7 ms·

1. Make your own, free saved game server and alter the application code to use it. This means a lot of work and expense, both to duplicate Ubisoft's game savin

by tumult 17y ago

1. Make your own, free saved game server and alter the application code to use it. This means a lot of work and expense, both to duplicate Ubisoft's game saving code and to set up and maintain the servers. Won't happen. I'm not even a very good game hacker, and I've done much more dramatic things. It's really not a huge deal. People have reverse-engineered entire online game protocols in order to have their own unofficial servers before the games were even out of beta. The client<->server model of protection is actually a good thing to cracking and the people who use cracks, since the original binary doesn't need to be modified in any way. You just run a little thing in your system tray that emulates whatever portion of the server protocol it needs to. And now you can also get the official updates from Ubisoft, re-activate with your own fake server any time, etc. It's not a "disable one line of code" type deal, but if you think that's even a simplification of how things have been for a while, that's pretty naive.

niyazpk 17y ago
3. Hack the game to not need to save games on a remote server. This means a hacker has to figure out the saved game format, somehow jam into the application new code to write the saved data and new code to read it, TEST IT, and get it to work. In most of the cases, there is no need to figure out the game format. Just read the binary data sent to the server and save it. Usually save game files are not that large and I suspect that most games read them at once to the memory. Again you don't have to write a lot of code to do all these stuff. Just redirect whatever is sent to the Ubisoft server to a local server host in the same machine. This way the user can carry the save file anywhere. This is an added advantage for pirates while legitimate users should rely upon Ubisoft to save their game files for them. Heck, they can even play when the Ubisoft server is down, or even if there is no internet connection.
- ErrantX 17y ago
  They could (probably have) limit that approach too by signing the data (as already suggested) or encrypting it with different keys for sending / receiving.
  - Retric 17y ago
    If you can hack the client binary you can change the keys it uses/expects.
    - stcredzero 17y ago
      There's ways of making it very difficult to find the keys. tptacek is in the business of doing just that, apparently.
jskinner 17y ago
the original binary doesn't need to be modified in any way It's easy for Ubisoft to also force the binary to be cracked: have the client request the server sign a random token with its private key, and verify it with a public key embedded into the client. This way a third party server could only be written if the client was also cracked to either change the key or remove the check.
- tumult 17y ago
  True. It's a loss for them either way -- if Ubisoft goes out of their way to add this feature, the effort required by the crackers is proportionally smaller. I tend to think most of the draconian copyrape is actually internal political maneuvering at these large publishers. Ways for one department to counter another's with figures "look! After implementing xxx DRM scheme in order to prevent loss from copyright infringers in market yyy, total predicted sales volume was not met by zzz! In addition, piracy rates remained at or above zzz1! This proves that our console-focused sales track etc etc" Kind of like how the digital distribution from EA for Crysis actually did not work at all, probably on purpose, for various reasons pertaining to retail and corporate in-fighting (my theory, anyway.)
- brown9-2 17y ago
  Isn't this the type of "check at startup" that the article mentions hackers can easily null out?
  - pyre 17y ago
    Maybe game designers should take lessons from Skype in making it as hard as possible to disassemble/hack the binary.
    - eru 17y ago
      Do you know why Skype is so keen on obfuscation?
    - nitrogen 17y ago
      Something tells me both game developers and crackers have been at this a lot longer than Skype... I remember playing cracked Atari games as a young kid, but back then I didn't know what "cracked" meant. In case anyone wonders, I found the games in a huge box of 360K floppies that came with the Atari system when I got it.
acg 17y ago
This is assuming the game is complete, what if the server is sending back parts of the game in response to state saving. For instance, perhaps some of the AI is running remotely. This could explain dropping out of the game: the game is unable to continue.
- tumult 17y ago
  They could do that. Run some portions of the game on the server, which would remove some of the game logic from the client, making any sort of crack to require adding back in instead of simply stripping out logic. They probably will not do anything non-trivial for this. It costs money to run servers, and they would have to run much more powerful servers in order to be running game logic for each player. That would eat into revenue, and this game is not even subscription-based.
  - stcredzero 17y ago
    They don't actually have to run portions of the game on the servers. They can just serve bits of logic code back to the client as certain milestones are met. You can easily cause 1000's of halting points in a program at the price of just a few kilobytes of data this way. The point is not to make a game hack-proof. Just to make the time to crack long enough for your purposes. (In this case, it just has to last a few more weeks than ususal.) Safes are rated like this, partly by the worst-case time it takes to break into them. http://en.wikipedia.org/wiki/Safe http://en.wikipedia.org/wiki/Safe EDIT: I see from other posts that AC2 has been cracked since 2 weeks before release. In the case of safes, the laws of physics are on your side. In the case of general purpose Von Neumann architecture computers, the mathematical laws are on the side of the crackers. In short, if you can execute it, you can read it, therefore you can crack it. To work perfectly, which is equivalent to working at all, DRM needs a "trusted" execution environment supported by hardware. Even a server environment is not going to cut it.
    - tptacek 17y ago
      It's not settled computer science that the content protection problem always favors attackers, although it's clear that the state of the art does. I'm only reacting to the "laws of physics" comment you're making. It's not true that "if you can execute it, you can read it", at least for important definitions of "read" (that include "understand" or "modify"). Take, for an example, white box cryptography. Some problems clearly favor attackers (executing code on general purpose shared Von Neumann architectures with general purpose operating systems). Other problems favor defenders (the halting problem). It's also the case that, smart as (say) 'DarkShikari is, high-end performance graphics and systems coders are not necessarily expert practical compiler theory people.
metamemetics 17y ago
" their own unofficial servers before the games were even out of beta." Now here's a real challenge: Starcraft 2 beta server
- Psyonic 17y ago
  There are people working on it... whether or not they will succeed, I can't say, but considering that fake WoW servers exist, I'm guessing they'll pull it off eventually.

