13 ms·

The cleverest floppy disc protection ever? Western Security Ltd

339 points by scarybeast 6y ago

h2odragon 6y ago
I never did BBC Micro, but in the early PC days there were "Copy II PC" add in ISA cards that the floppy cable passed through on the way to the drive. With their software most any floppy disk could be copied with a standard PC drive; and with a bit of hacking you could do things like read Victor 9000 floppies. There was only one floppy I could never get, a licensed Scrabble game that insisted on writing scores to its game disc. My mom loved that game and we had to buy it twice. It was humiliating, I had this special hardware and I never did figure that one out. * found one: https://www.biocomp.net/o62799.htm https://www.biocomp.net/o62799.htm
- Firehawke 6y ago
  The "Copy II PC Option Board", yeah. I knew a guy who had one, and it definitely could handle a lot of stuff that you normally couldn't. Interestingly, you really wanted an early-era board because they were forced to water down the later revisions so they couldn't copy newer protection schemes.
  - h2odragon 6y ago
    The original company got bought out by Central Point, they'd been running for a bit before then. They were not quite totally opaque in "API" then, there were like maybe 3 asm examples floating around BBS and net.* era usenet.
  - dunham 6y ago
    My fuzzy recollection is that the option board could read the entire track at once, raw - not MFM decoded, where the typical controller in a PC had a high level interface that only gave you sectors. One copy protection system that I remember was a track that had a mix of long and short sectors with the short sectors embedded in the middle of the longer ones. (Sectors header/footers were marked by special bytes that were illegal MFM coding.) If a program tried to copy the the track with a normal floppy controller, they would have more sectors than would fit on a track.
RcouF1uZ4gsC 6y ago
Fully online, streaming gaming a la Stadia, will be the ultimate in copy and cheat protection. Since you don't have access the the actual code, you won't be able to modify or hack it to either cheat or bypass protection.
- ev1 6y ago
  I understand that this is horrible for unbreakable DRM, but in my case, I only play multiplayer online games (MMOs) - there is nothing to pirate. I'd happily take game streaming in exchange for getting rid of invasive, useless, data-collecting (including clipboard contents, uploading files on disk, etc.) rootkit anticheats starting at boot being "mandatory" to play.
- CobrastanJorji 6y ago
  There's another benefit here that I haven't seen yet. Suddenly it becomes potentially reasonable to fully trust "clients". That enables much better anti-latency schemes which, combined with the clients probably being on the same low latency cloud network as each other, could potentially produce some really fantastic results. But you'd probably have to design the game engine around it.
carapace 6y ago
Who recalls the provenance of this old legend about the fellow who challenged his pal to decode a certain floppy? It was a bog-standard DOS boot disk (IIRC) that he could put in his machine and boot normally. But his pal put it in his computer and... nothing doing, no boot. Analysis of the floppy availed not. The challenge went unmet. What did our hero do to make the floppy? .esrever ni nups evird eht os ytiralop etisoppo htiw meht dehcattaer dna ,rotom eldnips evird eht ot seriw rewop eht deredlosed ,evird ksid eht denepo eH
- anakaine 6y ago
  Tricky
- 1996 6y ago
  The spoiler format is perfectly adapted to the content :)
- rightbyte 6y ago
  Would that work for CDs too?
  - duskwuff 6y ago
    It'd take some doing. You wouldn't be able to burn a CD-R backwards without some extra steps; a "blank" CD-R contains some data in the pregroove to identify it as a recordable disc and specify some parameters to the burner. A reverse-rotating drive wouldn't be able to read that data, since it'd be backwards. :)
  - szc 6y ago
    I don't think so, CDs have a spiral track, so the spiral would also have to be reversed.
    - Doxin 6y ago
      Presumably if you'd also flip the phases on the head stepper and move any relevant endstops around you might be able to convince the drive to read disks inside-out. Fairly sure it'd immediately give up due to pregroove shenanigans but it's an amusing idea.
ballenf 6y ago
I don't think it was mentioned, but I wonder if the mains power fluctuation (voltage or hz) would affect drive sector length / rpm also? So even the same drive couldn't produce a high fidelity copy of one of these discs if the power input was different.
- xxpor 6y ago
  I'm not sure how good the power supplies were back then, but ideally you'd have no idea what the mains power was at the drive since the power supply converts everything to DC. Now of course rectification isnt perfect so there were probably some artifacts, but enough to detect on the disk? Seems unlikely.
- phnofive 6y ago
  Seems like intentionally randomizing this would be a good way to mass produce fingerprinted copies - in addition to any variants in the media.
enriquto 6y ago
I'm just halfway of the text and I'm already tippy-tapping like an excited toddler waiting for candy! This has the same hackish aura as the "story of Mel"
empressplay 6y ago
See also Spiradisc https://paleotronic.com/2018/10/27/microm8-update-apple-ii-emulation-and-spiradisc-support/ https://paleotronic.com/2018/10/27/microm8-update-apple-ii-e...
garmaine 6y ago
Wouldn’t this be trivial to defeat once you know how it works though? Make a bit-for-bit copy, then overwrite track 9 with the new obfuscated lengths.
- Dylan16807 6y ago
  The same goes for any copy protection. If you understand how it works, you can change the code to bypass it. So it's "trivial" after you do the hard part. The clever thing is that it forces you to do the hard part without special hardware.
  - garmaine 6y ago
    Not really. The PSX copy protection, for example, couldn’t be written by standard CD-R writers.
    - Dylan16807 6y ago
      I'm talking about understanding how it works on a code level. You don't need to write the special disk out if you're patching the code, like this article does.
      - garmaine 6y ago
        Yeah but you'll have to hunt for and fix the code wherever it is on every disk, which could be subtly or completely different between applications. "Recalculate track 9" is a simple program that would have worked on any Western Security DRM disk.
        Dylan16807 6y ago
        You're assuming it's always in track 9 in the same spot. What if it isn't? And what if different applications use slightly different obfuscation? If we're assuming Western Security DRM is always in the same spot using the exact same method, why not compare it against some other type of copy protection that always puts the exact same checking code in the same spot? It would actually be easier to blot out the other type's code with NOPs than to recalculate obfuscated Western Security track-length tables.
