Top
Best
New

Posted by zdw 5 days ago

Defeating a 40-year-old copy protection dongle(dmitrybrant.com)
855 points | 286 commentspage 2
sonixier 5 days ago|
The company i work at has the same problem. We have some old mission-critical windows 2000 pc that runs the rpg compiler, with attached dongle. This gave me some clues on where to start - thanks author!
tclancy 4 days ago|
Check out this comment too! https://news.ycombinator.com/item?id=46854885
andyjohnson0 4 days ago||
> For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes.

Perhaps an indication that the code in that segment was hand-written in assembly language rather than C?

jasomill 4 days ago|
Probably just due to the fact that nothing in the standard C language maps to the x86 IN and OUT instructions for reading and writing I/O ports, though MS-DOS-era compilers supplied macros or library functions to use them (inp, inpw, outp, and outpw in Microsoft C, for example).
ForHackernews 4 days ago||
Searching for RPG compilers, I found this IBM notice: https://www.ibm.com/support/pages/osvs-rpg-ii-compiler110-wi...

    General Availability
        02-Nov-1981 , 281-999 
    No longer available for order, Withdrawn from Market
        05-Dec-2022 , 922-053 
    Transition to Extended/Sustained or End of Support
        30-Sep-2023 , 922-078 
    Completion of Extended, Sustained, Extension availability
        30-Sep-2023 
1981 to 2023 is a staggering run of support. That's why firms still buy IBM.
3uruiueijjj 5 days ago||
USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so.

In our case, the copy protection would still be as easy to bypass as the one in the article.

u1hcw9nx 5 days ago|
You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't.

Actual dongles with encryption and processor cost only $15 in batches of 100.

cricalix 5 days ago||
UnRaid does a variant of this; license is tied to the serial of the USB drive. It barely writes to the drive, so wear isn't meant to be much of an issue.
odomus 5 days ago||
Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?
yesturi 5 days ago||
BTW, in the European Union, reverse-engineering is perfectly legal, if it is done to ensure compatibility with the current tech.

I cannot cite the reliable sources for it, though.

TheDong 5 days ago|||
Once it hits 70 years from the lifetime of the author (so probably another 80 or 90 years from now) and is in public domain, that might change things since there will no longer be copyright being protected.

In terms of copyright terms, this software is still pretty young, not even halfway to public domain. It's disrespectful to call it "very old".

direwolf20 5 days ago||
Defeating a copy protection measure is illegal, even if the copy protection measure is not copyrighted.
TheDong 4 days ago||
I'm not talking about the copy protection, but the software being protected.

Surely if the work being protected isn't copyrighted, there's nothing to circumvent in terms of the DMCA?

direwolf20 4 days ago||
A non–copyrighted work can still have a copy protection measure
TheDong 4 days ago||
But would the DMCA ("Copyright Act") still apply when there's no copyright?

Here, let's read together: https://www.law.cornell.edu/uscode/text/17/1201

> No person shall circumvent a technological measure that effectively controls access to a work protected under this title

> protected under this title

A work not protected under title 17, copyright, is thus not covered.

direwolf20 5 days ago||
It's illegal.
NoiseBert69 4 days ago||
https://eur-lex.europa.eu/eli/dir/2009/24/oj/eng

Directive 2009/24/EC, Article 5 + Article 6

Under special circumstances it's legal within the EU do do this.

And removing a freaking old copy protection dongle to allow emulation of the software you legally are allowed to use falls under this.

sedatk 5 days ago||
Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.
unnouinceput 5 days ago||
Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk? The reason why this is not more common is because the more iterations you do, the harder is to create those iterations, which means you add a lot of time to create the protection which means that you need to have a finished code, and code is always modified by production team, so managers see this overtime unnecessary.
sedatk 4 days ago|||
> Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk?

Even the protection code in the 90’s had self-modifying code. It’s not novel or specifically hard to work with when you’re used to it, especially with modern tooling.

