Live data from Hacker News

Defeating a 40-year-old copy protection dongle

dmitrybrant.com

251–260 of 302 posts

Re: Defeating a 40-year-old copy protection dongle

#251
> It’s possible that I haven’t fully understood the logic, and the copy protection will somehow re-surface in another way.

They should be glad the copy protection is not more in the style of "The Games: Winter Challenge", where playing a pirated copy would make it subtly impossible to play many levels [1]. Would be 'fun' if the exported accounting data would contain all kinds of subtle errors.

[1] https://mrwint.github.io/winter/writeup/writeup.html

Re: Defeating a 40-year-old copy protection dongle

#252
post #108

Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.

Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do…

> Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk?

Even the protection code in the 90’s had self-modifying code. It’s not novel or specifically hard to work with when you’re used to it, especially with modern tooling.

What makes some games harder to crack is that testing that they work okay throughout. That might mean playing all the game from the beginning to the end, and trying all the scenarios, and fixing all the issues found. Assuming that RDR2 takes at least 20 hours to finish, and close to 100 hours to fully complete, that’s a huge undertaking of course. It’s no surprise that it took that long.

Re: Defeating a 40-year-old copy protection dongle

#253
post #55

Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?

It's illegal.

https://eur-lex.europa.eu/eli/dir/2009/24/oj/eng

Directive 2009/24/EC, Article 5 + Article 6

Under special circumstances it's legal within the EU do do this.

And removing a freaking old copy protection dongle to allow emulation of the software you legally are allowed to use falls under this.

Re: Defeating a 40-year-old copy protection dongle

#255
post #45

Earlier quoted context omitted.

This post doesn't go to to great detail, but seems to run natively: https://www.reddit.com/r/windows/comments/1n1no1k/august_202...

It might be possible to use the rest of that RAM above the 4GB barrier as a ridiculously fast RAM disk, with an XMS driver like this one: https://github.com/Baron-von-Riedesel/HimemSX

Huh, so someone actually built this? I was thinking about something similar the other day, in the form of a Windows 9x driver that would use that inaccessible RAM as a "page file".

Re: Defeating a 40-year-old copy protection dongle

#256

Earlier quoted context omitted.

Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one. Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unkn…

They could have been bought by a bigger company. You never know until you get sued. If the copyright isn't registered, and often even if it is, there's no way to know who owns it now. If you're legally daring, and you get sued, you can try to force them to prove they own the copyright. There's often not enough documentation of this sort of thing. People have gotten away with not paying their car loans because after s…

Sure. Anything's possible. My point was that any company response in this particular case is vanishingly unlikely.

> They could have been bought by a bigger company.

Any acquisition (or bankruptcy) in the 2000s is highly likely to have created a web trail.

> If the copyright isn't registered, and often even if it is, there's no way to know who owns it now.

But trademarks need to be renewed, which creates a web trail. And companies that sue over things, have generally already filed suit (or been sued) at least once in their 30+ year history (assuming they still exist today), all of which creates a web trail.

Over my decades in the tech business, I've been fortunate to work with some excellent lawyers as my in-house general counsel and one of the best taught me an important meta-point about realistically evaluating the likelihood of getting sued. Because, no matter how unlikely, anyone can sue over pretty much anything. So after doing the likelihood calculation, remember to ask: "What would the plaintiff's damages be?" Let's imagine someone is crazy enough to spend many months or years and tens of thousands of dollars suing over this defunct, unknown software which hasn't sold a copy in 25 years. But, the law being the law, they win a judgement of damages amounting to a symbolic $1. Because the plaintiff has to prove the actions of the defendant caused them to lose some significant amount money - in the present tense. And making significant amounts of money selling software in the 2020s leaves a web trail.

