16 ms·

Defeating a 40-year-old copy protection dongle

859 points by zdw 9mo ago

kwanbix 9mo ago
My father, an accountant, used to have a program like that, that used RPG and a dongle! Good times. Horrible donle.
dehrmann 9mo ago
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.
- cyanydeez 9mo ago
  Yeah, my IT company bitshifts suspect files and provides the magic number. The protection just needs suficirntly complex.
- opinologo 9mo ago
  Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000. In most cases it was not much more difficult than what OP described.
  - iamflimflam1 9mo ago
    I worked on some software that was used by telcos around that time - you were probably hacking our dongles :)
    - iamflimflam1 9mo ago
      Even more amazingly - that software I worked in is still being used and sold. Probably still has some of my ropey old code on it…
- 15155 9mo ago
  Audience matters. Something intended to stop legitimate business consumers in a non tech industry requires substantially less sophistication than something built to withstand professional reverse engineers.
  - dwattttt 9mo ago
    Locks are there to keep honest people honest. To expand on the saying, they're not there to be insurmountable. Just to be hard enough to make it easier to do things the right way.
    - nkrisc 9mo ago
      And often they’re there so no one can plausibly say they didn’t know what they were doing or stumbled into it accidentally. You can’t “accidentally” go through a door with a padlock on it. I’d guess it’s something similar with this dongle. You can’t “accidentally” run the software without the dongle.
  - classichasclass 9mo ago
    Copy protection was also generally less robust for educational software, since it sold to generally law-abiding folks (parents, educators, etc.). Never saw Rapidlok or V-MAX! used for educational software on the Commodore 64, for example.
  - Gigachad 9mo ago
    These days there would be an Aliexpress listing selling fake dongles within a month making it easy for the business customers too.
- bri3d 9mo ago
  In fairness, the decompiler didn't work on the protection method :) I think that both halves of the author's thesis are true: I bet that you could use this device in a more complicated way, but I also bet that the authors of the program deemed this sufficient. I've reversed a lot of software (both professionally and not) from that era and I'd say at least 90% of it really is "that easy," so there's nothing you're missing!
- rustyhancock 9mo ago
  The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access. More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case. I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty. What if the hardware has a LFSR in it and returns changing responses, and the caller can check them with a verify function else where that maintains a state and knows to expect the next in the sequence? We have far better tools today for sure, but we understood the system better back then. The right tool is sometimes better than a sharper tool as they say. Edit : I should add I'm aware it's very likely the actual reversing involved more steps and checks than Dimitrys blog which is narrowed to what worked.
  - mobilio 9mo ago
    BPIO anyone?
  - quercusa 9mo ago
    SoftICE was like magic back in the day.
ruleryak 9mo ago
Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you were trying to skip, find that string, hop over into assembly to see what triggered loading that, and then just alter the logic to jump over it when the time comes.
- antonvs 9mo ago
  > Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. I did that with dBASE III, which used ProLok "laser protection" from Vault Corporation - a signature burned onto the diskette with a laser. Back then, I found it amazing that Ashton-Tate actually spent money to contract with a copy protection company for something that could be so easily defeated by a teenager reading assembler. They could have easily just written the same kind of code themselves. An example of the power of marketing over substance. I was able to replicate that protection mechanism just by scratching a diskette with a pin. The "laser" was a meaninglessly advanced-sounding solution that added no value compared to any other means of damaging a diskette.
  - foresto 9mo ago
    > I was able to replicate that protection mechanism just by scratching a diskette with a pin. How did you figure out where to scratch it? Was the laser mark visible on the original disk, or did you have to read the code and orient based on the diskette's index hole?
    - anyfoo 9mo ago
      Yes, it was apparently very visible: https://martypc.blogspot.com/2024/09/pc-floppy-copy-protection-vault-prolok.html https://martypc.blogspot.com/2024/09/pc-floppy-copy-protecti... But as I mentioned in a sibling comment, I’m not sure it was ever confirmed that it was really a laser that made that mark.
catlikesshrimp 9mo ago
Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey. I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars. The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!
- bri3d 9mo ago
  Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly. I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion, if you could reverse one you could reverse the other. But this concept was insanely prevalent for ~20 years or so. One of the biggest problems was not having enough ports. Some parallel port dongles tried to ignore communication with other dongles and actually had a port on the back; you'd make a "dongle snake" out of them. Once they moved to USB it was both easier and harder - you couldn't make the snake anymore, but you could ask people to use a hub when they ran out of ports.
  - Joe_Cool 9mo ago
    P-CAD even had a dongle-caddy where you could plug in I think about 7 of them into to unlock different modules. I will check if I can find an image of it. EDIT: here is an old listing of it: https://www.ebay.com/itm/187748130737 https://www.ebay.com/itm/187748130737 Sadly the lid isn't open so you can't see what modules are installed.
  - alexfoo 9mo ago
    > I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion ... Starting in '97 I worked on some software that used Elan License Manager (elmd) that then moved on to FlexLM in a major release. Requests for, and problems with, licensing were a considerable source of support tickets but I'm sure it also drove a reasonable amount of sales as customers wanted to play with component X but were prevented from doing so by a lack of license. When we were acquired by IBM we replaced the licensing code with lawyers and (threats of) audits. It didn't seem to harm the revenue. The product is still being maintained and sold. > ... if you could reverse one you could reverse the other. I can confirm it was quite easy with gdb to either skip past the license checks or, in the case of Elan licensing at least, call the license generation function from within the binary to generate whatever licenses for whatever features you liked. The "hardware identifiers" were a nightmare too. I ended up writing some code that would pull all of the necessary information (primary MAC, IP address, hostid for Sparc machines, hostname, etc) and give it to us in a base64 encoded blob, we also grabbed some CPU and memory information that proved quite useful in seeing how the software was deployed.
aizk 9mo ago
Very cool to read an article about windows 95 still being used in production - a nice contrast to the infinite AI hype cycle over everything. Tech may move fast in flashy areas but not in the more "boring" parts of the industry.
- 1970-01-01 9mo ago
  The screenshots show the program was made for DOS. Very likely Windows was used just for network file sharing.
  - RaftPeople 9mo ago
    Ya, RPG assumed character based IO so probably a safe bet that they just ported stuff that ran on IBM character based terminals and just made it run in DOS. (I worked in RPG in the 80's)
- accrual 9mo ago
  I knew of a Windows 95 host running virtualized in a corp environment until at least 2014 or so. It was surprisingly sturdy, I only had to remote into it once or twice when the old software it was running hung up on something. It was old medical software and we apparently had a couple clients still interfaced to it.
- jojobas 9mo ago
  Win95 is only 30 years old and runs natively on some modern hardware. Apparently there is important stuff still running in emulated PDP-11s, almost double the age.
  - Joe_Cool 9mo ago
    It needs quite a few fixes to even run in a VM. But it can be done: https://github.com/JHRobotics/patcher9x https://github.com/JHRobotics/patcher9x
    - jojobas 9mo ago
dmitrygr 9mo ago
>Very importantly, there doesn’t seem to be any “input” into this routine. It doesn’t pop anything from the stack, nor does it care about any register values passed into it. Which can only mean that the result of this routine is completely constant! This is not necessarily a fair assumption (though it worked this time). It could be some sort of a rolling code, where the reply is not constant but changes, and remains verifiable. Example: garge door openers have no input from the garage, but the sent signal differs every button click, and the garage can verify its correctness
- dfox 9mo ago
  Unles the verification routine (eg. garage) keeps some state somewhere it has no way to prevent replays.
  - deleted 9mo ago
    [deleted]
  - dmitrygr 9mo ago
    i did not say replay was impossible. i said the statement in the article was overly broad, which it is. If it said "a single result could be hard-coded", it would be fine. but it said the function is constant, which it need not be. But even that need not be true. here is how you could design that dongle to require no persistent state on RX and still not allow simple replay. TX code: static u8 counter = 0; tmp = randU12() * 16 + (counter++); tmp2 = sha256(secret + tmp) & 0xffff; send32((tmp << 16) + tmp2) RX code: static u16 prevSeenCodes[16]; static u8 idx = 0; tmp = recv32(); tmp2 = tmp & 0xffff; tmp >>= 16; if (sha256(secret + tmp) & 0xffff != tmp2) fail(); if (tmp in prevSeenCodes) fail(); prevSeenCodes[15 & idx++] = tmp; now you need to replay at least a sequence of 16 codes that array is in ram and need not persist across program runs. dongle can be powered off or can be left on. all will work
