3 ms·

> I don’t know much about DRM methods, but I assume this is a Windows95-level weak one? Checking for files-from-the-future as evidence of clock-tampering is ce

> I don’t know much about DRM methods, but I assume this is a Windows95-level weak one? Checking for files-from-the-future as evidence of clock-tampering is certainly not a new technique - and I'm sure it predates Windows 95. I am familiar with a slightly improved version of the technique: rather than checking actual filesystem files, instead the DRM opened the HDD as a raw device and would write multiple redundant copies of timestamps and usage logs to unallocated parts of the disk - so even restoring a HDD (at the filesystem level) wouldn't be enough to make the DRM system think it was back-in-the-past. You'd have to do a raw low-level HDD restore that included the state of unallocated - but written - disk contents. I gather it would also raise a fuss if it couldn't find any of its previously written logs either. ...I don't know what happens if you try to run the software on a disk with zero free disk space, however. I think it was used by some Macromedia titles in the late 1990s - or software of that variety.

gruez 5y ago
>...I don't know what happens if you try to run the software on a disk with zero free disk space, however. It will still work, at least on windows. That's because it reserves some sectors at the end as hidden sectors that applications can't directly access. source: https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition
- p_l 5y ago
  The DRM schemes actually used the "no man's land" between MBR and start of cylinder 1, which was supposed to be unused. This craps itself when you run Grub, which happily scribbles itself to the same area
josephcsible 5y ago
> the DRM opened the HDD as a raw device Why does [insert random program here] need admin rights? Now you know!
- zinekeller 5y ago
  Nah, it's all being done as NT services now, but I assume your comment is from XP era where 9x compatibility is still important.
mmis1000 5y ago
If you are on windows, I guess ntfs alternative data stream is a good places to hide random items. You can write whatever information into it while not visible to user or most of file explore because it is so rarely used and windows hide it intentionally (excepts the windows itself use it to mark downloaded files)
- ale42 5y ago
  Windows also uses it for metadata, e.g. if you edit the "Comment" of a DLL file. The problem with NTFS alternate streams it's that they are very easy to find if you know what you're looking for. It might be better to hide data in plain sight in the middle of existing registry keys. Or actually you can create inaccessible registry keys (depending on the API you use, you can actually put NULLs in registry key names, making them inaccessible for regedit... but there are programs to easily detect this as it's known since a long time, see https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull https://docs.microsoft.com/en-us/sysinternals/downloads/regd...)
  - mmis1000 5y ago
    `it's that they are very easy to find...` is probably true for most methods. Those methods aren't magic anymore if you knows about them. And that is also the reason everybody why don't want to talk about how they hide thing?

gruez 5y ago

>...I don't know what happens if you try to run the software on a disk with zero free disk space, however. It will still work, at least on windows. That's because it reserves some sectors at the end as hidden sectors that applications can't directly access. source: https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition

p_l 5y ago
The DRM schemes actually used the "no man's land" between MBR and start of cylinder 1, which was supposed to be unused. This craps itself when you run Grub, which happily scribbles itself to the same area

josephcsible 5y ago

> the DRM opened the HDD as a raw device Why does [insert random program here] need admin rights? Now you know!

zinekeller 5y ago
Nah, it's all being done as NT services now, but I assume your comment is from XP era where 9x compatibility is still important.

mmis1000 5y ago

If you are on windows, I guess ntfs alternative data stream is a good places to hide random items. You can write whatever information into it while not visible to user or most of file explore because it is so rarely used and windows hide it intentionally (excepts the windows itself use it to mark downloaded files)

ale42 5y ago
Windows also uses it for metadata, e.g. if you edit the "Comment" of a DLL file. The problem with NTFS alternate streams it's that they are very easy to find if you know what you're looking for. It might be better to hide data in plain sight in the middle of existing registry keys. Or actually you can create inaccessible registry keys (depending on the API you use, you can actually put NULLs in registry key names, making them inaccessible for regedit... but there are programs to easily detect this as it's known since a long time, see https://docs.microsoft.com/en-us/sysinternals/downloads/regdelnull https://docs.microsoft.com/en-us/sysinternals/downloads/regd...)
- mmis1000 5y ago
  `it's that they are very easy to find...` is probably true for most methods. Those methods aren't magic anymore if you knows about them. And that is also the reason everybody why don't want to talk about how they hide thing?