7 ms·

>All in-game shutters like the one from when you kill a zombie are fixed because Capcom DRM’s entry points are patched out so most of their functions are never

by daenz 5y ago

>All in-game shutters like the one from when you kill a zombie are fixed because Capcom DRM’s entry points are patched out so most of their functions are never executed anymore. Can someone knowledgeable explain why DRM functions would be called on every zombie kill? I guess I don't have a good understanding on how these DRM checks are implemented in games in general.

alabamacadabra 5y ago
Probably a possible “checkpoint” from Denuvo or similar DRM manufacturers. One would define an “event” for the DRM to trigger. Sometimes it’s starting the game, starting a New Game, loading game/saving game, and so on. Perhaps Capcom thought to (perhaps aptly?) make the check that if you kill a zombie in the zombie game, it checks if you bought the rights to do so.
birdyrooster 5y ago
My guess is they want intermittent checks, but don't trust the system clock to advance, but a zombie kill is evidence that time has advanced for the player. Seems like it shouldn't block the main game thread and there should be a longer time to live for that check, and maybe those are the bugs.
- daenz 5y ago
  Do some cracks rely on preventing the system clock from advancing?
  - ip26 5y ago
    I’m not a cracker but messing with the system clock is a classic exploit for all kinds of things.
  - tehbeard 5y ago
    More that the function calls for the system clock are fairly easy to trace back to find these DRM hooks.
  - arcticbull 5y ago
    Generally in a software system you can't count on a time source to move forward, to move in consistent intervals, or to move at all. In a system that is designed to be resistant to attack, it actually makes a lot of sense to instead rely on a desirable event critical to progression. Especially one that occurs relatively infrequently and is likely associated with a lot of other complex calculations. I think this is pretty smart.
    - daenz 5y ago
      I think I understand the theory. If I was a cracker though, I would think that patching out the system clock calls (in order to prevent DRM checks) would have a lot of game-breaking unintended side-effects (animations, other time-based mechanics, etc). And if that was the case, it would be a perfect place to trigger the DRM calls, since a cracker couldn't patch the system time calls without breaking the game. tehbeard (another comment in this thread) makes a point that maybe not attaching the DRM calls to the clock makes it easier to hide them, since a cracker would probably be looking for a time-based trigger.
      - deleted 5y ago
        [deleted]
      - dognotdog 5y ago
        A game’s animation and other in-game timing functions are very unlikely to be based on wall-time, instead typically relying on monotonic counters that are higher resolution, less overhead, and not potentially adjusted backwards or forwards while the game is running. Thus, disabling wall-time accesses for a crack should have little influence on game timing and animations.
        daenz 5y ago
        That makes sense to use monotonic counters for game mechanics. I think the point still stands in that case though: if the DRM calls were tied to the same time source as the animation system, you couldn't patch one without breaking the other.
  - neom 5y ago
    In the late 90s early 2000s for some stuff you didn't need cracks, you could often literally just set the system clock back to 1990.
    - Scoundreller 5y ago
      If there was a free trial, yes.
NickNameNick 5y ago
If the DRM code was cleanly separated from the normal flow of the game code, it would be trivial for crackers to patch it out.
- briga 5y ago
  Evidently it's still trivial for crackers to patch it out
  - 22c 5y ago
    I wouldn't say it's trivial. EMPRESS is one of the most talented crackers on the scene at the moment and it took ~2 months for this release. Arguably, without EMPRESS, the crack would have taken a lot longer.
    - skhr0680 5y ago
      I think publishers should be happy with that. Every day a crack doesn’t come out is one more teenager who is hyped about latest game who will buy it.
      - paxys 5y ago
        Yeah, a lot of publishers voluntarily remove DRM from their games after a few months because most of the profit is made right at launch. Once the first round of discounts start to hit DRM serves no purpose anymore.
        haswell 5y ago
        I have never heard of this. Do you have any examples?
        paxys 5y ago
        Search for "Denuvo removed" on Google. Lots of recent examples. Doom Eternal & Metro Exodus – https://www.gamesindustry.biz/articles/2020-05-29-denuvo-security-software-removed-from-doom-eternal-and-metro-exodus https://www.gamesindustry.biz/articles/2020-05-29-denuvo-sec... Monster Hunter World – https://www.vg247.com/2021/06/03/monster-hunter-world-denuvo-removed-pc/ https://www.vg247.com/2021/06/03/monster-hunter-world-denuvo... Mass Effect Legendary Edition – https://www.nme.com/news/gaming-news/mass-effect-legendary-edition-removes-denuvo-2964344 https://www.nme.com/news/gaming-news/mass-effect-legendary-e... Nier Automata – https://www.nme.com/news/gaming-news/nier-automata-update-removes-denuvo-anti-tamper-software-2974400 https://www.nme.com/news/gaming-news/nier-automata-update-re...
GuB-42 5y ago
DRM calls are sprinkled everywhere inside the code, usually statically linked or even inlined. This is to make it harder for crackers to identify them. Here they put some in the zombie kill routine, but I don't think there is anything special about zombie kills. It could have been anything: picked up ammo, loading a map, pass a certain event, on a timer, during a save, all of the above, etc... I don't have a deep knowledge about the technology involved but from what I've seen modern DRM like Denuvo are based on virtual machines and are very flexible, allowing all sorts of checks at many points. Done well, there is little overhead, but some overzealous publishers do frequent lengthy checks, killing performance.
- SV_BubbleTime 5y ago
  > Done well, there is little overhead, but some overzealous publishers do frequent lengthy checks, killing performance. I can imagine disaster if someone inlines the wrong function here. Definitely something that shouldn’t make it out the door, but amazing the difference 6 letters could make.
  - wallscratch 5y ago
    Why can inlining functions cause disasters? Just instruction cache misses, or other things as well?
- unnouinceput 5y ago
  Quote:"...but some overzealous publishers do frequent lengthy checks..." Since when do publishers have access to source code to do those checks themselves? Developers do that. And yes, I am aware that in this particular case, for RE:Village, the developer and publisher are the same.
  - feoren 5y ago
    I would think it very odd if publishers were not given the source code. If you were a publisher, would you want some small shop to be able to disappear off the face of the Earth, preventing you from ever doing even simple ports and patches?
asgeir 5y ago
It can be useful to break the game in subtle ways so that the crackers have a harder time knowing when the crack is fully done. https://www.nag.co.za/2013/10/23/the-5-biggest-and-most-awesome-anti-piracy-trolls/ https://www.nag.co.za/2013/10/23/the-5-biggest-and-most-awes...