sonixier 9mo ago
The company i work at has the same problem. We have some old mission-critical windows 2000 pc that runs the rpg compiler, with attached dongle. This gave me some clues on where to start - thanks author!
- tclancy 9mo ago
  Check out this comment too! https://news.ycombinator.com/item?id=46854885 https://news.ycombinator.com/item?id=46854885
dunham 9mo ago
Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it. The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.
- zzzeek 9mo ago
  my story of this is Atari Macro Assembler. The floppy had a specific sector that was damaged, and the loader would test this sector to ensure it was in fact damaged. this was obvious becuase whenever loading the floppy, you had to wait for one of those big "BZZT....BZZT" things where the 810 drive was trying to access a bad sector and giving up. I was able to disassemble maybe the first 30 bytes of the boot to see it checking this and doing the jmp. I just overwrote it with a single jmp and got not just a copy but much faster loading without the BZZTBZZT part.
  - TMWNN 9mo ago
    I've heard that Happy Drive singlehandedly destroyed the commercial viability of the Atari 8-bit software market, because it was so widespread and is so powerful at duplicating games.
accrual 9mo ago
Fun journey! It would be fascinating to see what's inside the dongle. I wonder if it's programmable or just a simple circuit.
- byb 9mo ago
  Yes, a neat follow-up would be to clone the copy protection device with a cheap microcontroller. A lot of these devices were filled with epoxy, but it would be funny to find out these were all just 1Kbit EEPROMs. Such an article could give some background on parallel port communication, EEPROMs, and how regular printer data was passed through.
izme 9mo ago
This takes me back. There exist emulators for these dongles as well, you run the a dumper with the dongle attached and load the program and it makes a dump file which you then use in the emulator. I had to do this for a company so they could continue to use their old specialised Win98 software on modern computers using Dosbox and an emulator.
nsoonhui 9mo ago
I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade. Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates. [0]: https://mes100.com https://mes100.com
- huflungdung 9mo ago
  [dead]
- SecretDreams 9mo ago
  > which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users. I don't condone piracy, but I also don't condone SaaS.
  - nsoonhui 9mo ago
    In a perfect world, I would have agreed with you, even if it's diametrically opposite to my interest as a software developer cum business owner. But in an imperfect world whereby our dependencies ( software components that we use) and platforms that we need to build/rely on ( like Civil 3D) do charge us on annual basis, and that some of users expect perpetual bug fixes from us, with or without a support contract of sorts, SaaS seems to only way to go for our sustainability.
jedberg 9mo ago
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch? Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid. This was basically the 80s version of that.
- tclancy 9mo ago
  I mean, we used to turn single-sided 5 1/4" disks for the C64 into double-sided disks through the use of cutting-edge technology. Literally. I was fancy and got a $5 hole punch built for the job, but scissors worked too. Fast Hack'em may still be my favorite piece of software ever.
huflungdung 9mo ago
[dead]
engelo_b 9mo ago
[dead]
burnt-resistor 9mo ago
And they probably could've just used Neverlock Business which cracks zillions of programs.
DANmode 9mo ago
> Is this really worthy of a patent? You have no idea how deep this rabbit hole goes. Patents are barely better than copyright, as far as society net-positive.
deleted 9mo ago
[deleted]
odomus 9mo ago
Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?
- direwolf20 9mo ago
  It's illegal.
  - NoiseBert69 9mo ago
    https://eur-lex.europa.eu/eli/dir/2009/24/oj/eng https://eur-lex.europa.eu/eli/dir/2009/24/oj/eng Directive 2009/24/EC, Article 5 + Article 6 Under special circumstances it's legal within the EU do do this. And removing a freaking old copy protection dongle to allow emulation of the software you legally are allowed to use falls under this.
- TheDong 9mo ago
  Once it hits 70 years from the lifetime of the author (so probably another 80 or 90 years from now) and is in public domain, that might change things since there will no longer be copyright being protected. In terms of copyright terms, this software is still pretty young, not even halfway to public domain. It's disrespectful to call it "very old".
  - direwolf20 9mo ago
    Defeating a copy protection measure is illegal, even if the copy protection measure is not copyrighted.
    - TheDong 9mo ago
      I'm not talking about the copy protection, but the software being protected. Surely if the work being protected isn't copyrighted, there's nothing to circumvent in terms of the DMCA?
Tempest1981 9mo ago
So what hardware would be inside the dongle? Would a small PAL be enough? 22V10? Maybe use a few registers to delay the values written by a few cycles, mixing in some decode logic? (Something cheaper than a microcontroller, I'm guessing... due to cost)
asyncadventure 9mo ago
[dead]
zabzonk 9mo ago
I think I remember hacking some of the copy-protection out of a version of Tetris using the Borland debugger. I definitely patched mouse support into a Chris Crawford "Battle of the Bulge" game using it (for my rather tricky platform). That was a good debugger, and probably the last one I have used much - prefer logging/printing for stuff I write myself. I remember my Dragon 32 (6809, Color Computer clone) had a dongle you plugged into the joystick port to protect a really crap game - Jumping Knights? I never tried to defeat it.
charcircuit 9mo ago
>The only evidence for the existence of this company is this record of them exhibiting their wares at SIGGRAPH conferences in the early 1990s, as well as several patents issued to them, relating to software protection. There is also their webpage for ordering PC RPG II. The company address is a residential house. https://web.archive.org/web/20010802153755/http://home.netcom.com/~softwest/rpg.htm https://web.archive.org/web/20010802153755/http://home.netco...
- idogs 9mo ago
  Apparently there is a Noel Vasquez, now in his late 80s, living at that address. Might be the guy to contact for further information, if he's still around.
firecall 9mo ago
Cracking this dongle; wouldn't this be a federal offence in the US? Not being snarky - genuine question! I am not from the US :-)
- userbinator 9mo ago
  It probably is; and so is going 10 over the speed limit.
- direwolf20 9mo ago
  Yes and in every country that adopted a copyright treaty with the US, so all of them except China
  - garaetjjte 9mo ago
    While WIPO mandates similar wording not every implementation makes software-only patch criminal.
- TMWNN 9mo ago
  >Cracking this dongle; wouldn't this be a federal offence in the US? No. As of 2003 there is a DMCA exemption for "computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete". <https://en.wikipedia.org/wiki/Video_game_preservation#Legal_issues https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>
seblon 9mo ago
Yeah, Software protection was very naive in the beginning. Fun fact: I owned a windows 3.11 for workgroup UPGRADE disc collection, it was clearly explained and also enforced from the setup installer. So, no previous installed win 3.0 == upgrade installer will fail. The fix: just create an empty Textfile named win.com at any place - the installer simple scans the WHOLE disk just for this existing filename. Next fun fact: in reality, the Upgrade contained the full installation, no only a delta. Men, software was so simple these days....
- mikepurvis 9mo ago
  I have a childhood memory of my dad buying a shrink-wrapped copy of the Windows 3.1 Upgrade that was supposed to allow any installation of "3.0 or earlier" to become Win 3.1. it turned out when we actually tried it it only accepted 3.x though. [1] I think he ended up pirating a 3.x install from a friend and running the upgrade on to of that; felt pretty morally clear given what the box had advertised. [1]: eg https://www.ebay.com/itm/376080245422 https://www.ebay.com/itm/376080245422
  - goldfishgold 9mo ago
    Love the Ebay link. Where has that been sitting for the last 30 years?
    - mikepurvis 9mo ago
      Right?? Even if it's potentially a re-shrink, just the box period still existing in that condition is notable, especially for such a "plain" design; it's not like the full-colour Windows 95 ones for which there are probably thousands of unopened copies sitting in collectors' vaults.
smoyer 9mo ago
I designed a security dongle a long time ago ... Used properly, it did rotations and XORs like a CRC. You could definitely make it hard to defeat but it was still ultimately deterministic.
algeni 9mo ago
[flagged]
Sophira 9mo ago
The fact that the software and hardware is evidently still in use at some companies gives me pause about whether releasing it in a cracked form publicly after having published it on a personal website would be a good idea. Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in! All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue. If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.
- mrandish 9mo ago
  Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one. Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unknown software apps to preserve. Software sold for Windows 98 up to 2001 (so recent as to barely be considered 'vintage') with so little online footprint means it must have been incredibly obscure. No ads or reviews from magazines or even newsletters means there's a good chance it was a one or two person part-time, home-based business and the product had hundreds or maybe even just dozens of users. 1998-2001 was the hottest time ever for PC software. I worked in marketing Windows software during this period. To have any commercial Windows software product actively available for sale in the late 90s with no surviving footprint would almost require intentional effort to stay unknown. No press releases mailed. No review copies sent. No shows or conferences attended (exhibitor listings are searchable online now). There were much older niche vertical software programs for much more obscure platforms which we know sold less than a hundred copies ever, yet still have a larger online footprint than this program. The OP de-protecting and archiving this previously unknown commercial program represents quite a notable find in the preservation community.