csl 6y ago
Very clever and great article! But it sounds pretty easy to write a cracker for it: Just rewrite the machine code to jump over the check. Or did I miss anything? Edit: Guess it depends on the details and amount of "obfuscation" that he mentions.
- karmakaze 6y ago
  My thoughts exactly. I spent a good amount of time learning about and cracking various schemes. It was never about distribution but about bragging rights and the different ways code was obfuscated. Most were disappointingly simple, others had more layers, very rarely found ones that needed special effort beyond say a person-day or two to solve.
  - OnlyMortal 6y ago
    Skate Or Die in the C64 was tricky as it had self modifying code for obfuscation. Took me a while to “debug” that. The copy protection of Ocean games was much easier to crack. They had a “IsOkToRun” type of function which returned 1 in the A register.
- elahieh 6y ago
  Copying one of my old comments from slashdot... it sounds similar to Sierra's "cpc.com". While I was reading the article I wondered if the equivalent of this process for the 6502 (BRK/COP interrupt table?) would work. Back in the 1980s Sierra On-Line used to copy protect their adventure games with a copy protection system which involved strangely formatted sectors on the original disk which were impossible to duplicate exactly using standard PC hardware. The loader "sierra.com" used to call a copy-protection program "cpc.com" which loaded data from the disk to decrypt the main program and run it. cpc.com had some of the most obscure, twisty, awful code ever written to prevent debugging and it constantly used different methods to thwart stepping through the program using INT 3 (these were the days before Soft-Ice). But the solution (or "crack") was just dead simple. Just fire up debug, step to the beginning of cpc.com, and copy the vector from INT 3 into the INT 13 vector - then cpc.com stops right at the point where the data from the disk is being loaded, so it can be copied. Despite all the incredibly complex code, cpc.com had to read the data off the disk so there was no way the Sierra programmers could thwart this method.
beagle3 6y ago
IIRC, Quaid software's Copywrite on the PC was able to reliably duplicate weak bits, and had a companion called "zerodisk" which would -- in cooperation with marks left by Copywrite -- emulate laser holes. I remember at least one copy protection system I analyzed, which get "free reign" into writing tracks, by configuring the drive to write just one huge sector per track (which ended up being longer than the track), end encoding the sector gaps "in band" which later became "out of band" because the main track header was overwritten (and an "in band" one became out-of-band). It was interesting, but I have no nostalgia for that.
berkut 6y ago
Slightly off-topic, but since when were floppies referred to as "disc", as opposed to "disk"? I thought it was from Diskette? Is it a language / region thing? Optical discs were "disc", but at least growing up in the UK in the 80s/90s with DOS/Windows, I'm pretty certain I remember them always being "disk" for floppies? Am I misremembering?
- panzagl 6y ago
  From the US 80-90's (c64/Amiga/DOS), I remember it as "disk". I always thought "disc" was European in origin.
  - tremon 6y ago
    We also used hard disk/floppy disk here in Europe (NL). My recollection is as the GP says, "disc" was only consistently used for optical discs (CD, DVD, BR). It may still be that "disc" is European in origin -- the original CD came from Philips (NL) and Sony (JP) -- but for computer components, I've never seen it spelled "disc".
    - mattl 6y ago
      Weirdly BR is BD.
- karmakaze 6y ago
  I remember it the same way. But then if floppies are diskettes, what's the non-'ette' disk referring to? DASD Direct-access storage device[0] Disk Pack[1] perhaps? Answer seems to be the 8" floppy disk[2] which only IBM called "Diskette-1" and 5-1/4" ones called mini-diskettes, floppy diskettes, etc. [0] https://en.wikipedia.org/wiki/Direct-access_storage_device https://en.wikipedia.org/wiki/Direct-access_storage_device [1] https://en.wikipedia.org/wiki/Disk_pack https://en.wikipedia.org/wiki/Disk_pack [2] https://en.wikipedia.org/wiki/Floppy_disk#8-inch_floppy_disk https://en.wikipedia.org/wiki/Floppy_disk#8-inch_floppy_disk
  - kgwgk 6y ago
jedberg 6y ago
My favorite copy protection was on some games I had (I want to say they were Microprose games? But I could be wrong) where they would cut the hole in the disk just slightly bigger, and then take advantage of the fact that in DOS you could talk directly to the hardware to convince the read head to go just a little too far. Then it could read the magic 41st track to load the game, but no disk copy program could copy it.
- userbinator 6y ago
  Some of the "floppy extender" programs used more than the usual number of tracks, so unless the 41st was hidden somehow so that its existence was a secret, it would be no harder to copy than all the others. Of course, that may well be why it was so successful --- the extra track wasn't well known, and information travelled much slower back then.
- FpUser 6y ago
  Nah. I remember those days. Programs that could read/write/discover more tracks than the standard amount were widely available.
  - jedberg 6y ago
    Well, it was 30 plus years ago, but what I remember is that at first it was just the games that were doing it, and then people figured it out and made those other programs, making the copy protection useless.
  - marzell 6y ago
    There was a similar situation with CDs where you could overprovision data that existed past the technical limit of useable range. I think that's was utilized in NINs Year Zero ARG experiment.
    - peteretep 6y ago
      There were also hidden tracks before track 1 iirc. The X Files soundtrack had one
VikingCoder 6y ago
I remember my tech-savvy uncle was used to PCs which could read double-sided floppy disks. His jaw about dropped out of his skull when he saw me do the 0.5 second floppy-disk-flip that Apple IIc gamers got used to doing, because they could only read from a single side of the disk.
m3kw9 6y ago
DVD or CD protections had this type of protection where they read a part of the disk most DVD writers can’t write to
- agumonkey 6y ago
  SONY Playstation fault injection was clever too.
DrBazza 6y ago
I seem to remember the only software that would copy any disk you pointed it at, was in fact the source code listed in the official Acorn DFS manual. With the drawback that it copied one sector at a time, so without a double drive, that was a lot of swapping for a 40 track disk, let alone an 80 track one.
