Best Way to Image a Protected CD?

[LaBBa]

thanks for trying and help me
i'm not home and will return only next week so i will do it when i return and PM you

regards,
LaBBa

[LaBBa]

Hi all

I Have made some google search and found that more ppl have same issues
with same protection

http://club.cdfreaks.com/f18/defekte-sektoren-ab-316687-a-72880/

BTW i have made a image and compare the md5 of the mounted image againts the original CD and they are the same..

I'm currently uploading the CDs images will update you all soon..


regards,
LaBBa

[LaBBa]

Hi
I have made a trace log with CD and with Image CD from the start of the loops on the DeviceIoControl , i use beyond compare to view them and i'm still debugging it to see the places where things goes wrong.
see attached files

the image was created with blindWrite with a liteOn CDRW with profile of "Bad Sectors"

the CD files and the Mounted CD file where compared with MD5 and verify
the CD and Image data matches when comparing with InfoTool.

ps: i have already patched the places of JNZ and JZ and the application crashes if i do it so i need to find out why the values are deffrent when it runs from the Image CD

[LaBBa]

from what i'm seeing in the trace log there is a diffrent behavior when returning from the DeviceIoControl when using the CD and when using the CD Image :

With CD:

004B415F Main     PUSH EAX
004B4160 Main     PUSH 50
004B4162 Main     PUSH ECX
004B4163 Main     PUSH 50
004B4165 Main     PUSH ECX
004B4166 Main     PUSH 4D014 // IOCTL_SCSI_PASS_THROUGH_DIRECT
004B416B Main     MOV ECX,Copy_of_.004B398B                 ; ECX=004B398B
004B4170 Main     ADD ECX,16D                               ; ECX=004B3AF8
004B4176 Main     PUSH DWORD PTR DS:[ECX]
004B4178 Main     MOV ECX,Copy_of_.004B398B                 ; ECX=004B398B
004B417D Main     ADD ECX,2FB                               ; ECX=004B3C86
004B4183 Main     CALL DWORD PTR DS:[ECX]
DeviceIoControl   PUSH 14
7C801627 Main     PUSH kernel32.7C810CC8
.....
......
7C801662 Main     PUSH DWORD PTR SS:[EBP+8]
7C801665 Main     JE kernel32.7C801743
7C80166B Main     CALL DWORD PTR DS:[<&ntdll.NtDeviceIoControlFile>]
ZwDeviceIoControl>MOV EAX,42                                ; EAX=00000042
7C90D8E8 Main     MOV EDX,7FFE0300                          ; EDX=7FFE0300
....
....
7C802519 Main     LEAVE                                     ; EBP=0012FF08
7C80251A Main     PUSH ECX
7C80251B Main     RETN
7C801694 Main     RETN 20
004B4185 Main     POP ECX                                   ; ECX=00149988
004B4186 Main     POP EDX                                   ; EDX=004B3CD5
004B4187 Main     MOV ECX,Copy_of_.004B398B                 ; ECX=004B398B
004B418C Main     ADD ECX,18C                               ; ECX=004B3B17
004B4192 Main     MOV ECX,DWORD PTR DS:[ECX]                ; ECX=00149988
004B4194 Main     OR EAX,EAX
004B4196 Main     MOV AL,BYTE PTR DS:[ECX+2]                ; EAX=00000000
004B4199 Main     JE SHORT Copy_of_.004B41A1
004B419B Main     OR AL,AL
004B419D Main     JNZ SHORT Copy_of_.004B41A1 -> HERE WILL NOT JMP
004B419F Main     MOV AL,1                                  ; EAX=00000001

and with Image CD:

