Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Defeating a 40-year-old copy protection dongle

dmitrybrant.com

Post reply on HN
Print view View original

271–280 of 302 posts

Re: Defeating a 40-year-old copy protection dongle

#271

Post by marssaxman »

compsciphd wrote: post #202
notpushkin wrote: post #185

Earlier quoted context omitted.

My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.

back in the mid to late 90s, I got a trial for compuserve that was a free 2 month trial. I liked it as as they provided dialup PPP access so was able to use it as full time internet access. It wasn't quite "2 months" of access though. It was 1500 hours of access (which in practice > 24*62). However, their usage accounting software wasn't great. I had it setup to reconnect if the connection dropped, and they didn't do…

Back in the same era, an enterprising young hacker of my acquaintance obtained unmetered access to another of those pay-by-the-hour dialup services by messing with window Z-order. The dialup service's GUI client had a free tech support area; billing stopped once you opened its window, and did not start again until you closed it. The rest of the system was all still there and running as usual - you just couldn't click on any of it while the support-area window was active.

So... this kid whipped up a little bit of code which let you force the topmost window to the back, and proceeded to spend impressive quantities of time online doing apparently nothing in the online service's free support area.

Re: Defeating a 40-year-old copy protection dongle

#272

Post by anyfoo »

Someone wrote: post #184
anyfoo wrote: post #56

Earlier quoted context omitted.

Was ist ever confirmed that it was in fact a laser? I wanted to make a trivia question out of this ProLok protection, because “lasers for copy protection” sounds just weird enough to potentially be a nonsense answer without context, but I couldn’t confirm that the holes were indeed made with lasers, and not with other means.

Their patent ( https://patents.google.com/patent/US4785361A/en ) doesn’t mention a laser, but of course that doesn’t imply it wasn’t a laser. I would guess (more or less) identically damaging multiple floppy disks in the same way would be easier with a laser than with something mechanical (e.g. a knife or a drill) (it is fairly easy to control power and duration of a burn), so it might well have been a laser. On the…

It could be a tiny drop of something corrosive, but with that I’m also still wondering if a laser isn’t simpler, yeah.

I have almost no doubt that it could be a laser, it’s just unfortunate (and maybe a little bit suspicious) that I haven’t found it confirmed anyway. Almost like they wanted it to be a laser (hence the folklore around it), but had to use a less cool method to do it. But of course it might as well just have been a laser, and they for some reason declined to market or even just document it that way, for whatever reason.

Re: Defeating a 40-year-old copy protection dongle

#273

Post by 486sx33 »

nonamenoslogan wrote: post #262
hypercube33 wrote: post #239

Earlier quoted context omitted.

Heh there was some ad supported dial up Internet I found. you were supposed to download their browser and it'd dial in and work normal enough. I noticed it created a windows dial up connection. When you launched the browser the login info worked on this. I could just dial their server and save the username and password and use any browser or game normally.

Was this NetZero? I kind of recall their CDs would do something similar, launch an Ad supported version of Netscape--but if you just copied the Dial-Up connection it made, you could recreate it without the need for the Browser.

Eventually NetZero forced you to use their own dialer to ensure you kept the ads running… but you could spy on the ppp connection by just opening the COM port of your modem in terminal and watching. The password was encrypted (xor?) but you could just copy and paste the value into a regular dialer lol

Re: Defeating a 40-year-old copy protection dongle

#274

Post by jasomill »

compsciphd wrote: post #203
miki123211 wrote: post #164

Earlier quoted context omitted.

Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line. This works because s…

mellanox switches included an executable keygen in their firmware bundle. It could be used to both generate a key (given feature set) combined with a secret, but could also be used to validate what features a given key gave you (using the secret). Hence, the secret was stored in the binary and was easily visible with strings and one could then just use the tool itself to generate keys.

Sort of reminds me of the DEC PAKGEN tool to generate licenses for the VMS license management facility, which DEC distributed so third-party software vendors could issue licenses for their own software.

To prevent vendor A from creating licenses for vendor B's products, each DEC-issued PAKGEN license only authorized license generation for a specific named vendor's products.