  - 9mo ago
51Cards 9mo ago
I was hired in the early 90's by a collection of franchises for a home care company. The privately owned head office self-developed and distributed required monthly updates to the only software franchises were permitted to run their business. The monthly updates (floppies) reset the license for another month at each location. After years of problems, poor support, and in a couple cases offices getting shut down because head office just "didn't like them anymore", they banded together to sue the owners (one of which developed the software). I did IT work for a couple of the offices and was already familiar with maintaining the software / systems. They hired me to bypass the licensing code which was a lot of fun to figure out. In the end I wrote a DOS based license generator each office had that could update their software by just getting a code over the phone for the upcoming month (or any date for 365 days). A few years later once the lawsuit settled and the company broke apart we issued a patch for the software to remove the license check completely. I should fire up DOSBox sometime so I can play with that old software again.
boarsofcanada 9mo ago
I wrote RPG II code in the 80s and helped the company I was working part-time for transition to another one of these S/36 emulation environments on the PC in the 90s. The software we used was made by the very generically named California Software Products. It worked well enough and allowed the company to run until the founder retired and folded the business.
dhosek 9mo ago
I remember reading an ad in one of the 90s PC magazines that attributed the dongle to an inventor named “Don Gull.” I was fortunate enough to never have to use a hardware dongle, but I remember hearing about their persistence into the twenty-first century. I would imagine that most of them were as ridiculously simple as this one was.
weinzierl 9mo ago
These dongles used to be ubiquitous and they broke all the time. As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared) Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing. So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing. Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home. Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.
- l33tman 9mo ago
  We had proper licenses for all PADS seats at my previous work, but all the users always installed the cracked versions because it was unusable with the dongle.
- rwmj 9mo ago
  I remember when I worked in an electronics lab one of our EEs built several "dongle buses", a parallel port "bus" that you could plug up to about half a dozen dongles in, and it was frequently fully populated on the machines we used for CAD and PCB layout. An early version of PADS (PADS2000?) was one of the applications we used.
- xxr 9mo ago
  >they broke all the time While I was reading the OP I kept thinking about how an accounting firm's entire ability to do business rested on the continued functioning of a parallel-port dongle. I just have to imagine that they had a box full of these.
userbinator 9mo ago
For some reason, Reko was not able to decompile this code into a C representation That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler. In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program. This reminds me of the classic Ken Thompson attack.
sedatk 9mo ago
Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.
- unnouinceput 9mo ago
  Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk? The reason why this is not more common is because the more iterations you do, the harder is to create those iterations, which means you add a lot of time to create the protection which means that you need to have a finished code, and code is always modified by production team, so managers see this overtime unnecessary.
  - 71bw 9mo ago
    >Also to this day there is no crack to Diablo 3 Look into Blizzless :-)
    - unnouinceput 9mo ago
      Looking into Issues, reading 48 and just scrolling at beginning: "Local and LAN systems talk, but will not authenticate" / "Multiplayer Game Problem" / "cannot restore DB" / "Items stats do not reflect the game class"...etc, just to name a few. Yeah, I really like to get frustration when I am gaming due to unsupported and canceled project /s
  - self_awareness 9mo ago
    > The reason why this is not more common The real reason is that executable modifying its own code is often flagged by AV, or the OS itself, as an "insecure" activity. Since self-modification is used in attacks and exploits, good protections rarely use it now. It's impossible to use codesigns with self-modified code.
bitwize 9mo ago
This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.
- urbandw311er 9mo ago
  …and?
- TMWNN 9mo ago
  No. As of 2003 there is a DMCA exemption for "computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete". <https://en.wikipedia.org/wiki/Video_game_preservation#Legal_issues https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>
RagnarD 9mo ago
Fun hack, sure, but why on earth isn't the focus on porting the accounting data to a new, currently supported accounting system?
thenthenthen 9mo ago
As a hardware guy I would first start with opening up the dongle, but hey! Still very curious to see whats inside!
- medwards666 9mo ago
  I always thought the internals were encased in potting compound for these things to prevent exactly this scenario (certainly the ones I had for LightWave back in the day were)...
- alibarber 9mo ago
  Yes my first thought would be to probe the parallel lines and see what went in and came out, but this approach was just as interesting!
cricalix 9mo ago
Tangential to this was the existence of California Software Product's "Baby/36" software. My father was a 36/400 programmer and sysadmin, and in his spare time used Baby/36 to write software for local businesses. I have vague memories of parallel port dongles being involved back then too. Don't think he mandated their use, was more a "framework" requirement.
shevy-java 9mo ago
This is kind of like archaeology - just, software archaeology.
maximgeorge 9mo ago
[dead]
taylorportman 9mo ago
Often these dongles were just a single resistor 'circuit'
- direwolf20 9mo ago
  Like a warded lock. It only keeps honest people honest — and proves intent to not pay.
giamma 9mo ago
This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version. So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation. [0] https://en.wikipedia.org/wiki/Executable_compression https://en.wikipedia.org/wiki/Executable_compression
- notpushkin 9mo ago
  My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.
  - andreaven 9mo ago
    you were lucky it was an unsigned var.. otherwise you could have gifted a very nasty trial time of -1 minute! a pretty nice anti-addiction feature :-)
    - notpushkin 9mo ago
      Hahaha. On a second thought I think it was a bit trickier and did some weird math to obfuscate the value (probably something simple, like XOR). So yeah, my actual fix was to mash buttons until I got a big enough number :D
  - davidwritesbugs 9mo ago
    Hope she knows she still only has 3million trial days left
3uruiueijjj 9mo ago
USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so. In our case, the copy protection would still be as easy to bypass as the one in the article.
- u1hcw9nx 9mo ago
  You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't. Actual dongles with encryption and processor cost only $15 in batches of 100.
  - cricalix 9mo ago
    UnRaid does a variant of this; license is tied to the serial of the USB drive. It barely writes to the drive, so wear isn't meant to be much of an issue.
soanvig 9mo ago
I want to read the rest of the migration story
unwind 9mo ago
Just a few months back I worked in embedded development on a project and there was a physical dongle to unlock the compiler, which was surprising during on-boarding as I've spent years doing commercial embedded work relying on GCC. :)
jeffwass 9mo ago
Really interesting read, wonder how many other installs are using (and trapped into continuing to use) such obscure legacy software.
alkonaut 9mo ago
I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years. The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded. A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.
- spicyjpeg 9mo ago
  Plenty of low-volume industrial software has never really moved on from security dongles. Most modern arcade games for instance still rely on a USB dongle to decrypt game files [1], though nowadays they typically also come with an additional layer of TPM-backed encryption as well as always online DRM (many of them are region locked and operate on a revenue share contract, where the owner has to pay a per-play fee to the game manufacturer). These measures typically work well against piracy in the markets the game is officially distributed in (mainly Japan), but end up being cracked anyway once the game is popular enough that foreign arcades and private owners start importing older decommissioned cabinets and create demand for a way to get them running again without depending on the manufacturer's servers. [1]: https://mon.im/2017/12/konami-arcade-drm https://mon.im/2017/12/konami-arcade-drm
potatomaseat9 9mo ago
Its insane this things still works after 40 year old and someone now able to cracked it down
yesturi 9mo ago
It is interesting that the vendor adapts the hardware token and then makes it weak on the software side. I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all. [0] https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/ https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/
nu11ptr 9mo ago