m463 6y ago
Back in the 1980's I think there were a lot of interesting schemes. The solution was to just get an updated version of copy2pc or copywrite and they would have a fix. But I remember a few schemes that were interesting workarounds. One was the hole in the disk, one was a laser-burned dot on the disk. I recall with the hole in the disk - the software would try to read and if it succeeded it was a copy. The second one was slightly different and I believe the software would write to it, and read it back, and if it could read it back it was a copy. However the best of all was either the scratch-n-sniff card from Leather Godesses of Phobos, or the Age Verification of Leisure Suit Larry. example: "Gone With The Wind" is about a. outer space. b. a bank robbery. c. four hours long. d. dust. or President Ford prescribed _____ for dealing with economic problems. a. tranquilizers b. employment c. that everyone wear a WIN button d. that everyone should have a nice day
- hbbio 6y ago
  It's also quite funny that Quaid (who made copywrite) was sued by a protection vendor... but won! "We hold that: (1) Quaid did not infringe Vault's exclusive right to reproduce its program in copies under § 106(1); (2) Quaid's advertisement and sale of RAMKEY does not constitute contributory infringement; (3) RAMKEY does not constitute a derivative work of Vault's program under § 106(2); and (4) the provision in Vault's license agreement, which prohibits the decompilation or disassembly of its program, is unenforceable." in https://cyber.harvard.edu/ilaw/Contract/vault.htm https://cyber.harvard.edu/ilaw/Contract/vault.htm Edit: there is a Wikipedia page for that https://en.wikipedia.org/wiki/Vault_Corp._v._Quaid_Software_Ltd https://en.wikipedia.org/wiki/Vault_Corp._v._Quaid_Software_.... (there is a dot at the end of the URL but HN parser does not treat it correctly)
  - deleted 6y ago
    [deleted]
- grishka 6y ago
  > the Age Verification of Leisure Suit Larry I played the modern version (Leisure Suit Larry Reloaded) a bit but couldn't complete the age verification because it relied on the American history and pop culture too much. Had to shamefully google the answers.
mattbee 6y ago
The other thing this scheme gives you is a unique image per customer, so you could use it to trace illegal copies. When I worked on some expensive emulator software 22 years ago, floppy protection wasn't appropriate but I suggested to the boss that we use the order of linker symbols in the main executable to encode the customer's serial number. I guess it was a No because they wanted to use a standard duplicator, but also piracy was pretty well deterred by the 486 daughter board you needed to run it :)
acomjean 6y ago
Its all very clever. Till it doesn't work. A long time ago, we got EA's "seven cities of gold" from my parents for apple. My brothers and I were all excited but it would start to load then the drive would make a strange sound and it didn't work. We exchanged at the local software store, the next one did the same thing.. We tried on a friends apple //c and it worked there. Our //e drives must have been slightly out of spec. It was bitter disappointment. But a valuable lesson. They're now imaging floppies into new formats so the copy protected disk can still run in emulation: Things like the "Woz" format https://applesaucefdc.com/woz/reference1/ https://applesaucefdc.com/woz/reference1/
- AlbertoGP 6y ago
  I had the same experience with some of the games I bought. I ended up having to get a pirate copy and overwrite the original tape or later disk.
- m-p-3 6y ago
  The joys of DRMs affecting legitimate users..
notacoward 6y ago
I remember a similar "easy to write, easy to read, hard to recreate" approach being touted for credit-card security a while ago. The idea was to embed bits of glitter in a clear epoxy matrix, and collect a "fingerprint" of the result when read from different angles. It would be nearly impossible to recreate the glitter pattern. I really liked the idea, but apparently they never solved the alignment problem well enough to make the "easy to read" part a reality.
tomc1985 6y ago
Is "disc" British English? I have always understood "disk" to mean a floppy disk or hard disk (as short for diskette), and "disc" to refer to circular discs like CDs. (Yes, disks have discs inside them but they are squareish to hold) Seeing people refer to floppy disks as discs really bugs me for some reason.
- nicoburns 6y ago
  > Is "disc" British English? Yes, more or less. https://en.wikipedia.org/wiki/Spelling_of_disc https://en.wikipedia.org/wiki/Spelling_of_disc
- mnw21cam 6y ago
  Seeing people refer to hard drives as "disks" bugs me as well, because they aren't by any stretch of the imagination diskettes.
14 6y ago
This reminded me of back in the day with Xbox 360 and the cat and mouse we played with MS. MS started making their games I believe 4.8gb in size and all the pirates could only buy DVDs which were smaller as nothing bigger was actually available. The first thing pirates did was truncate the games and removed some padding so they could fit all the security features the disc required to play and remain stealth. Then MS found a way to detect truncated discs and many people were banned. Then one of the 360 main hackers came out with a genius idea to take the discs we could buy and modify the firmware to a certain brand and model of DVD burner to allow the burner to burn right to the outer edge of the DVD. This was possible because all dvds are actually slightly larger then their listed size but standard DVD burners could not burn to the extreme edge. Some burns didn’t write perfect and sometimes you had to burn it a few times before it was stealth. They also had a program to see if the stealth worked and the disc passed or failed. I never did receive a ban and eventually moved to another mod on my 360 that didn’t require discs at all. What a flashback reading this article.
parsimo2010 6y ago
Some thoughts: 1. I love how half the comments here are about disc/disk, which was just a passing comment in the article. 2. I really like reading these sorts of stories where modern hackers figure out the tricks used in vintage technology. They're interesting, and makes me feel a little better that all the clever hackers haven't died off yet. Sometimes I feel like the power of modern computers has made people lazy and we're going to lose our ability for clever solutions. But maybe the clever people are still there. 3. If you like reading about copy protection and (I can't believe I'm about to call the PS1 vintage) vintage tech, you might like this story about the copy protection for Spyro on the PS1. It wasn't so much copy protection as it was punishment after the copying. https://www.youtube.com/watch?v=4GYSeXLr5sY https://www.youtube.com/watch?v=4GYSeXLr5sY