by tumult 17y ago

niyazpk 17y ago

3. Hack the game to not need to save games on a remote server. This means a hacker has to figure out the saved game format, somehow jam into the application new code to write the saved data and new code to read it, TEST IT, and get it to work. In most of the cases, there is no need to figure out the game format. Just read the binary data sent to the server and save it. Usually save game files are not that large and I suspect that most games read them at once to the memory. Again you don't have to write a lot of code to do all these stuff. Just redirect whatever is sent to the Ubisoft server to a local server host in the same machine. This way the user can carry the save file anywhere. This is an added advantage for pirates while legitimate users should rely upon Ubisoft to save their game files for them. Heck, they can even play when the Ubisoft server is down, or even if there is no internet connection.

ErrantX 17y ago
They could (probably have) limit that approach too by signing the data (as already suggested) or encrypting it with different keys for sending / receiving.
- Retric 17y ago
  If you can hack the client binary you can change the keys it uses/expects.
  - stcredzero 17y ago
    There's ways of making it very difficult to find the keys. tptacek is in the business of doing just that, apparently.

jskinner 17y ago

the original binary doesn't need to be modified in any way It's easy for Ubisoft to also force the binary to be cracked: have the client request the server sign a random token with its private key, and verify it with a public key embedded into the client. This way a third party server could only be written if the client was also cracked to either change the key or remove the check.

tumult 17y ago
True. It's a loss for them either way -- if Ubisoft goes out of their way to add this feature, the effort required by the crackers is proportionally smaller. I tend to think most of the draconian copyrape is actually internal political maneuvering at these large publishers. Ways for one department to counter another's with figures "look! After implementing xxx DRM scheme in order to prevent loss from copyright infringers in market yyy, total predicted sales volume was not met by zzz! In addition, piracy rates remained at or above zzz1! This proves that our console-focused sales track etc etc" Kind of like how the digital distribution from EA for Crysis actually did not work at all, probably on purpose, for various reasons pertaining to retail and corporate in-fighting (my theory, anyway.)
brown9-2 17y ago
Isn't this the type of "check at startup" that the article mentions hackers can easily null out?
- pyre 17y ago
  Maybe game designers should take lessons from Skype in making it as hard as possible to disassemble/hack the binary.
  - eru 17y ago
    Do you know why Skype is so keen on obfuscation?
  - nitrogen 17y ago
    Something tells me both game developers and crackers have been at this a lot longer than Skype... I remember playing cracked Atari games as a young kid, but back then I didn't know what "cracked" meant. In case anyone wonders, I found the games in a huge box of 360K floppies that came with the Atari system when I got it.

acg 17y ago

This is assuming the game is complete, what if the server is sending back parts of the game in response to state saving. For instance, perhaps some of the AI is running remotely. This could explain dropping out of the game: the game is unable to continue.

tumult 17y ago
They could do that. Run some portions of the game on the server, which would remove some of the game logic from the client, making any sort of crack to require adding back in instead of simply stripping out logic. They probably will not do anything non-trivial for this. It costs money to run servers, and they would have to run much more powerful servers in order to be running game logic for each player. That would eat into revenue, and this game is not even subscription-based.
- stcredzero 17y ago
  They don't actually have to run portions of the game on the servers. They can just serve bits of logic code back to the client as certain milestones are met. You can easily cause 1000's of halting points in a program at the price of just a few kilobytes of data this way. The point is not to make a game hack-proof. Just to make the time to crack long enough for your purposes. (In this case, it just has to last a few more weeks than ususal.) Safes are rated like this, partly by the worst-case time it takes to break into them. http://en.wikipedia.org/wiki/Safe http://en.wikipedia.org/wiki/Safe EDIT: I see from other posts that AC2 has been cracked since 2 weeks before release. In the case of safes, the laws of physics are on your side. In the case of general purpose Von Neumann architecture computers, the mathematical laws are on the side of the crackers. In short, if you can execute it, you can read it, therefore you can crack it. To work perfectly, which is equivalent to working at all, DRM needs a "trusted" execution environment supported by hardware. Even a server environment is not going to cut it.
  - tptacek 17y ago
    It's not settled computer science that the content protection problem always favors attackers, although it's clear that the state of the art does. I'm only reacting to the "laws of physics" comment you're making. It's not true that "if you can execute it, you can read it", at least for important definitions of "read" (that include "understand" or "modify"). Take, for an example, white box cryptography. Some problems clearly favor attackers (executing code on general purpose shared Von Neumann architectures with general purpose operating systems). Other problems favor defenders (the halting problem). It's also the case that, smart as (say) 'DarkShikari is, high-end performance graphics and systems coders are not necessarily expert practical compiler theory people.

metamemetics 17y ago

" their own unofficial servers before the games were even out of beta." Now here's a real challenge: Starcraft 2 beta server

Psyonic 17y ago
There are people working on it... whether or not they will succeed, I can't say, but considering that fake WoW servers exist, I'm guessing they'll pull it off eventually.