> If we look at segment 0800, we see the smoking gun: in and out instructions, meaning that the copy-protection routine is definitely here, and best of all, the entire code segment is a mere 0x90 bytes, which suggests that the entire routine should be pretty easy to unravel and understand. For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Maybe this was a primitive form of obfuscation from those early days, which is now confusing Reko and preventing it from associating this chunk of code with the rest of the program… who knows. in/out instructions wouldn't have a C equivalent. My assumption would be it only translates instructions that a C compiler would typically create.
- kevincox 9mo ago
  I would still hope for it to translate most of the code with a couple of asm blocks. But maybe the density of them was too high and some heuristic decided against it?
  - jfyi 9mo ago
    It would have been an interesting ending to replace the instructions and see if Reko could be made to output code for the function.
Piraty 9mo ago
well done. this brought up fond memories of crackme communities in the early web... looking at asm callgraphs in ollydbg ... I just found my +20y old patch.exe that 'NOP's the correct address of a popular windows archive handling software just to get rid of its nag screen ;-)
doctor_blood 9mo ago
Today on "Hacker" News: a third of the commenters wring their hands and question the morality and legality of subverting copy protection on software almost half a century old.
- kstrauser 9mo ago
  To be fair, I might question the legality of it, although from a purely academic perspective. Like, exactly how illegal could it be, and are there any possible paths of it actually being enforced? That’s an interesting conversation to have. In practice, I couldn’t care less and it’s obviously morally OK.
- TMWNN 9mo ago
  There is no legality to debate. As of 2003 there is a DMCA exemption for "computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete". <https://en.wikipedia.org/wiki/Video_game_preservation#Legal_issues https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>
andyjohnson0 9mo ago
> For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Perhaps an indication that the code in that segment was hand-written in assembly language rather than C?
- jasomill 9mo ago
  Probably just due to the fact that nothing in the standard C language maps to the x86 IN and OUT instructions for reading and writing I/O ports, though MS-DOS-era compilers supplied macros or library functions to use them (inp, inpw, outp, and outpw in Microsoft C, for example).
ForHackernews 9mo ago
Searching for RPG compilers, I found this IBM notice: https://www.ibm.com/support/pages/osvs-rpg-ii-compiler110-withdrawal-notification https://www.ibm.com/support/pages/osvs-rpg-ii-compiler110-wi... General Availability 02-Nov-1981 , 281-999 No longer available for order, Withdrawn from Market 05-Dec-2022 , 922-053 Transition to Extended/Sustained or End of Support 30-Sep-2023 , 922-078 Completion of Extended, Sustained, Extension availability 30-Sep-2023 1981 to 2023 is a staggering run of support. That's why firms still buy IBM.
jijji 9mo ago
i used to use SoftIce to patch software the same way and sometimes just add a JMP to bypass the registration check completely
felineflock 9mo ago
I did something similar decades ago: ran on debug with and without the dongle, then compared the execution path to identify where exactly it deviated. Then replaced the "jump" with "nop" to prevent it from branching out when the dongle was absent. This was with an early version of Visual C++ and I knew only a little 8086 Assembly.
bloomingeek 9mo ago
Kind of related: I own and still use an HP laptop that came with 8 GB of DDR4 SDRAM and 16 GB of Intel Optane memory. When MS told all of us that Win 10 was moving away from support, I decided to format and install Ubuntu. I have lots of experience with Linux, so it was gonna be a piece of cake. Wrong! To my great surprise Linux wouldn't load, even after trying three different versions of Linux. After doing a massive search on the internet, I finally found a post that said I should crack open the case and remove the Optane chip, which I did. Presto, Linux was loaded and working fine!
SamBorick 9mo ago
I forwarded this to my dad who still works on RPG. This product is called "Software Sentinel": > It required an input key that was unique to our dongle series & our own code that was whatever we wanted. The reply was a hash of both values. > The last version we used was USB. They retired the parallel style long ago.
eloisant 9mo ago
At a time where games have shit like always online DRM, it's a bit reassuring to remember that software developers making the experience worse for their customers isn't new. You pay for software? You need to keep that big dongle plugged in your computer all the time! You pirate the same software? No need for any dongle!
- gguncth 9mo ago
  I worked in a research lab that had dongle protected software and it achieved its commercial purpose. It was installed on every computer but would only work with the dongle. Eventually people started fighting over the dongle so much that we got another license (and dongle).
- hypercube33 9mo ago
  Type the first word on page 28 of the manual. Use the decoder wheel (hopefully you didn't lose it) and put the code in to start the game. Copy protection always punishes the customer and not the pirate.
throwaway89201 9mo ago
> It’s possible that I haven’t fully understood the logic, and the copy protection will somehow re-surface in another way. They should be glad the copy protection is not more in the style of "The Games: Winter Challenge", where playing a pirated copy would make it subtly impossible to play many levels [1]. Would be 'fun' if the exported accounting data would contain all kinds of subtle errors. [1] https://mrwint.github.io/winter/writeup/writeup.html https://mrwint.github.io/winter/writeup/writeup.html
Graziano_M 9mo ago
What did the function that called into it do with the result? If it was a simple "if rv != 0xabcd goto fail" the patch could probably be simplified to just... nop a few bytes.
felineflock 9mo ago
A modern version of the old dongle seems to be the FIDO key (commonly known by the brand Yubikey), although it is for a different purpose than copy protection: anti-phishing/MFA authentication. Has that been defeated yet?
zoom6628 9mo ago
In the 80s I worked on BPCS, an early ERP system, and yes it was coded in RPG2, and RPG3. Mind blowingly hard to understand the source code but I credit my efforts then with later finding AWK so easy and logical. IBM had also just brought out the baby System36 which looked like a PC beige box but was actually a minified s/36 if I recall correctly. Didn't sell well. Then there was RPG for DOS which I heard of but didn't use. If the authors client had been using an RPG accounting system for 40 years then it might be BPCS and there were tools out there to convert RPG to other less traumatic languages. But fascinating article nonetheless and brought back memories of being an apps programmer. I also remember those dongles. Really fun when you had multiple apps with their own dongles and only one port.
- RaftPeople 9mo ago
  So did I. We joked that BPCS stood for: Better Programs Coming Soon It was actually a well designed and functional system, just too many bugs.
prirun 9mo ago
I wrote a Prime minicomputer emulator in 2005, mostly on a lark because I grew up on them in high school and college and they were pretty advanced for their time, with token ring networking, remote call file systems before NFS, lots of Multics-like features (the Prime founders were associated with Honeywell and MIT). I announced it on the Prime Usenet group and a guy wrote to say he was interested in using it for production, but had been burned before and wanted to make sure it worked. So I set him up a VM in my basement, he uploaded a bunch of his executables, and they all worked. I charged $1000/mo for the emulator. Since he was in the EU, I knew I wouldn't have a leg to stand on to get paid if they decided to stiff me, so I did some investigating into a Matrix dongle. It was pretty slick, and I coded up a copy protection scheme that allowed the emulator to run only when the dongle was inserted, and it contacted a license server in my basement to verify that it was allowed to run. To make sure my basement server wasn't a critical resource, I had the dongle setup like a battery that got periodically "charged": if the license server was down, the emulator kept running for up to N days on its local charge, giving me time to solve issues with the license server. This went on for a few years, but they were never happy they had to actually keep paying for the technology. I heard every excuse in the book about why they needed a backup dongle. I knew the real reason they wanted one was to hire someone to hack it, but unfortunately, that would mean removing it, and that would halt the emulator within 5 minutes. So they came up with excuses like: "Our state regulator requires us to have a backup computer system, so we need 2 dongles". No, you start computer 2, move the dongle, and you're fine. One time I heard from a guy who said he heard about the emulator from a Prime parts guy in Chicago I knew, and wanted to try it out for a large EU bank. I asked where to send it, and surprise - it was the same city as my other customer! So I call R in Chicago and asked him how the conversation went with this "banking" customer, and R says "It was kinda weird. He said he had a Prime with a failing disk drive, but when I asked what model drive he had, he didn't know. He kept asking if there was any other solution for him besides hardware until R says "Well, there's a guy that has an emulator", which the banking guy jumped on immediately. So I go to Google and lookup this address the banker gives me to send the dongle to, and it's a massage parlor! All in all, it was a good deal for me and a good deal for him, even if he wasn't happy about it. He was getting paid to support his own Prime software that he didn't have to port. But I learned my lesson as a youngin' about companies saying they will pay for something. I sold some printer/spooler minicomputer software in my early 20's and had a large investment bank (huge actually, as in everyone at the time would recognize their name) try it out for a month. They called and said they were processing the one-time license fee of $1500 but could I give them the access code early so they wouldn't have a disruption for a few days. I did it, and never got a dime from them. Hard lesson learned about being nice.