germanka 6y ago
Disk, because Disc is for optical mediums
amelius 6y ago
I'm curious what tricks people use nowadays for software copy protection? Are dongles still a thing? Have people given up on the idea of software protection? (SaaS is probably the best kind of protection if you don't take it too literally)
- grishka 6y ago
  From what I see, software that is capable of working fully offline is a rarity these days. Everything has an activation server.
- rabidrat 6y ago
  License keys, software phones home to verify the license key, refuses to run if license key not verified. You could hack the software to remove this protection, and for popular software packages people have done this (Windows, Photoshop, etc).
- toast0 6y ago
  Dongles are popular in arcade machines (which are mostly just PCs these days)
lowbloodsugar 6y ago
Never forget the press release "This is the first game that cannot be copied". And that's how I learned 6502.
IIAOPSW 6y ago
Way back when monetized flash games were a thing, there was a problem of ad piracy (people who would decompile your game and then upload and monetize it as their own). The conventional wisdom at the time was that piracy could only be delayed, not prevented. The reasoning was that a piracy check has to read the sites URL at some point and the hacker can just search for the only command in all of actionscript which does that. My game contained a very standard check url type protection. This was not the real protection. This was the piece of code which the hacker was supposed to notice and remove. Early on in the game there was a function call to get the total number of bytes in the file and then divide it by the number of expected bytes. Ostensibly this was to calculate the size of the loading bar. I stored this information in a forgettable global variable. On the surface this looks like the sloppy coding one expects from flash devs. But the real purpose was so that I could later check if this number was not 1.0 and trigger the true copy protection. Long story short if the number of bytes were incorrect then the game becomes unplayable after a few levels. I thought that was a nice touch since these hackers usually didn't play though enough of the game to test if their hack worked.
- treesknees 6y ago
  This reminds me of the write-up I saw about the Spyro games for Playstation. It has a similar result where a copied game would progressively become harder and impossible to beat. They had the same reasoning, most people pirating/patching the game won't play it all the way through before releasing their results. https://www.gamasutra.com/view/feature/131439/keeping_the_pirates_at_bay.php https://www.gamasutra.com/view/feature/131439/keeping_the_pi...
marcan_42 6y ago
Modern copy protection techniques are often based on this same principle. For example, the GameCube and Wii do a very similar thing. Since they use optical media, that doesn't have tracks but instead a single spiral groove, what they do is use a laser to burn little scratches into the disc (which you can see against a light). After mastering and lasering, the disc is checked to see what sectors the marks damaged. Error correction ensures the data is undamaged, but the drive can find these drop-outs. Then a table containing the sector locations is encoded and burned with the same laser into the "burst cut area", effectively a standard barcode format in the inner ring of the disc (this part is standard, many normal drives can read BCAs). This all works because the specific angular position of any given sector is unpredictable during optical disc mastering. The groove is continuous, and never lines up in exactly the same way. So, just like the floppy trick, this is "fingerprinting" the natural variation in write speeds of different disc mastering/burning systems. This scheme is undefeatable using off the shelf burners, but one trick that Datel used to master compatible unofficial discs is to rip the encrypted BCA table off of a real game (so they didn't have to crack the encryption, though that was possible later since it's symnetric) and, instead of burning marks into the disc, just turning off the mastering laser writing the disc track at the exact same points in each track. Those discs don't have any holes, but they have a pattern of sector damage that is indistinguishable to the drive (even though the angular positions no longer match), and they work. I believe the same trick should work with a lightly modified standard burner, if you can manage to find a way to burn the BCA (and you need other firmware patches for some other data-level changes to the disc, but those are easier). Xbox (360 and One discs at least I believe) also do this IIRC, but instead of intentional damage the drive has the ability to compute angular relationships between sectors I believe, though I'm not familiar with the details of that scheme.
itronitron 6y ago
I don't recall how my friends and I figured this out, if we discovered it or just heard about it, but it became standard practice to carefully insert a finger into the disc drive and slow the spinning disc when loading up a copied disc in order to defeat any complaints from the OS. Not sure why this worked but it always did :)
- djmips 6y ago
  That was also a trick to try and get a disk (of your own) that was having troubles to at least read to back it up.
djmips 6y ago
Not the Beeb but this copy protection was common even quite early on the Apple II. We we ran our disk drives with the cases off so we could adjust the speed screw to match track lengths. We had software that would visually feedback the track length so you could get it spot on.
billpg 6y ago
My recollection from the day was that "disk" was a class of file storage that allowed random access, distinct from tape which needs to be positioned. (For example, "RAM DISK" which isn't at all cylindrical.)
Springcleaning 6y ago
We had to build our own copy protection after dongles were hacked and too fussy. Weak bits were copyable using the CopyIIPC option board. So what we resorted to is using a needle scratching the inner most tracks of the floppy on random locations. Writing those tracks with a pattern and record where the pattern was broken. While executing the program it did write that track and read that track, the locations where the pattern was broken (two tracks, begin and end) was the key that was used to decrypt some parts of the further into the program. To my knowledge it was never hacked and every disk was unique, we kept the keys for each customer (was part of the serial) so if it was hacked we could trace it to the leaker.
blaines 6y ago
The comments are rather interesting as apparently George Keeling himself commented and confirmed everything. :)