What makes some games harder to crack is that testing that they work okay throughout. That might mean playing all the game from the beginning to the end, and trying all the scenarios, and fixing all the issues found. Assuming that RDR2 takes at least 20 hours to finish, and close to 100 hours to fully complete, that’s a huge undertaking of course. It’s no surprise that it took that long.

self_awareness 4 days ago||||
> The reason why this is not more common

The real reason is that executable modifying its own code is often flagged by AV, or the OS itself, as an "insecure" activity. Since self-modification is used in attacks and exploits, good protections rarely use it now. It's impossible to use codesigns with self-modified code.

71bw 5 days ago|||
>Also to this day there is no crack to Diablo 3

Look into Blizzless :-)

unnouinceput 4 days ago||
Looking into Issues, reading 48 and just scrolling at beginning: "Local and LAN systems talk, but will not authenticate" / "Multiplayer Game Problem" / "cannot restore DB" / "Items stats do not reflect the game class"...etc, just to name a few.

Yeah, I really like to get frustration when I am gaming due to unsupported and canceled project /s

sintax 5 days ago||
Out of curiosity googled for Sentinel (which was one of the other dongles back then), seems somebody is now providing a bypass/emulation service: https://sentineldongle.com/ (not affiliated with this, just googled Sentinel like 5 minutes ago and this showed up).
userbinator 5 days ago||
For some reason, Reko was not able to decompile this code into a C representation

That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler.

In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program.

This reminds me of the classic Ken Thompson attack.

Sophira 5 days ago||
The fact that the software and hardware is evidently still in use at some companies gives me pause about whether releasing it in a cracked form publicly after having published it on a personal website would be a good idea.

Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in!

All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue.

If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.

mrandish 5 days ago||
Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one.

Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unknown software apps to preserve. Software sold for Windows 98 up to 2001 (so recent as to barely be considered 'vintage') with so little online footprint means it must have been incredibly obscure. No ads or reviews from magazines or even newsletters means there's a good chance it was a one or two person part-time, home-based business and the product had hundreds or maybe even just dozens of users.

1998-2001 was the hottest time ever for PC software. I worked in marketing Windows software during this period. To have any commercial Windows software product actively available for sale in the late 90s with no surviving footprint would almost require intentional effort to stay unknown. No press releases mailed. No review copies sent. No shows or conferences attended (exhibitor listings are searchable online now). There were much older niche vertical software programs for much more obscure platforms which we know sold less than a hundred copies ever, yet still have a larger online footprint than this program. The OP de-protecting and archiving this previously unknown commercial program represents quite a notable find in the preservation community.

direwolf20 5 days ago||
They could have been bought by a bigger company. You never know until you get sued. If the copyright isn't registered, and often even if it is, there's no way to know who owns it now.

If you're legally daring, and you get sued, you can try to force them to prove they own the copyright. There's often not enough documentation of this sort of thing. People have gotten away with not paying their car loans because after several loan sales and company mergers, the company that owns it can't prove they do, so effectively nobody owns it and it doesn't exist.

mrandish 4 days ago||
Sure. Anything's possible. My point was that any company response in this particular case is vanishingly unlikely.

> They could have been bought by a bigger company.

Any acquisition (or bankruptcy) in the 2000s is highly likely to have created a web trail.

> If the copyright isn't registered, and often even if it is, there's no way to know who owns it now.

But trademarks need to be renewed, which creates a web trail. And companies that sue over things, have generally already filed suit (or been sued) at least once in their 30+ year history (assuming they still exist today), all of which creates a web trail.