859 points by zdw 9mo ago

My father, an accountant, used to have a program like that, that used RPG and a dongle! Good times. Horrible donle.

> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.

cyanydeez 9mo ago
Yeah, my IT company bitshifts suspect files and provides the magic number. The protection just needs suficirntly complex.
opinologo 9mo ago
Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000. In most cases it was not much more difficult than what OP described.
- iamflimflam1 9mo ago
  I worked on some software that was used by telcos around that time - you were probably hacking our dongles :)
  - iamflimflam1 9mo ago
    Even more amazingly - that software I worked in is still being used and sold. Probably still has some of my ropey old code on it…
15155 9mo ago
Audience matters. Something intended to stop legitimate business consumers in a non tech industry requires substantially less sophistication than something built to withstand professional reverse engineers.
- dwattttt 9mo ago
  Locks are there to keep honest people honest. To expand on the saying, they're not there to be insurmountable. Just to be hard enough to make it easier to do things the right way.
  - nkrisc 9mo ago
    And often they’re there so no one can plausibly say they didn’t know what they were doing or stumbled into it accidentally. You can’t “accidentally” go through a door with a padlock on it. I’d guess it’s something similar with this dongle. You can’t “accidentally” run the software without the dongle.
- classichasclass 9mo ago
  Copy protection was also generally less robust for educational software, since it sold to generally law-abiding folks (parents, educators, etc.). Never saw Rapidlok or V-MAX! used for educational software on the Commodore 64, for example.
- Gigachad 9mo ago
  These days there would be an Aliexpress listing selling fake dongles within a month making it easy for the business customers too.
bri3d 9mo ago
In fairness, the decompiler didn't work on the protection method :) I think that both halves of the author's thesis are true: I bet that you could use this device in a more complicated way, but I also bet that the authors of the program deemed this sufficient. I've reversed a lot of software (both professionally and not) from that era and I'd say at least 90% of it really is "that easy," so there's nothing you're missing!
rustyhancock 9mo ago
The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access. More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case. I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty. What if the hardware has a LFSR in it and returns changing responses, and the caller can check them with a verify function else where that maintains a state and knows to expect the next in the sequence? We have far better tools today for sure, but we understood the system better back then. The right tool is sometimes better than a sharper tool as they say. Edit : I should add I'm aware it's very likely the actual reversing involved more steps and checks than Dimitrys blog which is narrowed to what worked.
- mobilio 9mo ago
  BPIO anyone?
- quercusa 9mo ago
  SoftICE was like magic back in the day.

ruleryak 9mo ago

Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you were trying to skip, find that string, hop over into assembly to see what triggered loading that, and then just alter the logic to jump over it when the time comes.

antonvs 9mo ago
> Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. I did that with dBASE III, which used ProLok "laser protection" from Vault Corporation - a signature burned onto the diskette with a laser. Back then, I found it amazing that Ashton-Tate actually spent money to contract with a copy protection company for something that could be so easily defeated by a teenager reading assembler. They could have easily just written the same kind of code themselves. An example of the power of marketing over substance. I was able to replicate that protection mechanism just by scratching a diskette with a pin. The "laser" was a meaninglessly advanced-sounding solution that added no value compared to any other means of damaging a diskette.
- foresto 9mo ago
  > I was able to replicate that protection mechanism just by scratching a diskette with a pin. How did you figure out where to scratch it? Was the laser mark visible on the original disk, or did you have to read the code and orient based on the diskette's index hole?
  - anyfoo 9mo ago
    Yes, it was apparently very visible: https://martypc.blogspot.com/2024/09/pc-floppy-copy-protection-vault-prolok.html https://martypc.blogspot.com/2024/09/pc-floppy-copy-protecti... But as I mentioned in a sibling comment, I’m not sure it was ever confirmed that it was really a laser that made that mark.

catlikesshrimp 9mo ago

Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey. I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars. The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!

bri3d 9mo ago
Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly. I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion, if you could reverse one you could reverse the other. But this concept was insanely prevalent for ~20 years or so. One of the biggest problems was not having enough ports. Some parallel port dongles tried to ignore communication with other dongles and actually had a port on the back; you'd make a "dongle snake" out of them. Once they moved to USB it was both easier and harder - you couldn't make the snake anymore, but you could ask people to use a hub when they ran out of ports.
- Joe_Cool 9mo ago
  P-CAD even had a dongle-caddy where you could plug in I think about 7 of them into to unlock different modules. I will check if I can find an image of it. EDIT: here is an old listing of it: https://www.ebay.com/itm/187748130737 https://www.ebay.com/itm/187748130737 Sadly the lid isn't open so you can't see what modules are installed.
- alexfoo 9mo ago
  > I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion ... Starting in '97 I worked on some software that used Elan License Manager (elmd) that then moved on to FlexLM in a major release. Requests for, and problems with, licensing were a considerable source of support tickets but I'm sure it also drove a reasonable amount of sales as customers wanted to play with component X but were prevented from doing so by a lack of license. When we were acquired by IBM we replaced the licensing code with lawyers and (threats of) audits. It didn't seem to harm the revenue. The product is still being maintained and sold. > ... if you could reverse one you could reverse the other. I can confirm it was quite easy with gdb to either skip past the license checks or, in the case of Elan licensing at least, call the license generation function from within the binary to generate whatever licenses for whatever features you liked. The "hardware identifiers" were a nightmare too. I ended up writing some code that would pull all of the necessary information (primary MAC, IP address, hostid for Sparc machines, hostname, etc) and give it to us in a base64 encoded blob, we also grabbed some CPU and memory information that proved quite useful in seeing how the software was deployed.

aizk 9mo ago

Very cool to read an article about windows 95 still being used in production - a nice contrast to the infinite AI hype cycle over everything. Tech may move fast in flashy areas but not in the more "boring" parts of the industry.

1970-01-01 9mo ago
The screenshots show the program was made for DOS. Very likely Windows was used just for network file sharing.
- RaftPeople 9mo ago
  Ya, RPG assumed character based IO so probably a safe bet that they just ported stuff that ran on IBM character based terminals and just made it run in DOS. (I worked in RPG in the 80's)
accrual 9mo ago
I knew of a Windows 95 host running virtualized in a corp environment until at least 2014 or so. It was surprisingly sturdy, I only had to remote into it once or twice when the old software it was running hung up on something. It was old medical software and we apparently had a couple clients still interfaced to it.
jojobas 9mo ago
Win95 is only 30 years old and runs natively on some modern hardware. Apparently there is important stuff still running in emulated PDP-11s, almost double the age.
- Joe_Cool 9mo ago
  It needs quite a few fixes to even run in a VM. But it can be done: https://github.com/JHRobotics/patcher9x https://github.com/JHRobotics/patcher9x
  - jojobas 9mo ago

dmitrygr 9mo ago

>Very importantly, there doesn’t seem to be any “input” into this routine. It doesn’t pop anything from the stack, nor does it care about any register values passed into it. Which can only mean that the result of this routine is completely constant! This is not necessarily a fair assumption (though it worked this time). It could be some sort of a rolling code, where the reply is not constant but changes, and remains verifiable. Example: garge door openers have no input from the garage, but the sent signal differs every button click, and the garage can verify its correctness

dfox 9mo ago
Unles the verification routine (eg. garage) keeps some state somewhere it has no way to prevent replays.
- deleted 9mo ago
  [deleted]
- dmitrygr 9mo ago
  i did not say replay was impossible. i said the statement in the article was overly broad, which it is. If it said "a single result could be hard-coded", it would be fine. but it said the function is constant, which it need not be. But even that need not be true. here is how you could design that dongle to require no persistent state on RX and still not allow simple replay. TX code: static u8 counter = 0; tmp = randU12() * 16 + (counter++); tmp2 = sha256(secret + tmp) & 0xffff; send32((tmp << 16) + tmp2) RX code: static u16 prevSeenCodes[16]; static u8 idx = 0; tmp = recv32(); tmp2 = tmp & 0xffff; tmp >>= 16; if (sha256(secret + tmp) & 0xffff != tmp2) fail(); if (tmp in prevSeenCodes) fail(); prevSeenCodes[15 & idx++] = tmp; now you need to replay at least a sequence of 16 codes that array is in ram and need not persist across program runs. dongle can be powered off or can be left on. all will work

sonixier 9mo ago

The company i work at has the same problem. We have some old mission-critical windows 2000 pc that runs the rpg compiler, with attached dongle. This gave me some clues on where to start - thanks author!

