StarForce going down?

Yes, it is emulated , like Alocohol 120% can make images of such cds and mount them on a virtual cdrom and emulate the DPM so the lock checking is fooled as it is the original cd, but this is only an image file, you can not duplicate the locked cd this way. Any attempt to copy these kind of protected cds will cause the physically change in DPM so the copies won't simply pass the lock check. I have not seen also anyone cracked the lock checking routines, this can give us a generic patch for the lock.

still waiting...

[dyn!o]

Ahh... that's right but who cares about physical CD? It's not about physical copy but rather cracking the protection in general - no matter what way. The game protected by a CD check only always carry the highest risk - much higher than other software protections because it can be attacked from both sides: CD cloning and/or executable cracking.

The last solution, not implemented yet, is to calculate CD access and sectors read speed timings. At the moment it will fool all virtual drives but if someone will implement such a protection then very quickly Aclohol/CloneCD/DaemonTools will contain anti-timing features... and so on... and so on...

The question is if someone will invent a stable CD protection technology which force cracker to break each title manually (like Armadillo and ACProtect do). Then, in some countries, games piracy rate would be lowered - noticeably lowered.

Regards.

[taos]

Perhaps the solution could be that Armadillo uses a CD API protection like Krypton 0.5 but with a strong EXE packed with nanomites...

[peleon]

Hi Fellas,

Very good those links dynio Didnt know that starforce was going down but the opposite. I agree that drivers are a bad to make protection...though it's true they are harder to crack. So, it's a bit of compromise.

I tried SF3 long time ago but not success. Does anyone know if there are tutorials or papers explaining about this protection and how to break it? I know that russian guys have tried a lot with SF3 but dont know if they broke it.

Regards.

[taos]

I don't understand why device drivers are very hard to break...

I think that it's very hard to unpack "some" device drivers.Only that.

For example:

Any device driver (NT) is a SYS file. If you have the SYS file unpacked, then you can reverse (using IDA or other) when you reboot your SO in safe mode.
You can modify all the protection in the sys file (debugger detection, CRC,etc...). When you disable debugger detection, you can use your ring 0 debug. I know it's a hard job but I think it's not very very hard.

Regards

[dyn!o]

About StarForce reversing.
As far as I know there are two groups which managed to completely reverse StarForce VM. One Spanish and second Russian. Part of their work is available on the Internet (including VM description).

About drivers.
They are harder to protect but easier to reverse. For instance look at Hasp and Xtreme Protector drivers. They are hard to maintain (compatibility) but gives strong anti-debug shield in NT OSes clones (Pace/XProtector). Anyway, that's the endless story because cracker can always use ring0 too.... until the time someone will invent "ring -1" mode .

About debugger detection.
Sometimes it's not enogugh to skip it. If you want to keygen serious protection then, usually, you have to unpack it... althought it's not always necessary (for instance look at ExeShield tutorial).


Regards.

[peleon]

Hello dyn!o,

Thanks for the info.

I've been for a couple of hours trying to find those information about unpacking starforce but no success. Many forums talking about SF3 but they didnt succeed cracking it.

I just found in Yates2K site a small .DOC explaining the format of a VM instruction. Though, that's not help much.

Any help?

Thanks.