4 ms·

Quote from a piracy thread: "Red Dead Redemption uses some obfuscation written by the same folks that sold previous obfuscation as 'Arxan'. The HWID-bound lice

Quote from a piracy thread: "Red Dead Redemption uses some obfuscation written by the same folks that sold previous obfuscation as 'Arxan'. The HWID-bound license probably plugs into the DRM such that it enables continued execution of the game code. This has become a feature of complex DRM." "It also has a lot of custom checks that Rockstar wrote." "That's it. There's no grand mystery, it's a classically challenging problem using new ways of writing frustrating-to-reverse bullshit." src: https://www.reddit.com/r/Piracy/comments/h0j17y/red_dead_redemption_2_drm/ftnthhy?utm_source=share&utm_medium=web2x&context=3 https://www.reddit.com/r/Piracy/comments/h0j17y/red_dead_red...

jnwatson 6y ago
I interviewed with Arxan. I've been generally impressed with their stuff.
- invalidusernam3 6y ago
  Was it an interesting interview? Sounds like it would be an interesting place to work.
  - jnwatson 6y ago
    It was a typical startup: somewhat disorganized, but with some interesting technical questions. I didn't know nearly as much about reversing back when I interviewed as I did now. Most of the questions were on the order of "come up with better ideas than we have", which IMHO is probably not the best way to interview.
- NoOneNew 6y ago
  I'm also interested in what was impressive with them. STORY TIME! Tell us a story!
drmcometru 6y ago
I work on anti-DRM techniques for a living. The experience has shifted my views of DRM. Originally, I saw DRM as highly anti-consumer, and a waste of time and clock cycles. Arguably I do still believe that - but now I have great respect for the technical side of good DRM implementations, and I acknowledge that they provide a time buffer to protect against the first wave of piracy. I've stripped Arxran's protections from software in the past, and I might just have a look at breaking RDR2 now it's been brought to my attention...
- renewiltord 6y ago
  Wait, how do you make a living from that? Like publishers need you to break their stuff out so they can resell it long after the developer is gone or something?
  - ineedasername 6y ago
    Yes, I'm curious about what kind of (legal) paying job needs that sort of skill set.
  - drmcometru 6y ago
    Organizations that apply 3rd party DRM to their products often want independent verification that the DRM functions as intended (there's a lot of snake-oil), and a quantification of how much time/effort it takes to break the DRM.
    - barbs 6y ago
      Wow. Kind of like red-team hackers testing the security of their website or whatever. Sounds like a dream job for the right person...a "drmcometru" if you will ;)
    - renewiltord 6y ago
      Very cool, very cool. Thank you!
      - Deimorz 6y ago
        The user who answered you isn't the one you were asking (it's still a possible answer).
        sahruum9 6y ago
        ... Yes it is
        renewiltord 6y ago
rasz 6y ago
This type of DRM can eat something crazy like >50% CPU when playing. Dense dynamic recompilation, running inside obfuscated VM, etc. https://www.extremetech.com/gaming/282924-denuvo-really-does-cripple-pc-gaming-performance https://www.extremetech.com/gaming/282924-denuvo-really-does...
theincredulousk 6y ago
Worked with Arxan's technology for a bit. Not surprised it is getting to the point where cracker's don't have the time to break it. Embracing the point that everything can be broken eventually, the focus becomes just making it take a long time, such that it is not economical, or simply too time consuming "for fun". Arxan's toolkit includes peppering custom checks everywhere in the code, including mechanisms so these checks don't have the same signature and can't be searched for easily once one is found. Further, there are "silent ones", which most of the time don't do anything, but at some point will activate. This makes it so you can think you've broken the protection, and then e.g. one hour into playing the game it randomly seg-faults (crashes with an error indistinguishable from a normal bug, through deliberate memory corruption), or flags your hardware as using a cracked version and blacklists it. Imagine trying to figure out if memory corruption was on purpose or a normal bug when the corruption happened 1,000,000,000 instructions ago by a section of code that is completely innocuous and just had an off-by-1 error introduced via some index calculation. Now imagine there are 500,000 of these little silent/time-delay traps sprinkled all over the code. In that way it can be nearly impossible to know if you've fully cracked the game. I mean you can really take the long-con with these things, and let it run for weeks, or even just never notify the user and hit them with a blacklist. Imagine playing a game for 100 hours and then out of nowhere having your progress wiped - pretty harsh lesson if you were invested in it. Then there is the binary + in-memory encryption, and customization of protection for every install. This was one of the holy grails as I understood it - you could make the software such that the protection system is completely custom for every install of the software, which makes binary patching useless. This would be difficult when distributing the software on discs, but, and this is a key point, trivial these days where games are downloaded. It is easy to custom generate binaries for everyone. This can do things like use a custom key based on your HWID that is literally necessary to decrypt portions of the game code. There is no way around having the correct key for your hardware to literally decrypt and run the code, which through other techniques can be made custom and further checked for authenticity, making it impossible to simply get the decrypted code and patch it in to other installs. Related techniques can be used to determine if you're running a binary that was decrypted on a different machine, and that is before getting into code that is custom-encrypted and decrypted in-memory at runtime based on your current HWID. You're probably thinking you can reason your way around this, but trust me, it has all been thought of before. The closest you could probably come is forcing cracked clients to all run in some kind of identical virtual machine, which is going to be shit for playing a AAA game even if it worked and no protections were able to figure out they were running in a virtual machine, which they can. The list goes on for this tech, and while no single tech is super effective, when they are all put together, it adds up to a knot that very few people will have the motivation or monetary incentive to sort out, or even ability to in a relevant amount of time after the games release. By the time they figure it the next update could be released, and all that is left is to look back in misery at the time of their life they wasted cracking an old version of a game.

