Top
Best
New

Posted by zdw 5 days ago

Defeating a 40-year-old copy protection dongle(dmitrybrant.com)
855 points | 286 commentspage 5
prirun 12 hours ago|
I wrote a Prime minicomputer emulator in 2005, mostly on a lark because I grew up on them in high school and college and they were pretty advanced for their time, with token ring networking, remote call file systems before NFS, lots of Multics-like features (the Prime founders were associated with Honeywell and MIT).

I announced it on the Prime Usenet group and a guy wrote to say he was interested in using it for production, but had been burned before and wanted to make sure it worked. So I set him up a VM in my basement, he uploaded a bunch of his executables, and they all worked. I charged $1000/mo for the emulator. Since he was in the EU, I knew I wouldn't have a leg to stand on to get paid if they decided to stiff me, so I did some investigating into a Matrix dongle. It was pretty slick, and I coded up a copy protection scheme that allowed the emulator to run only when the dongle was inserted, and it contacted a license server in my basement to verify that it was allowed to run. To make sure my basement server wasn't a critical resource, I had the dongle setup like a battery that got periodically "charged": if the license server was down, the emulator kept running for up to N days on its local charge, giving me time to solve issues with the license server.

This went on for a few years, but they were never happy they had to actually keep paying for the technology. I heard every excuse in the book about why they needed a backup dongle. I knew the real reason they wanted one was to hire someone to hack it, but unfortunately, that would mean removing it, and that would halt the emulator within 5 minutes. So they came up with excuses like:

"Our state regulator requires us to have a backup computer system, so we need 2 dongles". No, you start computer 2, move the dongle, and you're fine.

One time I heard from a guy who said he heard about the emulator from a Prime parts guy in Chicago I knew, and wanted to try it out for a large EU bank. I asked where to send it, and surprise - it was the same city as my other customer! So I call R in Chicago and asked him how the conversation went with this "banking" customer, and R says "It was kinda weird. He said he had a Prime with a failing disk drive, but when I asked what model drive he had, he didn't know. He kept asking if there was any other solution for him besides hardware until R says "Well, there's a guy that has an emulator", which the banking guy jumped on immediately. So I go to Google and lookup this address the banker gives me to send the dongle to, and it's a massage parlor!

All in all, it was a good deal for me and a good deal for him, even if he wasn't happy about it. He was getting paid to support his own Prime software that he didn't have to port. But I learned my lesson as a youngin' about companies saying they will pay for something. I sold some printer/spooler minicomputer software in my early 20's and had a large investment bank (huge actually, as in everyone at the time would recognize their name) try it out for a month. They called and said they were processing the one-time license fee of $1500 but could I give them the access code early so they wouldn't have a disruption for a few days. I did it, and never got a dime from them. Hard lesson learned about being nice.

dhosek 5 days ago||
I remember reading an ad in one of the 90s PC magazines that attributed the dongle to an inventor named “Don Gull.” I was fortunate enough to never have to use a hardware dongle, but I remember hearing about their persistence into the twenty-first century. I would imagine that most of them were as ridiculously simple as this one was.
felineflock 4 days ago||
A modern version of the old dongle seems to be the FIDO key (commonly known by the brand Yubikey), although it is for a different purpose than copy protection: anti-phishing/MFA authentication.

Has that been defeated yet?

catlikesshrimp 5 days ago||
Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey.

I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars.

The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!

bri3d 5 days ago||
Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly.

I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion, if you could reverse one you could reverse the other.

But this concept was insanely prevalent for ~20 years or so.

One of the biggest problems was not having enough ports. Some parallel port dongles tried to ignore communication with other dongles and actually had a port on the back; you'd make a "dongle snake" out of them. Once they moved to USB it was both easier and harder - you couldn't make the snake anymore, but you could ask people to use a hub when they ran out of ports.

Joe_Cool 5 days ago|||
P-CAD even had a dongle-caddy where you could plug in I think about 7 of them into to unlock different modules.

I will check if I can find an image of it.

EDIT: here is an old listing of it: https://www.ebay.com/itm/187748130737

Sadly the lid isn't open so you can't see what modules are installed.

alexfoo 5 days ago|||
> I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion ...

Starting in '97 I worked on some software that used Elan License Manager (elmd) that then moved on to FlexLM in a major release.

Requests for, and problems with, licensing were a considerable source of support tickets but I'm sure it also drove a reasonable amount of sales as customers wanted to play with component X but were prevented from doing so by a lack of license.

When we were acquired by IBM we replaced the licensing code with lawyers and (threats of) audits. It didn't seem to harm the revenue. The product is still being maintained and sold.

> ... if you could reverse one you could reverse the other.

I can confirm it was quite easy with gdb to either skip past the license checks or, in the case of Elan licensing at least, call the license generation function from within the binary to generate whatever licenses for whatever features you liked.

The "hardware identifiers" were a nightmare too. I ended up writing some code that would pull all of the necessary information (primary MAC, IP address, hostid for Sparc machines, hostname, etc) and give it to us in a base64 encoded blob, we also grabbed some CPU and memory information that proved quite useful in seeing how the software was deployed.

GuB-42 5 days ago|||
Having to put a physical device on your parallel port at the back of the computer is kind of annoying, especially if every software you use has one.