339 points by scarybeast 6y ago

I never did BBC Micro, but in the early PC days there were "Copy II PC" add in ISA cards that the floppy cable passed through on the way to the drive. With their software most any floppy disk could be copied with a standard PC drive; and with a bit of hacking you could do things like read Victor 9000 floppies. There was only one floppy I could never get, a licensed Scrabble game that insisted on writing scores to its game disc. My mom loved that game and we had to buy it twice. It was humiliating, I had this special hardware and I never did figure that one out. * found one: https://www.biocomp.net/o62799.htm https://www.biocomp.net/o62799.htm

Firehawke 6y ago
The "Copy II PC Option Board", yeah. I knew a guy who had one, and it definitely could handle a lot of stuff that you normally couldn't. Interestingly, you really wanted an early-era board because they were forced to water down the later revisions so they couldn't copy newer protection schemes.
- h2odragon 6y ago
  The original company got bought out by Central Point, they'd been running for a bit before then. They were not quite totally opaque in "API" then, there were like maybe 3 asm examples floating around BBS and net.* era usenet.
- dunham 6y ago
  My fuzzy recollection is that the option board could read the entire track at once, raw - not MFM decoded, where the typical controller in a PC had a high level interface that only gave you sectors. One copy protection system that I remember was a track that had a mix of long and short sectors with the short sectors embedded in the middle of the longer ones. (Sectors header/footers were marked by special bytes that were illegal MFM coding.) If a program tried to copy the the track with a normal floppy controller, they would have more sectors than would fit on a track.

RcouF1uZ4gsC 6y ago

Fully online, streaming gaming a la Stadia, will be the ultimate in copy and cheat protection. Since you don't have access the the actual code, you won't be able to modify or hack it to either cheat or bypass protection.

ev1 6y ago
I understand that this is horrible for unbreakable DRM, but in my case, I only play multiplayer online games (MMOs) - there is nothing to pirate. I'd happily take game streaming in exchange for getting rid of invasive, useless, data-collecting (including clipboard contents, uploading files on disk, etc.) rootkit anticheats starting at boot being "mandatory" to play.
CobrastanJorji 6y ago
There's another benefit here that I haven't seen yet. Suddenly it becomes potentially reasonable to fully trust "clients". That enables much better anti-latency schemes which, combined with the clients probably being on the same low latency cloud network as each other, could potentially produce some really fantastic results. But you'd probably have to design the game engine around it.

carapace 6y ago

Who recalls the provenance of this old legend about the fellow who challenged his pal to decode a certain floppy? It was a bog-standard DOS boot disk (IIRC) that he could put in his machine and boot normally. But his pal put it in his computer and... nothing doing, no boot. Analysis of the floppy availed not. The challenge went unmet. What did our hero do to make the floppy? .esrever ni nups evird eht os ytiralop etisoppo htiw meht dehcattaer dna ,rotom eldnips evird eht ot seriw rewop eht deredlosed ,evird ksid eht denepo eH

anakaine 6y ago
Tricky
1996 6y ago
The spoiler format is perfectly adapted to the content :)
rightbyte 6y ago
Would that work for CDs too?
- duskwuff 6y ago
  It'd take some doing. You wouldn't be able to burn a CD-R backwards without some extra steps; a "blank" CD-R contains some data in the pregroove to identify it as a recordable disc and specify some parameters to the burner. A reverse-rotating drive wouldn't be able to read that data, since it'd be backwards. :)
- szc 6y ago
  I don't think so, CDs have a spiral track, so the spiral would also have to be reversed.
  - Doxin 6y ago
    Presumably if you'd also flip the phases on the head stepper and move any relevant endstops around you might be able to convince the drive to read disks inside-out. Fairly sure it'd immediately give up due to pregroove shenanigans but it's an amusing idea.

ballenf 6y ago

I don't think it was mentioned, but I wonder if the mains power fluctuation (voltage or hz) would affect drive sector length / rpm also? So even the same drive couldn't produce a high fidelity copy of one of these discs if the power input was different.

xxpor 6y ago
I'm not sure how good the power supplies were back then, but ideally you'd have no idea what the mains power was at the drive since the power supply converts everything to DC. Now of course rectification isnt perfect so there were probably some artifacts, but enough to detect on the disk? Seems unlikely.
phnofive 6y ago
Seems like intentionally randomizing this would be a good way to mass produce fingerprinted copies - in addition to any variants in the media.

enriquto 6y ago

I'm just halfway of the text and I'm already tippy-tapping like an excited toddler waiting for candy! This has the same hackish aura as the "story of Mel"

empressplay 6y ago

See also Spiradisc https://paleotronic.com/2018/10/27/microm8-update-apple-ii-emulation-and-spiradisc-support/ https://paleotronic.com/2018/10/27/microm8-update-apple-ii-e...

garmaine 6y ago

Wouldn’t this be trivial to defeat once you know how it works though? Make a bit-for-bit copy, then overwrite track 9 with the new obfuscated lengths.