jnwatson 6y ago

I interviewed with Arxan. I've been generally impressed with their stuff.

invalidusernam3 6y ago
Was it an interesting interview? Sounds like it would be an interesting place to work.
- jnwatson 6y ago
  It was a typical startup: somewhat disorganized, but with some interesting technical questions. I didn't know nearly as much about reversing back when I interviewed as I did now. Most of the questions were on the order of "come up with better ideas than we have", which IMHO is probably not the best way to interview.
NoOneNew 6y ago
I'm also interested in what was impressive with them. STORY TIME! Tell us a story!

drmcometru 6y ago

I work on anti-DRM techniques for a living. The experience has shifted my views of DRM. Originally, I saw DRM as highly anti-consumer, and a waste of time and clock cycles. Arguably I do still believe that - but now I have great respect for the technical side of good DRM implementations, and I acknowledge that they provide a time buffer to protect against the first wave of piracy. I've stripped Arxran's protections from software in the past, and I might just have a look at breaking RDR2 now it's been brought to my attention...

renewiltord 6y ago
Wait, how do you make a living from that? Like publishers need you to break their stuff out so they can resell it long after the developer is gone or something?
- ineedasername 6y ago
  Yes, I'm curious about what kind of (legal) paying job needs that sort of skill set.
- drmcometru 6y ago
  Organizations that apply 3rd party DRM to their products often want independent verification that the DRM functions as intended (there's a lot of snake-oil), and a quantification of how much time/effort it takes to break the DRM.
  - barbs 6y ago
    Wow. Kind of like red-team hackers testing the security of their website or whatever. Sounds like a dream job for the right person...a "drmcometru" if you will ;)
  - renewiltord 6y ago
    Very cool, very cool. Thank you!
    - Deimorz 6y ago
      The user who answered you isn't the one you were asking (it's still a possible answer).
      - sahruum9 6y ago
        ... Yes it is
      - renewiltord 6y ago

rasz 6y ago

This type of DRM can eat something crazy like >50% CPU when playing. Dense dynamic recompilation, running inside obfuscated VM, etc. https://www.extremetech.com/gaming/282924-denuvo-really-does-cripple-pc-gaming-performance https://www.extremetech.com/gaming/282924-denuvo-really-does...

theincredulousk 6y ago

Worked with Arxan's technology for a bit. Not surprised it is getting to the point where cracker's don't have the time to break it. Embracing the point that everything can be broken eventually, the focus becomes just making it take a long time, such that it is not economical, or simply too time consuming "for fun". Arxan's toolkit includes peppering custom checks everywhere in the code, including mechanisms so these checks don't have the same signature and can't be searched for easily once one is found. Further, there are "silent ones", which most of the time don't do anything, but at some point will activate. This makes it so you can think you've broken the protection, and then e.g. one hour into playing the game it randomly seg-faults (crashes with an error indistinguishable from a normal bug, through deliberate memory corruption), or flags your hardware as using a cracked version and blacklists it. Imagine trying to figure out if memory corruption was on purpose or a normal bug when the corruption happened 1,000,000,000 instructions ago by a section of code that is completely innocuous and just had an off-by-1 error introduced via some index calculation. Now imagine there are 500,000 of these little silent/time-delay traps sprinkled all over the code. In that way it can be nearly impossible to know if you've fully cracked the game. I mean you can really take the long-con with these things, and let it run for weeks, or even just never notify the user and hit them with a blacklist. Imagine playing a game for 100 hours and then out of nowhere having your progress wiped - pretty harsh lesson if you were invested in it. Then there is the binary + in-memory encryption, and customization of protection for every install. This was one of the holy grails as I understood it - you could make the software such that the protection system is completely custom for every install of the software, which makes binary patching useless. This would be difficult when distributing the software on discs, but, and this is a key point, trivial these days where games are downloaded. It is easy to custom generate binaries for everyone. This can do things like use a custom key based on your HWID that is literally necessary to decrypt portions of the game code. There is no way around having the correct key for your hardware to literally decrypt and run the code, which through other techniques can be made custom and further checked for authenticity, making it impossible to simply get the decrypted code and patch it in to other installs. Related techniques can be used to determine if you're running a binary that was decrypted on a different machine, and that is before getting into code that is custom-encrypted and decrypted in-memory at runtime based on your current HWID. You're probably thinking you can reason your way around this, but trust me, it has all been thought of before. The closest you could probably come is forcing cracked clients to all run in some kind of identical virtual machine, which is going to be shit for playing a AAA game even if it worked and no protections were able to figure out they were running in a virtual machine, which they can. The list goes on for this tech, and while no single tech is super effective, when they are all put together, it adds up to a knot that very few people will have the motivation or monetary incentive to sort out, or even ability to in a relevant amount of time after the games release. By the time they figure it the next update could be released, and all that is left is to look back in misery at the time of their life they wasted cracking an old version of a game.