by daenz 5y ago

alabamacadabra 5y ago

Probably a possible “checkpoint” from Denuvo or similar DRM manufacturers. One would define an “event” for the DRM to trigger. Sometimes it’s starting the game, starting a New Game, loading game/saving game, and so on. Perhaps Capcom thought to (perhaps aptly?) make the check that if you kill a zombie in the zombie game, it checks if you bought the rights to do so.

birdyrooster 5y ago

My guess is they want intermittent checks, but don't trust the system clock to advance, but a zombie kill is evidence that time has advanced for the player. Seems like it shouldn't block the main game thread and there should be a longer time to live for that check, and maybe those are the bugs.

daenz 5y ago
Do some cracks rely on preventing the system clock from advancing?
- ip26 5y ago
  I’m not a cracker but messing with the system clock is a classic exploit for all kinds of things.
- tehbeard 5y ago
  More that the function calls for the system clock are fairly easy to trace back to find these DRM hooks.
- arcticbull 5y ago
  Generally in a software system you can't count on a time source to move forward, to move in consistent intervals, or to move at all. In a system that is designed to be resistant to attack, it actually makes a lot of sense to instead rely on a desirable event critical to progression. Especially one that occurs relatively infrequently and is likely associated with a lot of other complex calculations. I think this is pretty smart.
  - daenz 5y ago
    I think I understand the theory. If I was a cracker though, I would think that patching out the system clock calls (in order to prevent DRM checks) would have a lot of game-breaking unintended side-effects (animations, other time-based mechanics, etc). And if that was the case, it would be a perfect place to trigger the DRM calls, since a cracker couldn't patch the system time calls without breaking the game. tehbeard (another comment in this thread) makes a point that maybe not attaching the DRM calls to the clock makes it easier to hide them, since a cracker would probably be looking for a time-based trigger.
    - deleted 5y ago
      [deleted]
    - dognotdog 5y ago
      A game’s animation and other in-game timing functions are very unlikely to be based on wall-time, instead typically relying on monotonic counters that are higher resolution, less overhead, and not potentially adjusted backwards or forwards while the game is running. Thus, disabling wall-time accesses for a crack should have little influence on game timing and animations.
      - daenz 5y ago
        That makes sense to use monotonic counters for game mechanics. I think the point still stands in that case though: if the DRM calls were tied to the same time source as the animation system, you couldn't patch one without breaking the other.
- neom 5y ago
  In the late 90s early 2000s for some stuff you didn't need cracks, you could often literally just set the system clock back to 1990.
  - Scoundreller 5y ago
    If there was a free trial, yes.