tclancy 9mo ago
Check out this comment too! https://news.ycombinator.com/item?id=46854885 https://news.ycombinator.com/item?id=46854885

dunham 9mo ago

Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it. The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.

zzzeek 9mo ago
my story of this is Atari Macro Assembler. The floppy had a specific sector that was damaged, and the loader would test this sector to ensure it was in fact damaged. this was obvious becuase whenever loading the floppy, you had to wait for one of those big "BZZT....BZZT" things where the 810 drive was trying to access a bad sector and giving up. I was able to disassemble maybe the first 30 bytes of the boot to see it checking this and doing the jmp. I just overwrote it with a single jmp and got not just a copy but much faster loading without the BZZTBZZT part.
- TMWNN 9mo ago
  I've heard that Happy Drive singlehandedly destroyed the commercial viability of the Atari 8-bit software market, because it was so widespread and is so powerful at duplicating games.

accrual 9mo ago

Fun journey! It would be fascinating to see what's inside the dongle. I wonder if it's programmable or just a simple circuit.

byb 9mo ago
Yes, a neat follow-up would be to clone the copy protection device with a cheap microcontroller. A lot of these devices were filled with epoxy, but it would be funny to find out these were all just 1Kbit EEPROMs. Such an article could give some background on parallel port communication, EEPROMs, and how regular printer data was passed through.

izme 9mo ago

This takes me back. There exist emulators for these dongles as well, you run the a dumper with the dongle attached and load the program and it makes a dump file which you then use in the emulator. I had to do this for a company so they could continue to use their old specialised Win98 software on modern computers using Dosbox and an emulator.

nsoonhui 9mo ago

I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand. Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade. Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates. [0]: https://mes100.com https://mes100.com

huflungdung 9mo ago
[dead]
SecretDreams 9mo ago
> which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users. I don't condone piracy, but I also don't condone SaaS.
- nsoonhui 9mo ago
  In a perfect world, I would have agreed with you, even if it's diametrically opposite to my interest as a software developer cum business owner. But in an imperfect world whereby our dependencies ( software components that we use) and platforms that we need to build/rely on ( like Civil 3D) do charge us on annual basis, and that some of users expect perpetual bug fixes from us, with or without a support contract of sorts, SaaS seems to only way to go for our sustainability.

jedberg 9mo ago

> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch? Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid. This was basically the 80s version of that.

tclancy 9mo ago
I mean, we used to turn single-sided 5 1/4" disks for the C64 into double-sided disks through the use of cutting-edge technology. Literally. I was fancy and got a $5 hole punch built for the job, but scissors worked too. Fast Hack'em may still be my favorite piece of software ever.

huflungdung 9mo ago

[dead]

engelo_b 9mo ago

[dead]

burnt-resistor 9mo ago

And they probably could've just used Neverlock Business which cracks zillions of programs.

DANmode 9mo ago

> Is this really worthy of a patent? You have no idea how deep this rabbit hole goes. Patents are barely better than copyright, as far as society net-positive.

deleted 9mo ago

[deleted]

odomus 9mo ago

Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?

direwolf20 9mo ago
It's illegal.
- NoiseBert69 9mo ago
  https://eur-lex.europa.eu/eli/dir/2009/24/oj/eng https://eur-lex.europa.eu/eli/dir/2009/24/oj/eng Directive 2009/24/EC, Article 5 + Article 6 Under special circumstances it's legal within the EU do do this. And removing a freaking old copy protection dongle to allow emulation of the software you legally are allowed to use falls under this.
TheDong 9mo ago
Once it hits 70 years from the lifetime of the author (so probably another 80 or 90 years from now) and is in public domain, that might change things since there will no longer be copyright being protected. In terms of copyright terms, this software is still pretty young, not even halfway to public domain. It's disrespectful to call it "very old".
- direwolf20 9mo ago
  Defeating a copy protection measure is illegal, even if the copy protection measure is not copyrighted.
  - TheDong 9mo ago
    I'm not talking about the copy protection, but the software being protected. Surely if the work being protected isn't copyrighted, there's nothing to circumvent in terms of the DMCA?

Tempest1981 9mo ago

So what hardware would be inside the dongle? Would a small PAL be enough? 22V10? Maybe use a few registers to delay the values written by a few cycles, mixing in some decode logic? (Something cheaper than a microcontroller, I'm guessing... due to cost)

asyncadventure 9mo ago

[dead]

zabzonk 9mo ago

I think I remember hacking some of the copy-protection out of a version of Tetris using the Borland debugger. I definitely patched mouse support into a Chris Crawford "Battle of the Bulge" game using it (for my rather tricky platform). That was a good debugger, and probably the last one I have used much - prefer logging/printing for stuff I write myself. I remember my Dragon 32 (6809, Color Computer clone) had a dongle you plugged into the joystick port to protect a really crap game - Jumping Knights? I never tried to defeat it.

charcircuit 9mo ago

>The only evidence for the existence of this company is this record of them exhibiting their wares at SIGGRAPH conferences in the early 1990s, as well as several patents issued to them, relating to software protection. There is also their webpage for ordering PC RPG II. The company address is a residential house. https://web.archive.org/web/20010802153755/http://home.netcom.com/~softwest/rpg.htm https://web.archive.org/web/20010802153755/http://home.netco...

idogs 9mo ago
Apparently there is a Noel Vasquez, now in his late 80s, living at that address. Might be the guy to contact for further information, if he's still around.

firecall 9mo ago

Cracking this dongle; wouldn't this be a federal offence in the US? Not being snarky - genuine question! I am not from the US :-)

userbinator 9mo ago
It probably is; and so is going 10 over the speed limit.
direwolf20 9mo ago
Yes and in every country that adopted a copyright treaty with the US, so all of them except China
- garaetjjte 9mo ago
  While WIPO mandates similar wording not every implementation makes software-only patch criminal.
TMWNN 9mo ago
>Cracking this dongle; wouldn't this be a federal offence in the US? No. As of 2003 there is a DMCA exemption for "computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete". <https://en.wikipedia.org/wiki/Video_game_preservation#Legal_issues https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>

seblon 9mo ago

Yeah, Software protection was very naive in the beginning. Fun fact: I owned a windows 3.11 for workgroup UPGRADE disc collection, it was clearly explained and also enforced from the setup installer. So, no previous installed win 3.0 == upgrade installer will fail. The fix: just create an empty Textfile named win.com at any place - the installer simple scans the WHOLE disk just for this existing filename. Next fun fact: in reality, the Upgrade contained the full installation, no only a delta. Men, software was so simple these days....

mikepurvis 9mo ago
I have a childhood memory of my dad buying a shrink-wrapped copy of the Windows 3.1 Upgrade that was supposed to allow any installation of "3.0 or earlier" to become Win 3.1. it turned out when we actually tried it it only accepted 3.x though. [1] I think he ended up pirating a 3.x install from a friend and running the upgrade on to of that; felt pretty morally clear given what the box had advertised. [1]: eg https://www.ebay.com/itm/376080245422 https://www.ebay.com/itm/376080245422
- goldfishgold 9mo ago
  Love the Ebay link. Where has that been sitting for the last 30 years?
  - mikepurvis 9mo ago
    Right?? Even if it's potentially a re-shrink, just the box period still existing in that condition is notable, especially for such a "plain" design; it's not like the full-colour Windows 95 ones for which there are probably thousands of unopened copies sitting in collectors' vaults.

smoyer 9mo ago

I designed a security dongle a long time ago ... Used properly, it did rotations and XORs like a CRC. You could definitely make it hard to defeat but it was still ultimately deterministic.

algeni 9mo ago

[flagged]

Sophira 9mo ago

The fact that the software and hardware is evidently still in use at some companies gives me pause about whether releasing it in a cracked form publicly after having published it on a personal website would be a good idea. Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in! All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue. If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.