Dylan16807 6y ago
The same goes for any copy protection. If you understand how it works, you can change the code to bypass it. So it's "trivial" after you do the hard part. The clever thing is that it forces you to do the hard part without special hardware.
- garmaine 6y ago
  Not really. The PSX copy protection, for example, couldn’t be written by standard CD-R writers.
  - Dylan16807 6y ago
    I'm talking about understanding how it works on a code level. You don't need to write the special disk out if you're patching the code, like this article does.
    - garmaine 6y ago
      Yeah but you'll have to hunt for and fix the code wherever it is on every disk, which could be subtly or completely different between applications. "Recalculate track 9" is a simple program that would have worked on any Western Security DRM disk.
      - Dylan16807 6y ago
        You're assuming it's always in track 9 in the same spot. What if it isn't? And what if different applications use slightly different obfuscation? If we're assuming Western Security DRM is always in the same spot using the exact same method, why not compare it against some other type of copy protection that always puts the exact same checking code in the same spot? It would actually be easier to blot out the other type's code with NOPs than to recalculate obfuscated Western Security track-length tables.

csl 6y ago

Very clever and great article! But it sounds pretty easy to write a cracker for it: Just rewrite the machine code to jump over the check. Or did I miss anything? Edit: Guess it depends on the details and amount of "obfuscation" that he mentions.

karmakaze 6y ago
My thoughts exactly. I spent a good amount of time learning about and cracking various schemes. It was never about distribution but about bragging rights and the different ways code was obfuscated. Most were disappointingly simple, others had more layers, very rarely found ones that needed special effort beyond say a person-day or two to solve.
- OnlyMortal 6y ago
  Skate Or Die in the C64 was tricky as it had self modifying code for obfuscation. Took me a while to “debug” that. The copy protection of Ocean games was much easier to crack. They had a “IsOkToRun” type of function which returned 1 in the A register.
elahieh 6y ago
Copying one of my old comments from slashdot... it sounds similar to Sierra's "cpc.com". While I was reading the article I wondered if the equivalent of this process for the 6502 (BRK/COP interrupt table?) would work. Back in the 1980s Sierra On-Line used to copy protect their adventure games with a copy protection system which involved strangely formatted sectors on the original disk which were impossible to duplicate exactly using standard PC hardware. The loader "sierra.com" used to call a copy-protection program "cpc.com" which loaded data from the disk to decrypt the main program and run it. cpc.com had some of the most obscure, twisty, awful code ever written to prevent debugging and it constantly used different methods to thwart stepping through the program using INT 3 (these were the days before Soft-Ice). But the solution (or "crack") was just dead simple. Just fire up debug, step to the beginning of cpc.com, and copy the vector from INT 3 into the INT 13 vector - then cpc.com stops right at the point where the data from the disk is being loaded, so it can be copied. Despite all the incredibly complex code, cpc.com had to read the data off the disk so there was no way the Sierra programmers could thwart this method.

beagle3 6y ago

IIRC, Quaid software's Copywrite on the PC was able to reliably duplicate weak bits, and had a companion called "zerodisk" which would -- in cooperation with marks left by Copywrite -- emulate laser holes. I remember at least one copy protection system I analyzed, which get "free reign" into writing tracks, by configuring the drive to write just one huge sector per track (which ended up being longer than the track), end encoding the sector gaps "in band" which later became "out of band" because the main track header was overwritten (and an "in band" one became out-of-band). It was interesting, but I have no nostalgia for that.

berkut 6y ago

Slightly off-topic, but since when were floppies referred to as "disc", as opposed to "disk"? I thought it was from Diskette? Is it a language / region thing? Optical discs were "disc", but at least growing up in the UK in the 80s/90s with DOS/Windows, I'm pretty certain I remember them always being "disk" for floppies? Am I misremembering?

panzagl 6y ago
From the US 80-90's (c64/Amiga/DOS), I remember it as "disk". I always thought "disc" was European in origin.
- tremon 6y ago
  We also used hard disk/floppy disk here in Europe (NL). My recollection is as the GP says, "disc" was only consistently used for optical discs (CD, DVD, BR). It may still be that "disc" is European in origin -- the original CD came from Philips (NL) and Sony (JP) -- but for computer components, I've never seen it spelled "disc".
  - mattl 6y ago
    Weirdly BR is BD.
karmakaze 6y ago
I remember it the same way. But then if floppies are diskettes, what's the non-'ette' disk referring to? DASD Direct-access storage device[0] Disk Pack[1] perhaps? Answer seems to be the 8" floppy disk[2] which only IBM called "Diskette-1" and 5-1/4" ones called mini-diskettes, floppy diskettes, etc. [0] https://en.wikipedia.org/wiki/Direct-access_storage_device https://en.wikipedia.org/wiki/Direct-access_storage_device [1] https://en.wikipedia.org/wiki/Disk_pack https://en.wikipedia.org/wiki/Disk_pack [2] https://en.wikipedia.org/wiki/Floppy_disk#8-inch_floppy_disk https://en.wikipedia.org/wiki/Floppy_disk#8-inch_floppy_disk
- kgwgk 6y ago

jedberg 6y ago

My favorite copy protection was on some games I had (I want to say they were Microprose games? But I could be wrong) where they would cut the hole in the disk just slightly bigger, and then take advantage of the fact that in DOS you could talk directly to the hardware to convince the read head to go just a little too far. Then it could read the magic 41st track to load the game, but no disk copy program could copy it.

userbinator 6y ago
Some of the "floppy extender" programs used more than the usual number of tracks, so unless the 41st was hidden somehow so that its existence was a secret, it would be no harder to copy than all the others. Of course, that may well be why it was so successful --- the extra track wasn't well known, and information travelled much slower back then.
FpUser 6y ago
Nah. I remember those days. Programs that could read/write/discover more tracks than the standard amount were widely available.
- jedberg 6y ago
  Well, it was 30 plus years ago, but what I remember is that at first it was just the games that were doing it, and then people figured it out and made those other programs, making the copy protection useless.
- marzell 6y ago
  There was a similar situation with CDs where you could overprovision data that existed past the technical limit of useable range. I think that's was utilized in NINs Year Zero ARG experiment.
  - peteretep 6y ago
    There were also hidden tracks before track 1 iirc. The X Files soundtrack had one

VikingCoder 6y ago

I remember my tech-savvy uncle was used to PCs which could read double-sided floppy disks. His jaw about dropped out of his skull when he saw me do the 0.5 second floppy-disk-flip that Apple IIc gamers got used to doing, because they could only read from a single side of the disk.

m3kw9 6y ago

DVD or CD protections had this type of protection where they read a part of the disk most DVD writers can’t write to

agumonkey 6y ago
SONY Playstation fault injection was clever too.

