Live data from Hacker News

Defeating a 40-year-old copy protection dongle

dmitrybrant.com

291–300 of 302 posts

Re: Defeating a 40-year-old copy protection dongle

#291

Earlier quoted context omitted.

The funny thing is SAAS frequently provides less value because of automatic updates. If your toilet could change its shape at a moment's notice because of some study on a sample of people who are entirely unlike you or even just because some random PM wanted a promotion, and you could not stop it from doing so, it would be incredibly obvious how bad that was. Yet many people in the software field try to convince user…

... If there were an ever-evolving landscape of awful things crawling up out of my sewer through my toilet, I would very much want to pay for automated toilet updates to prevent the most recent awful crawling horror from appearing in my bathroom.

If the people who produced toilets ACTUALLY cared about stopping the ever-evolving landscape of awful things, they could:

A. Release security updates independently from feature updates

B. Stop adding random features that hook you up to more unwanted landscapes, or landscapes at all (software that could run entirely locally without network access but have network access anyway, updates that force ads, the updater itself, etc.)

but they don't because that's not the actual reason they have automatic updates.

Re: Defeating a 40-year-old copy protection dongle

#292
In the 80s I worked on BPCS, an early ERP system, and yes it was coded in RPG2, and RPG3. Mind blowingly hard to understand the source code but I credit my efforts then with later finding AWK so easy and logical. IBM had also just brought out the baby System36 which looked like a PC beige box but was actually a minified s/36 if I recall correctly. Didn't sell well. Then there was RPG for DOS which I heard of but didn't use.

If the authors client had been using an RPG accounting system for 40 years then it might be BPCS and there were tools out there to convert RPG to other less traumatic languages.

But fascinating article nonetheless and brought back memories of being an apps programmer. I also remember those dongles. Really fun when you had multiple apps with their own dongles and only one port.

Re: Defeating a 40-year-old copy protection dongle

#293

In the 80s I worked on BPCS, an early ERP system, and yes it was coded in RPG2, and RPG3. Mind blowingly hard to understand the source code but I credit my efforts then with later finding AWK so easy and logical. IBM had also just brought out the baby System36 which looked like a PC beige box but was actually a minified s/36 if I recall correctly. Didn't sell well. Then there was RPG for DOS which I heard of but didn…

So did I. We joked that BPCS stood for: Better Programs Coming Soon

It was actually a well designed and functional system, just too many bugs.

Re: Defeating a 40-year-old copy protection dongle

#294

Earlier quoted context omitted.

>business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liable for problems in said software.) This is a nice idea but the reality is that there's MANY corporate customers who are happy to get away with casual piracy. Sometimes it's a holdover from when the com…

Even at a simple level, if it's between spending weeks going through purchasing or not asking too many questions and getting on with it. I can see a lot of people choosing option B.

Also don’t underestimate the stupidity of inexperienced employees in their mid 20s…

One found someone installed a cracked Adobe Photoshop on a work PC. Probably a stupid one/off task. We were not graphic artists. Not 100% sure who did it but it was in an area only a few people had access.

The risk management team was not amused…

Re: Defeating a 40-year-old copy protection dongle

#295

Earlier quoted context omitted.

If you think it's bad now, the early days of the web were absolutely filled with scumbag grifters who made small fortunes hiring contractors and then refusing to pay. Many of them disappeared in the y2k dot com bust, but then seem to have reappeared in SF after 2008. In the late 1990's, my second ever Flash app development client stiffed me on a $10k invoice. He finally figured out 6 months later that he didn't have…

> because that client wasn't planning to pay them Wait, you mean they used your little ruse as a means to be paid themselves??

Yes they did, and it worked!

Re: Defeating a 40-year-old copy protection dongle

#296

Earlier quoted context omitted.

The proper thing to do is not to zeroize the correct string memory before comparing. The proper thing is to only store the hash in the binary in the first place, not the correct string. (Although having a 2nd layer of hashing before comparing might also be a good idea, and in that case you would want to zeroize the 1st hash before comparing the 2nd hash.)

