MS-DOS game copy protection and cracks

dosdays.co.uk

52 points·fooqux··4 comments

Late 90s and early 2000s were the best days for Reverse Engineering. +Fravia, Woodmann's forum and SoftIce flickers in the back of my memory...

And yes, many of the old-school (and entry level) tuts were from the DOS era. ORC's?

The protection scheme where they used a laser to burn a small hole in a specific sector of the disk is just mind boggling to me. How'd they figure out where to make the hole?

5.25" disks include a synchronization index hole read by the drive and 3.25" disks align using a hub mechanism. These wouldn't be too difficult to align factory-duplicated floppies in a custom jig that includes a laser or similar small, focused heating element.

The risk of this style of approach is that it must be compatible with every single drive manufactured combined with every floppy controller because it must produce exactly the same OS-level error pathology with intentional physical damage. (Another approach is inducing low level MFM errors without physically modifying the media but it requires special hardware.)

Also, as with physical hasps (dongles), copy protection magic codes, install floppy disk writable decrementing counters, damaged sector key disks, and pretty much every other technique, these checks always exist somewhere as binary instructions in the executable and can be located with a debugger and/or hex editor through binary search and/or call stack tracing heuristics in a relatively short time.

> The risk of this style of approach is that it must be compatible with every single drive manufactured combined with every floppy controller because it must produce exactly the same OS-level error pathology with intentional physical damage.

As long as it works for most of the marketplace, support can work out something for the 0.1% when they call or write in.

Reply on news.ycombinator.com