As with all other DEC-supplied VMS software, PAKGEN was licensed through the VMS license management facility.

Thus if you could somehow get a PAKGEN license for the vendor name "DEC", you could use it to generate licenses for arbitrary DEC products.

Including PAKGEN itself.

And you could therefore generate licenses authorizing PAKGEN to generate licenses for arbitrary vendors' products.

Re: Defeating a 40-year-old copy protection dongle

#275

Post by jasomill »

ale42 wrote: post #138
ruleryak wrote: post #7

Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you wer…

I remember an icon editor (or something similar) for Windows 3.1, it was a shareware where you could enter a code to remove the nag screen. No crack was necessary, I basically managed to enter valid registration codes by just typing random numbers. In the end I had enough valid numbers that I could figure out the logic, it was something about the sums of digit groups.

This was true for the 10-digit CD keys Microsoft used for many products in the 90s: the first three digits could be almost anything, and the last seven digits had to sum to a multiple of 7, so, e.g., 111-1111111 was a valid product key (for any product that used the scheme).

Re: Defeating a 40-year-old copy protection dongle

#276

Post by chongli »

charcircuit wrote: post #117
chongli wrote: post #105

Earlier quoted context omitted.

There are arrangements where you continue to pay for cars and houses without owning them. They're called leases and rental agreements. They typically cost a lot less for the consumer than outright purchases and at the conclusion of the lease/rental term the consumer is free to return the car/house to its owner without compensation for depreciation or wear & tear (though car leases usually impose mileage restrictions…

Rental cars and houses do exist, but you could still have fully owned cars and houses whose doors lock without paying a subscription. It doesn't have to be the full thing either. Certain tiers could disable only air conditioning for example.

Rental cars and houses do exist, but you could still have fully owned cars and houses whose doors lock without paying a subscription.

For cars maybe, but not for houses. Property law for land is very old and very well established. If someone else is able to lock you out of your house then they are the title owner, not you. If you are the title owner then you’re well within your rights to have a locksmith replace the lock on the door.

Re: Defeating a 40-year-old copy protection dongle

#277

Post by jasomill »

andyjohnson0 wrote: post #218

> For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Perhaps an indication that the code in that segment was hand-written in assembly language rather than C?

Probably just due to the fact that nothing in the standard C language maps to the x86 IN and OUT instructions for reading and writing I/O ports, though MS-DOS-era compilers supplied macros or library functions to use them (inp, inpw, outp, and outpw in Microsoft C, for example).

Re: Defeating a 40-year-old copy protection dongle

#278

Post by notpushkin »

andreaven wrote: post #266
notpushkin wrote: post #185

Earlier quoted context omitted.

My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.

you were lucky it was an unsigned var.. otherwise you could have gifted a very nasty trial time of -1 minute! a pretty nice anti-addiction feature :-)

Hahaha. On a second thought I think it was a bit trickier and did some weird math to obfuscate the value (probably something simple, like XOR).

So yeah, my actual fix was to mash buttons until I got a big enough number :D

Re: Defeating a 40-year-old copy protection dongle

#279

Post by notpushkin »

stvltvs wrote: post #241
davidwritesbugs wrote: post #186

Earlier quoted context omitted.

Hope she knows she still only has 3million trial days left

Grandson was naive to his grandmother's mortality.

Yep – she died a couple years ago.

Hope she enjoys the full version of life better than the trial we live in :’)

Re: Defeating a 40-year-old copy protection dongle

#280

Post by TheDong »

direwolf20 wrote: post #260
TheDong wrote: post #247

Earlier quoted context omitted.

I'm not talking about the copy protection, but the software being protected. Surely if the work being protected isn't copyrighted, there's nothing to circumvent in terms of the DMCA?

A non–copyrighted work can still have a copy protection measure

But would the DMCA ("Copyright Act") still apply when there's no copyright?

Here, let's read together: https://www.law.cornell.edu/uscode/text/17/1201

> No person shall circumvent a technological measure that effectively controls access to a work protected under this title

> protected under this title

A work not protected under title 17, copyright, is thus not covered.

Post reply on HN