DrBazza 6y ago

I seem to remember the only software that would copy any disk you pointed it at, was in fact the source code listed in the official Acorn DFS manual. With the drawback that it copied one sector at a time, so without a double drive, that was a lot of swapping for a 40 track disk, let alone an 80 track one.

m463 6y ago

Back in the 1980's I think there were a lot of interesting schemes. The solution was to just get an updated version of copy2pc or copywrite and they would have a fix. But I remember a few schemes that were interesting workarounds. One was the hole in the disk, one was a laser-burned dot on the disk. I recall with the hole in the disk - the software would try to read and if it succeeded it was a copy. The second one was slightly different and I believe the software would write to it, and read it back, and if it could read it back it was a copy. However the best of all was either the scratch-n-sniff card from Leather Godesses of Phobos, or the Age Verification of Leisure Suit Larry. example: "Gone With The Wind" is about a. outer space. b. a bank robbery. c. four hours long. d. dust. or President Ford prescribed _____ for dealing with economic problems. a. tranquilizers b. employment c. that everyone wear a WIN button d. that everyone should have a nice day

hbbio 6y ago
It's also quite funny that Quaid (who made copywrite) was sued by a protection vendor... but won! "We hold that: (1) Quaid did not infringe Vault's exclusive right to reproduce its program in copies under § 106(1); (2) Quaid's advertisement and sale of RAMKEY does not constitute contributory infringement; (3) RAMKEY does not constitute a derivative work of Vault's program under § 106(2); and (4) the provision in Vault's license agreement, which prohibits the decompilation or disassembly of its program, is unenforceable." in https://cyber.harvard.edu/ilaw/Contract/vault.htm https://cyber.harvard.edu/ilaw/Contract/vault.htm Edit: there is a Wikipedia page for that https://en.wikipedia.org/wiki/Vault_Corp._v._Quaid_Software_Ltd https://en.wikipedia.org/wiki/Vault_Corp._v._Quaid_Software_.... (there is a dot at the end of the URL but HN parser does not treat it correctly)
- deleted 6y ago
  [deleted]
grishka 6y ago
> the Age Verification of Leisure Suit Larry I played the modern version (Leisure Suit Larry Reloaded) a bit but couldn't complete the age verification because it relied on the American history and pop culture too much. Had to shamefully google the answers.

mattbee 6y ago

The other thing this scheme gives you is a unique image per customer, so you could use it to trace illegal copies. When I worked on some expensive emulator software 22 years ago, floppy protection wasn't appropriate but I suggested to the boss that we use the order of linker symbols in the main executable to encode the customer's serial number. I guess it was a No because they wanted to use a standard duplicator, but also piracy was pretty well deterred by the 486 daughter board you needed to run it :)

acomjean 6y ago

Its all very clever. Till it doesn't work. A long time ago, we got EA's "seven cities of gold" from my parents for apple. My brothers and I were all excited but it would start to load then the drive would make a strange sound and it didn't work. We exchanged at the local software store, the next one did the same thing.. We tried on a friends apple //c and it worked there. Our //e drives must have been slightly out of spec. It was bitter disappointment. But a valuable lesson. They're now imaging floppies into new formats so the copy protected disk can still run in emulation: Things like the "Woz" format https://applesaucefdc.com/woz/reference1/ https://applesaucefdc.com/woz/reference1/

AlbertoGP 6y ago
I had the same experience with some of the games I bought. I ended up having to get a pirate copy and overwrite the original tape or later disk.
m-p-3 6y ago
The joys of DRMs affecting legitimate users..

notacoward 6y ago

I remember a similar "easy to write, easy to read, hard to recreate" approach being touted for credit-card security a while ago. The idea was to embed bits of glitter in a clear epoxy matrix, and collect a "fingerprint" of the result when read from different angles. It would be nearly impossible to recreate the glitter pattern. I really liked the idea, but apparently they never solved the alignment problem well enough to make the "easy to read" part a reality.

tomc1985 6y ago

Is "disc" British English? I have always understood "disk" to mean a floppy disk or hard disk (as short for diskette), and "disc" to refer to circular discs like CDs. (Yes, disks have discs inside them but they are squareish to hold) Seeing people refer to floppy disks as discs really bugs me for some reason.

nicoburns 6y ago
> Is "disc" British English? Yes, more or less. https://en.wikipedia.org/wiki/Spelling_of_disc https://en.wikipedia.org/wiki/Spelling_of_disc
mnw21cam 6y ago
Seeing people refer to hard drives as "disks" bugs me as well, because they aren't by any stretch of the imagination diskettes.

14 6y ago

This reminded me of back in the day with Xbox 360 and the cat and mouse we played with MS. MS started making their games I believe 4.8gb in size and all the pirates could only buy DVDs which were smaller as nothing bigger was actually available. The first thing pirates did was truncate the games and removed some padding so they could fit all the security features the disc required to play and remain stealth. Then MS found a way to detect truncated discs and many people were banned. Then one of the 360 main hackers came out with a genius idea to take the discs we could buy and modify the firmware to a certain brand and model of DVD burner to allow the burner to burn right to the outer edge of the DVD. This was possible because all dvds are actually slightly larger then their listed size but standard DVD burners could not burn to the extreme edge. Some burns didn’t write perfect and sometimes you had to burn it a few times before it was stealth. They also had a program to see if the stealth worked and the disc passed or failed. I never did receive a ban and eventually moved to another mod on my 360 that didn’t require discs at all. What a flashback reading this article.