More common for games was to use the media itself for copy protection, using a variety of tricks to make copy more difficult. Other techniques involve printing some keys you have to enter using colors that don't render well in photocopies, or have you look at words a certain page of a thick user manual, the idea being that it is more expensive to go through the effort of copying this material than to buy the software legally.

One of my favorite is from Microprose games, for which the manual was a pretty good reference book on the subject of the game, that alone is worth buying. And the copy protection is about asking you about information contained in the book, for example, it may be some detail about a particular plane in a flight simulator, which means that a way to bypass copy protection is simply to be knowledgeable about planes!

Dongles were common, but mostly for expensive enterprise software. Also, dongles don't make cracking harder compared to all the other techniques, so for popular consumer software like games, it is likely to be a lot of inconvenience and a waste of money for limited results.

exidy 5 days ago|||
Partly it was an anti-Wobbler thing. Someone in America or somewhere thought it was real clever to make the game ask you little questions, like “What’s the first word on line 23 on page 19 of the manual?" and then reset the machine if you didn’t answer them right, so they’d obviously never heard of Wobbler’s dad’s office’s photocopier.

-- Only You Can Save Mankind, Terry Pratchett, 1992

ryandrake 5 days ago|||
Makes me sad how many person-years of effort have been wasted over the years on futile dongle-engineering, copy-protection and DRM. They're pretty much all cracked. And the industry keeps insisting on trying!
GuB-42 5 days ago|||
The industry doesn't want to make software crack proof, they just want to make money. Typically, in the case of games, is is about "when", not "if", they know it will be cracked eventually, but they want to hold long enough to secure their launch sales, which is where they make most of the money. It is even common to remove DRM after a few months, because it is not worth it.

As for enterprise software, pros usually don't want the potential legal trouble associated with cracked software, and dongles are just about not making is easy to violate the licence by accident.

efreak 4 days ago|||
Making games uncrackable is a solved problem: the game runs on the server and the server decides what happens, with the user connecting a client that simply sends input to the server and receives a scene to render.

This has many negative side effects, but if the game doesn't require twitchy reflexes it's usually not very noticable. It's also terrible for preservation.

jandrese 5 days ago|||
One problem is that they often couldn't be daisy chained, the connector on the back was only useful for an actual printer. So if everybody started doing it you would have to swap them constantly which is a headache. So they're mostly used for software where it's going to be the only thing running on the box.

I find it interesting that they didn't make it into the USB era where you could easily have something that does some actual processing on the device that makes it a serious challenge to reverse engineer.

chrisldgk 5 days ago|||
They did carry over into the USB era! I specifically remember my stepdads copy of Cubase (music production software) requiring a USB dongle to open.
bonzog 5 days ago||
Ditto - and there's also the "iLok" dongle used by loads of virtual instrument & effects plugins for DAWs.
efreak 4 days ago||||
My dad worked for a company that had some involvement in this area. I know USB was used for dongles alongside parallel/serial, but I have a vague memory that there might actually be PCI-based authentication as well.
jofla_net 5 days ago|||
I could have sworn, back in my day, on WinNT4 we successfully chained a red and white pair from Autodesk. One for AutoCad, and either Mechanical Desktop or 3ds Max.
jandrese 5 days ago||
It worked sometimes, but was always a roll of the dice.
ok123456 5 days ago|||
It was widely used in engineering software because the license cost was equivalent to a large fraction of an engineer's salary. Anyone who used AutoCAD back in the 90s can remember.

When parallel ports were discontinued, they migrated to USB and network license servers.

dpb001 5 days ago||
A company I worked for in the mid-80’s used a PC based CAD package with this kind of copy protection. IIRC the cost of the software was about $5K, and engineers using it probably made around 50K/yr. This level of expense required a lengthy capex justification approval process. There was a category of users who didn’t need the software full time and since the software was tied to the dongle it was common to have the package installed on multiple workstations and borrow the dongle when needed.

The nature of our business was such that there was a lot of logic analyzers and signal tracing equipment in the lab and the dongle was reverse engineered and cloned after a couple of “where’d my dongle go” incidents.

sowbug 5 days ago|||
Dongles still exist in the form of Nintendo Switch cartridges, though they're an extreme form that contains all the app logic, rather than just 7606h.
hcs 5 days ago|||
On Switch 2 there are also pure license dongles in the form of the Game-Key Card. https://en.wikipedia.org/wiki/Nintendo_Game_Card#Game-Key_Ca...
djmips 5 days ago|||
Haha, true enough. But you also get all the game 3D assets, music as well.
maxglute 5 days ago||
Cartridges and cd/dvds/ physical media with DRM were technically dongles.

I remember hearing a courier died overnighting a CAD dongle.

potatomaseat9 5 days ago||
Its insane this things still works after 40 year old and someone now able to cracked it down
Tempest1981 5 days ago||
So what hardware would be inside the dongle? Would a small PAL be enough? 22V10? Maybe use a few registers to delay the values written by a few cycles, mixing in some decode logic? (Something cheaper than a microcontroller, I'm guessing... due to cost)
bitwize 5 days ago||
This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.
urbandw311er 5 days ago|
…and?
Graziano_M 4 days ago||
What did the function that called into it do with the result? If it was a simple "if rv != 0xabcd goto fail" the patch could probably be simplified to just... nop a few bytes.
smoyer 5 days ago|
I designed a security dongle a long time ago ... Used properly, it did rotations and XORs like a CRC. You could definitely make it hard to defeat but it was still ultimately deterministic.
More comments...