mrandish 9mo ago
Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one. Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unknown software apps to preserve. Software sold for Windows 98 up to 2001 (so recent as to barely be considered 'vintage') with so little online footprint means it must have been incredibly obscure. No ads or reviews from magazines or even newsletters means there's a good chance it was a one or two person part-time, home-based business and the product had hundreds or maybe even just dozens of users. 1998-2001 was the hottest time ever for PC software. I worked in marketing Windows software during this period. To have any commercial Windows software product actively available for sale in the late 90s with no surviving footprint would almost require intentional effort to stay unknown. No press releases mailed. No review copies sent. No shows or conferences attended (exhibitor listings are searchable online now). There were much older niche vertical software programs for much more obscure platforms which we know sold less than a hundred copies ever, yet still have a larger online footprint than this program. The OP de-protecting and archiving this previously unknown commercial program represents quite a notable find in the preservation community.
- 9mo ago

51Cards 9mo ago

I was hired in the early 90's by a collection of franchises for a home care company. The privately owned head office self-developed and distributed required monthly updates to the only software franchises were permitted to run their business. The monthly updates (floppies) reset the license for another month at each location. After years of problems, poor support, and in a couple cases offices getting shut down because head office just "didn't like them anymore", they banded together to sue the owners (one of which developed the software). I did IT work for a couple of the offices and was already familiar with maintaining the software / systems. They hired me to bypass the licensing code which was a lot of fun to figure out. In the end I wrote a DOS based license generator each office had that could update their software by just getting a code over the phone for the upcoming month (or any date for 365 days). A few years later once the lawsuit settled and the company broke apart we issued a patch for the software to remove the license check completely. I should fire up DOSBox sometime so I can play with that old software again.

boarsofcanada 9mo ago

I wrote RPG II code in the 80s and helped the company I was working part-time for transition to another one of these S/36 emulation environments on the PC in the 90s. The software we used was made by the very generically named California Software Products. It worked well enough and allowed the company to run until the founder retired and folded the business.

dhosek 9mo ago

I remember reading an ad in one of the 90s PC magazines that attributed the dongle to an inventor named “Don Gull.” I was fortunate enough to never have to use a hardware dongle, but I remember hearing about their persistence into the twenty-first century. I would imagine that most of them were as ridiculously simple as this one was.

weinzierl 9mo ago

These dongles used to be ubiquitous and they broke all the time. As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared) Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing. So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing. Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home. Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.

l33tman 9mo ago
We had proper licenses for all PADS seats at my previous work, but all the users always installed the cracked versions because it was unusable with the dongle.
rwmj 9mo ago
I remember when I worked in an electronics lab one of our EEs built several "dongle buses", a parallel port "bus" that you could plug up to about half a dozen dongles in, and it was frequently fully populated on the machines we used for CAD and PCB layout. An early version of PADS (PADS2000?) was one of the applications we used.
xxr 9mo ago
>they broke all the time While I was reading the OP I kept thinking about how an accounting firm's entire ability to do business rested on the continued functioning of a parallel-port dongle. I just have to imagine that they had a box full of these.

userbinator 9mo ago

For some reason, Reko was not able to decompile this code into a C representation That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler. In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program. This reminds me of the classic Ken Thompson attack.

sedatk 9mo ago

Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.

unnouinceput 9mo ago
Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk? The reason why this is not more common is because the more iterations you do, the harder is to create those iterations, which means you add a lot of time to create the protection which means that you need to have a finished code, and code is always modified by production team, so managers see this overtime unnecessary.
- 71bw 9mo ago
  >Also to this day there is no crack to Diablo 3 Look into Blizzless :-)
  - unnouinceput 9mo ago
    Looking into Issues, reading 48 and just scrolling at beginning: "Local and LAN systems talk, but will not authenticate" / "Multiplayer Game Problem" / "cannot restore DB" / "Items stats do not reflect the game class"...etc, just to name a few. Yeah, I really like to get frustration when I am gaming due to unsupported and canceled project /s
- self_awareness 9mo ago
  > The reason why this is not more common The real reason is that executable modifying its own code is often flagged by AV, or the OS itself, as an "insecure" activity. Since self-modification is used in attacks and exploits, good protections rarely use it now. It's impossible to use codesigns with self-modified code.

bitwize 9mo ago

This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.

urbandw311er 9mo ago
…and?
TMWNN 9mo ago
No. As of 2003 there is a DMCA exemption for "computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete". <https://en.wikipedia.org/wiki/Video_game_preservation#Legal_issues https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>

RagnarD 9mo ago

Fun hack, sure, but why on earth isn't the focus on porting the accounting data to a new, currently supported accounting system?

thenthenthen 9mo ago

As a hardware guy I would first start with opening up the dongle, but hey! Still very curious to see whats inside!

medwards666 9mo ago
I always thought the internals were encased in potting compound for these things to prevent exactly this scenario (certainly the ones I had for LightWave back in the day were)...
alibarber 9mo ago
Yes my first thought would be to probe the parallel lines and see what went in and came out, but this approach was just as interesting!

cricalix 9mo ago

Tangential to this was the existence of California Software Product's "Baby/36" software. My father was a 36/400 programmer and sysadmin, and in his spare time used Baby/36 to write software for local businesses. I have vague memories of parallel port dongles being involved back then too. Don't think he mandated their use, was more a "framework" requirement.

shevy-java 9mo ago

This is kind of like archaeology - just, software archaeology.

maximgeorge 9mo ago

[dead]

taylorportman 9mo ago

Often these dongles were just a single resistor 'circuit'

direwolf20 9mo ago
Like a warded lock. It only keeps honest people honest — and proves intent to not pay.

giamma 9mo ago

This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version. So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation. [0] https://en.wikipedia.org/wiki/Executable_compression https://en.wikipedia.org/wiki/Executable_compression

notpushkin 9mo ago
My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.
- andreaven 9mo ago
  you were lucky it was an unsigned var.. otherwise you could have gifted a very nasty trial time of -1 minute! a pretty nice anti-addiction feature :-)
  - notpushkin 9mo ago
    Hahaha. On a second thought I think it was a bit trickier and did some weird math to obfuscate the value (probably something simple, like XOR). So yeah, my actual fix was to mash buttons until I got a big enough number :D
- davidwritesbugs 9mo ago
  Hope she knows she still only has 3million trial days left

3uruiueijjj 9mo ago

USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so. In our case, the copy protection would still be as easy to bypass as the one in the article.

u1hcw9nx 9mo ago
You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't. Actual dongles with encryption and processor cost only $15 in batches of 100.
- cricalix 9mo ago
  UnRaid does a variant of this; license is tied to the serial of the USB drive. It barely writes to the drive, so wear isn't meant to be much of an issue.

soanvig 9mo ago

I want to read the rest of the migration story

unwind 9mo ago

Just a few months back I worked in embedded development on a project and there was a physical dongle to unlock the compiler, which was surprising during on-boarding as I've spent years doing commercial embedded work relying on GCC. :)

jeffwass 9mo ago

Really interesting read, wonder how many other installs are using (and trapped into continuing to use) such obscure legacy software.

alkonaut 9mo ago

I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years. The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded. A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.

spicyjpeg 9mo ago
Plenty of low-volume industrial software has never really moved on from security dongles. Most modern arcade games for instance still rely on a USB dongle to decrypt game files [1], though nowadays they typically also come with an additional layer of TPM-backed encryption as well as always online DRM (many of them are region locked and operate on a revenue share contract, where the owner has to pay a per-play fee to the game manufacturer). These measures typically work well against piracy in the markets the game is officially distributed in (mainly Japan), but end up being cracked anyway once the game is popular enough that foreign arcades and private owners start importing older decommissioned cabinets and create demand for a way to get them running again without depending on the manufacturer's servers. [1]: https://mon.im/2017/12/konami-arcade-drm https://mon.im/2017/12/konami-arcade-drm

potatomaseat9 9mo ago

Its insane this things still works after 40 year old and someone now able to cracked it down

yesturi 9mo ago

It is interesting that the vendor adapts the hardware token and then makes it weak on the software side. I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all. [0] https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/ https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/

nu11ptr 9mo ago

> If we look at segment 0800, we see the smoking gun: in and out instructions, meaning that the copy-protection routine is definitely here, and best of all, the entire code segment is a mere 0x90 bytes, which suggests that the entire routine should be pretty easy to unravel and understand. For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Maybe this was a primitive form of obfuscation from those early days, which is now confusing Reko and preventing it from associating this chunk of code with the rest of the program… who knows. in/out instructions wouldn't have a C equivalent. My assumption would be it only translates instructions that a C compiler would typically create.

kevincox 9mo ago
I would still hope for it to translate most of the code with a couple of asm blocks. But maybe the density of them was too high and some heuristic decided against it?
- jfyi 9mo ago
  It would have been an interesting ending to replace the instructions and see if Reko could be made to output code for the function.