NickNameNick 5y ago

If the DRM code was cleanly separated from the normal flow of the game code, it would be trivial for crackers to patch it out.

briga 5y ago
Evidently it's still trivial for crackers to patch it out
- 22c 5y ago
  I wouldn't say it's trivial. EMPRESS is one of the most talented crackers on the scene at the moment and it took ~2 months for this release. Arguably, without EMPRESS, the crack would have taken a lot longer.
  - skhr0680 5y ago
    I think publishers should be happy with that. Every day a crack doesn’t come out is one more teenager who is hyped about latest game who will buy it.
    - paxys 5y ago
      Yeah, a lot of publishers voluntarily remove DRM from their games after a few months because most of the profit is made right at launch. Once the first round of discounts start to hit DRM serves no purpose anymore.
      - haswell 5y ago
        I have never heard of this. Do you have any examples?
        paxys 5y ago
        Search for "Denuvo removed" on Google. Lots of recent examples. Doom Eternal & Metro Exodus – https://www.gamesindustry.biz/articles/2020-05-29-denuvo-security-software-removed-from-doom-eternal-and-metro-exodus https://www.gamesindustry.biz/articles/2020-05-29-denuvo-sec... Monster Hunter World – https://www.vg247.com/2021/06/03/monster-hunter-world-denuvo-removed-pc/ https://www.vg247.com/2021/06/03/monster-hunter-world-denuvo... Mass Effect Legendary Edition – https://www.nme.com/news/gaming-news/mass-effect-legendary-edition-removes-denuvo-2964344 https://www.nme.com/news/gaming-news/mass-effect-legendary-e... Nier Automata – https://www.nme.com/news/gaming-news/nier-automata-update-removes-denuvo-anti-tamper-software-2974400 https://www.nme.com/news/gaming-news/nier-automata-update-re...

GuB-42 5y ago

DRM calls are sprinkled everywhere inside the code, usually statically linked or even inlined. This is to make it harder for crackers to identify them. Here they put some in the zombie kill routine, but I don't think there is anything special about zombie kills. It could have been anything: picked up ammo, loading a map, pass a certain event, on a timer, during a save, all of the above, etc... I don't have a deep knowledge about the technology involved but from what I've seen modern DRM like Denuvo are based on virtual machines and are very flexible, allowing all sorts of checks at many points. Done well, there is little overhead, but some overzealous publishers do frequent lengthy checks, killing performance.

SV_BubbleTime 5y ago
> Done well, there is little overhead, but some overzealous publishers do frequent lengthy checks, killing performance. I can imagine disaster if someone inlines the wrong function here. Definitely something that shouldn’t make it out the door, but amazing the difference 6 letters could make.
- wallscratch 5y ago
  Why can inlining functions cause disasters? Just instruction cache misses, or other things as well?
unnouinceput 5y ago
Quote:"...but some overzealous publishers do frequent lengthy checks..." Since when do publishers have access to source code to do those checks themselves? Developers do that. And yes, I am aware that in this particular case, for RE:Village, the developer and publisher are the same.
- feoren 5y ago
  I would think it very odd if publishers were not given the source code. If you were a publisher, would you want some small shop to be able to disappear off the face of the Earth, preventing you from ever doing even simple ports and patches?

asgeir 5y ago

It can be useful to break the game in subtle ways so that the crackers have a harder time knowing when the crack is fully done. https://www.nag.co.za/2013/10/23/the-5-biggest-and-most-awesome-anti-piracy-trolls/ https://www.nag.co.za/2013/10/23/the-5-biggest-and-most-awes...