parsimo2010 6y ago

Some thoughts: 1. I love how half the comments here are about disc/disk, which was just a passing comment in the article. 2. I really like reading these sorts of stories where modern hackers figure out the tricks used in vintage technology. They're interesting, and makes me feel a little better that all the clever hackers haven't died off yet. Sometimes I feel like the power of modern computers has made people lazy and we're going to lose our ability for clever solutions. But maybe the clever people are still there. 3. If you like reading about copy protection and (I can't believe I'm about to call the PS1 vintage) vintage tech, you might like this story about the copy protection for Spyro on the PS1. It wasn't so much copy protection as it was punishment after the copying. https://www.youtube.com/watch?v=4GYSeXLr5sY https://www.youtube.com/watch?v=4GYSeXLr5sY

germanka 6y ago

Disk, because Disc is for optical mediums

amelius 6y ago

I'm curious what tricks people use nowadays for software copy protection? Are dongles still a thing? Have people given up on the idea of software protection? (SaaS is probably the best kind of protection if you don't take it too literally)

grishka 6y ago
From what I see, software that is capable of working fully offline is a rarity these days. Everything has an activation server.
rabidrat 6y ago
License keys, software phones home to verify the license key, refuses to run if license key not verified. You could hack the software to remove this protection, and for popular software packages people have done this (Windows, Photoshop, etc).
toast0 6y ago
Dongles are popular in arcade machines (which are mostly just PCs these days)

lowbloodsugar 6y ago

Never forget the press release "This is the first game that cannot be copied". And that's how I learned 6502.

IIAOPSW 6y ago

Way back when monetized flash games were a thing, there was a problem of ad piracy (people who would decompile your game and then upload and monetize it as their own). The conventional wisdom at the time was that piracy could only be delayed, not prevented. The reasoning was that a piracy check has to read the sites URL at some point and the hacker can just search for the only command in all of actionscript which does that. My game contained a very standard check url type protection. This was not the real protection. This was the piece of code which the hacker was supposed to notice and remove. Early on in the game there was a function call to get the total number of bytes in the file and then divide it by the number of expected bytes. Ostensibly this was to calculate the size of the loading bar. I stored this information in a forgettable global variable. On the surface this looks like the sloppy coding one expects from flash devs. But the real purpose was so that I could later check if this number was not 1.0 and trigger the true copy protection. Long story short if the number of bytes were incorrect then the game becomes unplayable after a few levels. I thought that was a nice touch since these hackers usually didn't play though enough of the game to test if their hack worked.

treesknees 6y ago
This reminds me of the write-up I saw about the Spyro games for Playstation. It has a similar result where a copied game would progressively become harder and impossible to beat. They had the same reasoning, most people pirating/patching the game won't play it all the way through before releasing their results. https://www.gamasutra.com/view/feature/131439/keeping_the_pirates_at_bay.php https://www.gamasutra.com/view/feature/131439/keeping_the_pi...

marcan_42 6y ago

Modern copy protection techniques are often based on this same principle. For example, the GameCube and Wii do a very similar thing. Since they use optical media, that doesn't have tracks but instead a single spiral groove, what they do is use a laser to burn little scratches into the disc (which you can see against a light). After mastering and lasering, the disc is checked to see what sectors the marks damaged. Error correction ensures the data is undamaged, but the drive can find these drop-outs. Then a table containing the sector locations is encoded and burned with the same laser into the "burst cut area", effectively a standard barcode format in the inner ring of the disc (this part is standard, many normal drives can read BCAs). This all works because the specific angular position of any given sector is unpredictable during optical disc mastering. The groove is continuous, and never lines up in exactly the same way. So, just like the floppy trick, this is "fingerprinting" the natural variation in write speeds of different disc mastering/burning systems. This scheme is undefeatable using off the shelf burners, but one trick that Datel used to master compatible unofficial discs is to rip the encrypted BCA table off of a real game (so they didn't have to crack the encryption, though that was possible later since it's symnetric) and, instead of burning marks into the disc, just turning off the mastering laser writing the disc track at the exact same points in each track. Those discs don't have any holes, but they have a pattern of sector damage that is indistinguishable to the drive (even though the angular positions no longer match), and they work. I believe the same trick should work with a lightly modified standard burner, if you can manage to find a way to burn the BCA (and you need other firmware patches for some other data-level changes to the disc, but those are easier). Xbox (360 and One discs at least I believe) also do this IIRC, but instead of intentional damage the drive has the ability to compute angular relationships between sectors I believe, though I'm not familiar with the details of that scheme.

itronitron 6y ago

I don't recall how my friends and I figured this out, if we discovered it or just heard about it, but it became standard practice to carefully insert a finger into the disc drive and slow the spinning disc when loading up a copied disc in order to defeat any complaints from the OS. Not sure why this worked but it always did :)

djmips 6y ago
That was also a trick to try and get a disk (of your own) that was having troubles to at least read to back it up.

djmips 6y ago

Not the Beeb but this copy protection was common even quite early on the Apple II. We we ran our disk drives with the cases off so we could adjust the speed screw to match track lengths. We had software that would visually feedback the track length so you could get it spot on.

billpg 6y ago

My recollection from the day was that "disk" was a class of file storage that allowed random access, distinct from tape which needs to be positioned. (For example, "RAM DISK" which isn't at all cylindrical.)

Springcleaning 6y ago

We had to build our own copy protection after dongles were hacked and too fussy. Weak bits were copyable using the CopyIIPC option board. So what we resorted to is using a needle scratching the inner most tracks of the floppy on random locations. Writing those tracks with a pattern and record where the pattern was broken. While executing the program it did write that track and read that track, the locations where the pattern was broken (two tracks, begin and end) was the key that was used to decrypt some parts of the further into the program. To my knowledge it was never hacked and every disk was unique, we kept the keys for each customer (was part of the serial) so if it was hacked we could trace it to the leaker.

blaines 6y ago

The comments are rather interesting as apparently George Keeling himself commented and confirmed everything. :)