Piraty 9mo ago

well done. this brought up fond memories of crackme communities in the early web... looking at asm callgraphs in ollydbg ... I just found my +20y old patch.exe that 'NOP's the correct address of a popular windows archive handling software just to get rid of its nag screen ;-)

doctor_blood 9mo ago

Today on "Hacker" News: a third of the commenters wring their hands and question the morality and legality of subverting copy protection on software almost half a century old.

kstrauser 9mo ago
To be fair, I might question the legality of it, although from a purely academic perspective. Like, exactly how illegal could it be, and are there any possible paths of it actually being enforced? That’s an interesting conversation to have. In practice, I couldn’t care less and it’s obviously morally OK.
TMWNN 9mo ago
There is no legality to debate. As of 2003 there is a DMCA exemption for "computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete". <https://en.wikipedia.org/wiki/Video_game_preservation#Legal_issues https://en.wikipedia.org/wiki/Video_game_preservation#Legal_...>

andyjohnson0 9mo ago

> For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Perhaps an indication that the code in that segment was hand-written in assembly language rather than C?

jasomill 9mo ago
Probably just due to the fact that nothing in the standard C language maps to the x86 IN and OUT instructions for reading and writing I/O ports, though MS-DOS-era compilers supplied macros or library functions to use them (inp, inpw, outp, and outpw in Microsoft C, for example).

ForHackernews 9mo ago

Searching for RPG compilers, I found this IBM notice: https://www.ibm.com/support/pages/osvs-rpg-ii-compiler110-withdrawal-notification https://www.ibm.com/support/pages/osvs-rpg-ii-compiler110-wi... General Availability 02-Nov-1981 , 281-999 No longer available for order, Withdrawn from Market 05-Dec-2022 , 922-053 Transition to Extended/Sustained or End of Support 30-Sep-2023 , 922-078 Completion of Extended, Sustained, Extension availability 30-Sep-2023 1981 to 2023 is a staggering run of support. That's why firms still buy IBM.

jijji 9mo ago

i used to use SoftIce to patch software the same way and sometimes just add a JMP to bypass the registration check completely

felineflock 9mo ago

I did something similar decades ago: ran on debug with and without the dongle, then compared the execution path to identify where exactly it deviated. Then replaced the "jump" with "nop" to prevent it from branching out when the dongle was absent. This was with an early version of Visual C++ and I knew only a little 8086 Assembly.

bloomingeek 9mo ago

Kind of related: I own and still use an HP laptop that came with 8 GB of DDR4 SDRAM and 16 GB of Intel Optane memory. When MS told all of us that Win 10 was moving away from support, I decided to format and install Ubuntu. I have lots of experience with Linux, so it was gonna be a piece of cake. Wrong! To my great surprise Linux wouldn't load, even after trying three different versions of Linux. After doing a massive search on the internet, I finally found a post that said I should crack open the case and remove the Optane chip, which I did. Presto, Linux was loaded and working fine!

SamBorick 9mo ago

I forwarded this to my dad who still works on RPG. This product is called "Software Sentinel": > It required an input key that was unique to our dongle series & our own code that was whatever we wanted. The reply was a hash of both values. > The last version we used was USB. They retired the parallel style long ago.

eloisant 9mo ago

At a time where games have shit like always online DRM, it's a bit reassuring to remember that software developers making the experience worse for their customers isn't new. You pay for software? You need to keep that big dongle plugged in your computer all the time! You pirate the same software? No need for any dongle!

gguncth 9mo ago
I worked in a research lab that had dongle protected software and it achieved its commercial purpose. It was installed on every computer but would only work with the dongle. Eventually people started fighting over the dongle so much that we got another license (and dongle).
hypercube33 9mo ago
Type the first word on page 28 of the manual. Use the decoder wheel (hopefully you didn't lose it) and put the code in to start the game. Copy protection always punishes the customer and not the pirate.

throwaway89201 9mo ago

> It’s possible that I haven’t fully understood the logic, and the copy protection will somehow re-surface in another way. They should be glad the copy protection is not more in the style of "The Games: Winter Challenge", where playing a pirated copy would make it subtly impossible to play many levels [1]. Would be 'fun' if the exported accounting data would contain all kinds of subtle errors. [1] https://mrwint.github.io/winter/writeup/writeup.html https://mrwint.github.io/winter/writeup/writeup.html

Graziano_M 9mo ago

What did the function that called into it do with the result? If it was a simple "if rv != 0xabcd goto fail" the patch could probably be simplified to just... nop a few bytes.

felineflock 9mo ago

A modern version of the old dongle seems to be the FIDO key (commonly known by the brand Yubikey), although it is for a different purpose than copy protection: anti-phishing/MFA authentication. Has that been defeated yet?

zoom6628 9mo ago

In the 80s I worked on BPCS, an early ERP system, and yes it was coded in RPG2, and RPG3. Mind blowingly hard to understand the source code but I credit my efforts then with later finding AWK so easy and logical. IBM had also just brought out the baby System36 which looked like a PC beige box but was actually a minified s/36 if I recall correctly. Didn't sell well. Then there was RPG for DOS which I heard of but didn't use. If the authors client had been using an RPG accounting system for 40 years then it might be BPCS and there were tools out there to convert RPG to other less traumatic languages. But fascinating article nonetheless and brought back memories of being an apps programmer. I also remember those dongles. Really fun when you had multiple apps with their own dongles and only one port.

RaftPeople 9mo ago
So did I. We joked that BPCS stood for: Better Programs Coming Soon It was actually a well designed and functional system, just too many bugs.

prirun 9mo ago

I wrote a Prime minicomputer emulator in 2005, mostly on a lark because I grew up on them in high school and college and they were pretty advanced for their time, with token ring networking, remote call file systems before NFS, lots of Multics-like features (the Prime founders were associated with Honeywell and MIT). I announced it on the Prime Usenet group and a guy wrote to say he was interested in using it for production, but had been burned before and wanted to make sure it worked. So I set him up a VM in my basement, he uploaded a bunch of his executables, and they all worked. I charged $1000/mo for the emulator. Since he was in the EU, I knew I wouldn't have a leg to stand on to get paid if they decided to stiff me, so I did some investigating into a Matrix dongle. It was pretty slick, and I coded up a copy protection scheme that allowed the emulator to run only when the dongle was inserted, and it contacted a license server in my basement to verify that it was allowed to run. To make sure my basement server wasn't a critical resource, I had the dongle setup like a battery that got periodically "charged": if the license server was down, the emulator kept running for up to N days on its local charge, giving me time to solve issues with the license server. This went on for a few years, but they were never happy they had to actually keep paying for the technology. I heard every excuse in the book about why they needed a backup dongle. I knew the real reason they wanted one was to hire someone to hack it, but unfortunately, that would mean removing it, and that would halt the emulator within 5 minutes. So they came up with excuses like: "Our state regulator requires us to have a backup computer system, so we need 2 dongles". No, you start computer 2, move the dongle, and you're fine. One time I heard from a guy who said he heard about the emulator from a Prime parts guy in Chicago I knew, and wanted to try it out for a large EU bank. I asked where to send it, and surprise - it was the same city as my other customer! So I call R in Chicago and asked him how the conversation went with this "banking" customer, and R says "It was kinda weird. He said he had a Prime with a failing disk drive, but when I asked what model drive he had, he didn't know. He kept asking if there was any other solution for him besides hardware until R says "Well, there's a guy that has an emulator", which the banking guy jumped on immediately. So I go to Google and lookup this address the banker gives me to send the dongle to, and it's a massage parlor! All in all, it was a good deal for me and a good deal for him, even if he wasn't happy about it. He was getting paid to support his own Prime software that he didn't have to port. But I learned my lesson as a youngin' about companies saying they will pay for something. I sold some printer/spooler minicomputer software in my early 20's and had a large investment bank (huge actually, as in everyone at the time would recognize their name) try it out for a month. They called and said they were processing the one-time license fee of $1500 but could I give them the access code early so they wouldn't have a disruption for a few days. I did it, and never got a dime from them. Hard lesson learned about being nice.