Over my decades in the tech business, I've been fortunate to work with some excellent lawyers as my in-house general counsel and one of the best taught me an important meta-point about realistically evaluating the likelihood of getting sued. Because, no matter how unlikely, anyone can sue over pretty much anything. So after doing the likelihood calculation, remember to ask: "What would the plaintiff's damages be?" Let's imagine someone is crazy enough to spend many months or years and tens of thousands of dollars suing over this defunct, unknown software which hasn't sold a copy in 25 years. But, the law being the law, they win a judgement of damages amounting to a symbolic $1. Because the plaintiff has to prove the actions of the defendant caused them to lose some significant amount money - in the present tense. And making significant amounts of money selling software in the 2020s leaves a web trail.

Because crazy people exist, this bonkers $1 scenario has actually happened (although not in software preservation as far as I'm aware). And, in the rare cases where it's not thrown out by an irritated judge for wasting everyone's time, the judgement is a remedy ("stop doing that") and symbolic damages of $1. And, no, the defendant doesn't have to spend anywhere near what the plaintiff does to defend. You can get to default judgement by doing as little as just filing a few forms and having someone appear once. However, IF the company still existed - the far more likely scenario is they'd just ask OP to remove his blog post and that would be that.

The reason this point matters is that vintage software preservation is historically important yet unfortunately some of our IP laws were created with no thought for what happens in the 'abandonware' scenario where the product is long past economic viability (or even being able to be run) and the company is either gone or no longer cares.

It is always theoretically possible that someone objects to archiving and preservation but the consequences for an individual preserving the software for history and no financial gain, who took reasonable steps to find the copyright owner - are almost always nothing more than a C&D letter - and that's the rare worst case. This is based on decades of experience preserving copyrighted commercial abandonware by non-profit projects like Archive.org and MAME.

My concern is if enough people continually drop the pedantically correct drive-by warning "But you could be SUED" every time some volunteer preservationist saves another title from extinction, people who don't understand there's virtually zero chance in a case like this that OP suffers any meaningful harm simply won't do volunteer preservation or help those who are. It's a form of concern trolling which doesn't help while potentially causing a good thing to happen less.

direwolf20 4 days ago||
You can break laws. You just have to realistically estimate the risk. The chance is low, but the impact is high. Maybe you set up an LLC just in case, or you act from the shadows like "Anna"

The government's traditionally very weaponized. I'd err on the side of overestimating risk unless you're certain about the legalities. Your life could be ruined. Most things that are worth doing could ruin your life. You could die in a car crash too. You have to choose which risks to take.

mrandish 4 days ago||
> ... but the impact is high.

Wow. I kind of regret the effort supplying supporting facts and reasoning demonstrating the impact is almost invariably zero or negligible.

> Most things that are worth doing could ruin your life. You could die in a car crash too.

So... you agree?

> You have to choose which risks to take.

And you have to choose which concerns to troll. Maybe consider the potential unintended harm you may cause of stopping something worth doing before evoking the specter of a scary-sounding consequence. A consequence which is, in reality, very nearly always harmless (in the non-profit, preservation with reasonable prior search scenario) as well as vanishingly unlikely to happen at all.

direwolf20 4 days ago||
After Samourai, Tornado Cash, and so on, I'm not trusting anyone to tell me the possible impact of breaking a law is low. The government has repeatedly demonstrated that it's willing to apply the maximum penalty it can to anyone it hates, laws be damned.
prmoustache 4 days ago||
> If you haven't already checked whether the patent and other intellectual property is still owned by any company,

The copyright may still apply but any patent must have expired (20years).

felineflock 4 days ago||
I did something similar decades ago: ran on debug with and without the dongle, then compared the execution path to identify where exactly it deviated. Then replaced the "jump" with "nop" to prevent it from branching out when the dongle was absent. This was with an early version of Visual C++ and I knew only a little 8086 Assembly.
jedberg 5 days ago|
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch?

Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid.

This was basically the 80s version of that.

tclancy 4 days ago|
I mean, we used to turn single-sided 5 1/4" disks for the C64 into double-sided disks through the use of cutting-edge technology. Literally. I was fancy and got a $5 hole punch built for the job, but scissors worked too. Fast Hack'em may still be my favorite piece of software ever.
More comments...