004B4150 Main     PUSH 0
004B4152 Main     MOV EDX,Copy_of_.004B398B                 ; EDX=004B398B
004B4157 Main     ADD EDX,17D                               ; EDX=004B3B08
004B415D Main     MOV EAX,EDX                               ; EAX=004B3B08
004B415F Main     PUSH EAX
004B4160 Main     PUSH 50
004B4162 Main     PUSH ECX
004B4163 Main     PUSH 50
004B4165 Main     PUSH ECX
004B4166 Main     PUSH 4D014  // IOCTL_SCSI_PASS_THROUGH_DIRECT
004B416B Main     MOV ECX,Copy_of_.004B398B                 ; ECX=004B398B
004B4170 Main     ADD ECX,16D                               ; ECX=004B3AF8
004B4176 Main     PUSH DWORD PTR DS:[ECX]
004B4178 Main     MOV ECX,Copy_of_.004B398B                 ; ECX=004B398B
004B417D Main     ADD ECX,2FB                               ; ECX=004B3C86
004B4183 Main     CALL DWORD PTR DS:[ECX]
DeviceIoControl   PUSH 14
7C801627 Main     PUSH kernel32.7C810CC8
7C80162C Main     CALL kernel32.7C8024CB
7C8024CB Main     PUSH kernel32.7C8399F3
....
....
7C801660 Main     PUSH EBX
7C801661 Main     PUSH EBX
7C801662 Main     PUSH DWORD PTR SS:[EBP+8]
7C801665 Main     JE kernel32.7C801743
7C80166B Main     CALL DWORD PTR DS:[<&ntdll.NtDeviceIoControlFile>]
ZwDeviceIoControl>MOV EAX,42                                ; EAX=00000042
7C90D8E8 Main     MOV EDX,7FFE0300                          ; EDX=7FFE0300
.....
.....
7C802516 Main     POP EDI
7C802517 Main     POP ESI                                   ; ESI=00591D60
7C802518 Main     POP EBX                                   ; EBX=00000010
7C802519 Main     LEAVE                                     ; EBP=0012FF08
7C80251A Main     PUSH ECX
7C80251B Main     RETN
7C801694 Main     RETN 20
004B4185 Main     POP ECX                                   ; ECX=00149988
004B4186 Main     POP EDX                                   ; EDX=004B3CD5
004B4187 Main     MOV ECX,Copy_of_.004B398B                 ; ECX=004B398B
004B418C Main     ADD ECX,18C                               ; ECX=004B3B17
004B4192 Main     MOV ECX,DWORD PTR DS:[ECX]                ; ECX=00149988
004B4194 Main     OR EAX,EAX
004B4196 Main     MOV AL,BYTE PTR DS:[ECX+2]                ; EAX=00000002
004B4199 Main     JE SHORT Copy_of_.004B41A1
004B419B Main     OR AL,AL
004B419D Main     JNZ SHORT Copy_of_.004B41A1 ->HERE WILL JUMP

the DeviceIoControl uses : IOCTL_SCSI_PASS_THROUGH_DIRECT
as we can see with CD
004B4196 Main MOV AL,BYTE PTR DS:[ECX+2] ; EAX=00000000

and without CD but with CD Image
004B4196 Main MOV AL,BYTE PTR DS:[ECX+2] ; EAX=00000002

we get diffrent values...
i'm currently debugging it to see what is the cause for this deffrent values

any help will be appreciated.

Regards,
LaBBa

What if you burn your image? Same difference?
And what if you change the eax value to the one returned by the original cd?
Is it working then?

[LaBBa]

I never tried to trace the code with burned cd because it showed me the same error msg about not original CD so i made an image and then start working on the image.. i will check and trace the code with a burned CD and will show my results of debugging.

if i patch the eax value the application crash.

[LaBBa]

Hi all

I have just found out that some one in my contry has cracked the CD protection of a newer version of the application i'm trying to crack
i don't know if this new version is like my version that comes with 2 CDs
maybe this version came with 1 DVD.

he added a file that he called : appName.emu
and it's a binary file with this header :

CD001
 GEAR CD/DVD PREMASTERING        GEAR SOFTWARE  2007032013494800200703201349480019830320130322002007032013032200

well i check and there is an application that create a CD copy called GEAR SOFTWARE but i don't see anything spcial about this app.

the Cracker also patch the application so it will read from file .emu data when trying to boot from CD

does any one knows about this kind of CD protection that need to be cracked like so ?

and i don't understand how did he make this dump file and make the application read this when needed... (i don't have the original exe file of this new version so i can't compare it)

i have added the emu file that was added to crack this newer app

regards,
LaBBa.