Because crazy people exist, this bonkers $1 scenario has actually happened (although not in software preservation as far as I'm aware). And, in the rare cases where it's not thrown out by an irritated judge for wasting everyone's time, the judgement is a remedy ("stop doing that") and symbolic damages of $1. And, no, the defendant doesn't have to spend anywhere near what the plaintiff does to defend. You can get to default judgement by doing as little as just filing a few forms and having someone appear once. However, IF the company still existed - the far more likely scenario is they'd just ask OP to remove his blog post and that would be that.

The reason this point matters is that vintage software preservation is historically important yet unfortunately some of our IP laws were created with no thought for what happens in the 'abandonware' scenario where the product is long past economic viability (or even being able to be run) and the company is either gone or no longer cares.

It is always theoretically possible that someone objects to archiving and preservation but the consequences for an individual preserving the software for history and no financial gain, who took reasonable steps to find the copyright owner - are almost always nothing more than a C&D letter - and that's the rare worst case. This is based on decades of experience preserving copyrighted commercial abandonware by non-profit projects like Archive.org and MAME.

My concern is if enough people continually drop the pedantically correct drive-by warning "But you could be SUED" every time some volunteer preservationist saves another title from extinction, people who don't understand there's virtually zero chance in a case like this that OP suffers any meaningful harm simply won't do volunteer preservation or help those who are. It's a form of concern trolling which doesn't help while potentially causing a good thing to happen less.

Re: Defeating a 40-year-old copy protection dongle

#257

Earlier quoted context omitted.

If I get ongoing value from my fully paid off car, should I keep paying the OEM? How about my house or my bike or my shoes? My toilet (huge ROI on this one)? My fridge?? Why do we feel that software gets to impose this ridiculous SaaS model? The only real answer is "because they can", not because it's helping anyone. Reality is that many modern software developments have plenty in common with designing a toilet. You…

The funny thing is SAAS frequently provides less value because of automatic updates. If your toilet could change its shape at a moment's notice because of some study on a sample of people who are entirely unlike you or even just because some random PM wanted a promotion, and you could not stop it from doing so, it would be incredibly obvious how bad that was. Yet many people in the software field try to convince user…

... If there were an ever-evolving landscape of awful things crawling up out of my sewer through my toilet, I would very much want to pay for automated toilet updates to prevent the most recent awful crawling horror from appearing in my bathroom.

Re: Defeating a 40-year-old copy protection dongle

#258
post #3

> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.

The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access. More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case. I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty. What if the hardware has a LFSR in it…

SoftICE was like magic back in the day.

Re: Defeating a 40-year-old copy protection dongle

#259

Earlier quoted context omitted.

They could have been bought by a bigger company. You never know until you get sued. If the copyright isn't registered, and often even if it is, there's no way to know who owns it now. If you're legally daring, and you get sued, you can try to force them to prove they own the copyright. There's often not enough documentation of this sort of thing. People have gotten away with not paying their car loans because after s…

Sure. Anything's possible. My point was that any company response in this particular case is vanishingly unlikely. > They could have been bought by a bigger company. Any acquisition (or bankruptcy) in the 2000s is highly likely to have created a web trail. > If the copyright isn't registered, and often even if it is, there's no way to know who owns it now. But trademarks need to be renewed, which creates a web trail.…

You can break laws. You just have to realistically estimate the risk. The chance is low, but the impact is high. Maybe you set up an LLC just in case, or you act from the shadows like "Anna"

The government's traditionally very weaponized. I'd err on the side of overestimating risk unless you're certain about the legalities. Your life could be ruined. Most things that are worth doing could ruin your life. You could die in a car crash too. You have to choose which risks to take.

Re: Defeating a 40-year-old copy protection dongle

#260

Earlier quoted context omitted.

Defeating a copy protection measure is illegal, even if the copy protection measure is not copyrighted.

I'm not talking about the copy protection, but the software being protected. Surely if the work being protected isn't copyrighted, there's nothing to circumvent in terms of the DMCA?

A non–copyrighted work can still have a copy protection measure
Post reply on HN