You can't not store the correct string in this case, as the key is calculated from the user's email address. There is an infinite number of possible keys. THe only way to check if the key is correct is to recalculate it yourself. These days, I guess you could make the key an ECDSA signature for a public key embedded in the binary if you were willing to accept such long keys.

[deleted]

Re: Defeating a 40-year-old copy protection dongle

#297
I wrote a Prime minicomputer emulator in 2005, mostly on a lark because I grew up on them in high school and college and they were pretty advanced for their time, with token ring networking, remote call file systems before NFS, lots of Multics-like features (the Prime founders were associated with Honeywell and MIT).

I announced it on the Prime Usenet group and a guy wrote to say he was interested in using it for production, but had been burned before and wanted to make sure it worked. So I set him up a VM in my basement, he uploaded a bunch of his executables, and they all worked. I charged $1000/mo for the emulator. Since he was in the EU, I knew I wouldn't have a leg to stand on to get paid if they decided to stiff me, so I did some investigating into a Matrix dongle. It was pretty slick, and I coded up a copy protection scheme that allowed the emulator to run only when the dongle was inserted, and it contacted a license server in my basement to verify that it was allowed to run. To make sure my basement server wasn't a critical resource, I had the dongle setup like a battery that got periodically "charged": if the license server was down, the emulator kept running for up to N days on its local charge, giving me time to solve issues with the license server.

This went on for a few years, but they were never happy they had to actually keep paying for the technology. I heard every excuse in the book about why they needed a backup dongle. I knew the real reason they wanted one was to hire someone to hack it, but unfortunately, that would mean removing it, and that would halt the emulator within 5 minutes. So they came up with excuses like:

"Our state regulator requires us to have a backup computer system, so we need 2 dongles". No, you start computer 2, move the dongle, and you're fine.

One time I heard from a guy who said he heard about the emulator from a Prime parts guy in Chicago I knew, and wanted to try it out for a large EU bank. I asked where to send it, and surprise - it was the same city as my other customer! So I call R in Chicago and asked him how the conversation went with this "banking" customer, and R says "It was kinda weird. He said he had a Prime with a failing disk drive, but when I asked what model drive he had, he didn't know. He kept asking if there was any other solution for him besides hardware until R says "Well, there's a guy that has an emulator", which the banking guy jumped on immediately. So I go to Google and lookup this address the banker gives me to send the dongle to, and it's a massage parlor!

All in all, it was a good deal for me and a good deal for him, even if he wasn't happy about it. He was getting paid to support his own Prime software that he didn't have to port. But I learned my lesson as a youngin' about companies saying they will pay for something. I sold some printer/spooler minicomputer software in my early 20's and had a large investment bank (huge actually, as in everyone at the time would recognize their name) try it out for a month. They called and said they were processing the one-time license fee of $1500 but could I give them the access code early so they wouldn't have a disruption for a few days. I did it, and never got a dime from them. Hard lesson learned about being nice.

Re: Defeating a 40-year-old copy protection dongle

#298
post #224
post #20

Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it. The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address o…

my story of this is Atari Macro Assembler. The floppy had a specific sector that was damaged, and the loader would test this sector to ensure it was in fact damaged. this was obvious becuase whenever loading the floppy, you had to wait for one of those big "BZZT....BZZT" things where the 810 drive was trying to access a bad sector and giving up. I was able to disassemble maybe the first 30 bytes of the boot to see it…

I've heard that Happy Drive singlehandedly destroyed the commercial viability of the Atari 8-bit software market, because it was so widespread and is so powerful at duplicating games.

Re: Defeating a 40-year-old copy protection dongle

#299
post #55

Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?

The Internet Archive has a DMCA exemption. https://en.wikipedia.org/wiki/Internet_Archive#Software>

There are more general exemptions, including dongle-based software. https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>

Re: Defeating a 40-year-old copy protection dongle

#300

Cracking this dongle; wouldn't this be a federal offence in the US? Not being snarky - genuine question! I am not from the US :-)

>Cracking this dongle; wouldn't this be a federal offence in the US?

No. As of 2003 there is a DMCA exemption for "computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete". https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>

Post reply on HN