CDs: Spellforce 1 is one. No clue if it is SecuROM7+, though. Also I do not mean the platinum rereleases, they are on DVD.
Gothic 2 Gold Edition is also SecuROM protected I believe and maybe Herrscher von Atlantis - Poseidon but that is so old, I don't think it is SecuROM7.
You can mostly look these things up on this site, which has a lot of No-CD cracks. game....world you know.
They often mention the protection and version (that is how I found all of my samples of ProtectDISC)
 

MilesGT

Member
Newcomer
Joined
Jun 30, 2023
Messages
5
Trophies
0
Age
33
XP
41
Country
United States
Hi all,

I have a service manual disc from Ford that is being a pain in the butt. Confirmed a CD with Securom 7+. I've tried Alcohol 120% (which worked on these discs in the past, older ones) using DPM, Daemon Tools with DPM, and when finding this guide, BlindWrite.

All 3 pieces of software fail to grab the DPM. It just fails at anlysis start. Further, I've tried a mix of the 3 above on both my Windows 10 machines (2 of them), a Windows 11 machine, and a Windows XP machine. Also a combination of drives, 2 USB, 1 SATA, and 1 IDE. It didn't matter the machine, each software gave it's own error, and it was consistent across drives and machines.

Part of me is wondering if this is the disc, which would suck :( The setup program is blocked by Securom, and I'd like to make an image of the disc so I can reinstall it later if needed and the disc is lost. My other 2 discs (For a 2013 and 2015 model year of vehicle) I was able to get the DPM read out. But for this one, a 2017 model year, I am getting these DPM errors.

To note, the older service manual discs also used Securom 7+.

Anything I should try different?
 
  • Wow
Reactions: KleinesSinchen

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • kijetesantakalu042 @ kijetesantakalu042:
    I don't want to watch a furry yell in my earholes
  • BigOnYa @ BigOnYa:
    Welp, no dinner for you tonight.
  • kijetesantakalu042 @ kijetesantakalu042:
    I don't want fillian i want foodillian
  • BigOnYa @ BigOnYa:
    Your credit card on file has been charged. Thank you donating to the filllan fan club, you will receive email updates every five minutes.
  • kijetesantakalu042 @ kijetesantakalu042:
    Do I atleast get the fillian fansly?
  • BigOnYa @ BigOnYa:
    Yes for a phenomenal fee.
  • kijetesantakalu042 @ kijetesantakalu042:
    Go back to north korea where you don't have internet access
  • Xdqwerty @ Xdqwerty:
    @kijetesantakalu042, most of my recommendations are memes and clips (most of them not even in spanish)
  • kijetesantakalu042 @ kijetesantakalu042:
    @Xdqwerty My recos switch from memes to jpop to vtubers to fillian on a fixed cycle
  • K3Nv2 @ K3Nv2:
    Fulfill your fantasy of loading a blue tentacle girl with semen
  • BigOnYa @ BigOnYa:
    I still have access, I make one of my kids stand on the roof and hold a satellite dish, and other kid ride bike fast to create electricity.
  • kijetesantakalu042 @ kijetesantakalu042:
    @BigOnYa respect honestly
    +1
  • kijetesantakalu042 @ kijetesantakalu042:
    Neurosama is the intermediary step in between all of my recommendations
  • K3Nv2 @ K3Nv2:
    The most his kids do is tell him to fuck off he lies
    +2
  • BigOnYa @ BigOnYa:
    Ken just mad Ancientboi gave him away at birth.
  • K3Nv2 @ K3Nv2:
    Bigonya just mad I say what he already says first
    +1
  • K3Nv2 @ K3Nv2:
    Man woke up and my entire face cheek was bloody I think bigonya sat on me
  • kijetesantakalu042 @ kijetesantakalu042:
    ken just mad bigonya didn't sleep with him
    +2
  • K3Nv2 @ K3Nv2:
    @kijetesantakalu042, just mad Bigonya didn't sleep with him first
  • Xdqwerty @ Xdqwerty:
    @K3Nv2, >Fulfill your fantasy of loading a blue tentacle girl with semen. Wut
  • kijetesantakalu042 @ kijetesantakalu042:
    ken just mad he has fetal alcohol syndrome
  • K3Nv2 @ K3Nv2:
    @kijetesantakalu042, just mad he's get fecal matter addiction
  • kijetesantakalu042 @ kijetesantakalu042:
    Ken just mad his parents gave birth to him
  • K3Nv2 @ K3Nv2:
    @kijetesantakalu042, just mad he's got parents
  • kijetesantakalu042 @ kijetesantakalu042:
    Kens just mad his adam's apple is so big his doctor screamed so she didn't sleep with him
    kijetesantakalu042 @ kijetesantakalu042: Kens just mad his adam's apple is so big his doctor screamed so she didn't sleep with him