1 Topic by sarami (edited by sarami 2015-12-26 09:53:07)

  • Registered: 2011-02-20
  • Posts: 1,745

I have a question about Old SecuRom.

http://support.alcohol-soft.com/knowled … b+Channels

Subchannel includes Data Subchannel and Audio Subchannel, where a disc saves
additional information other than normal data and tracks.

Since not all CD-ROMs/ CD-RWs support subchannel, some game and music vendors save the "fingerprint information" in the two sub channels.
Therefore, if user wishes backup the disc, it is considered as failed if these data do not correctly backup.

The manufacturers that use such measure of CD copy protection include Sony's Securom ("fingerprint " has been saved in Data Subchannel), New Securom ("fingerprint" has been saved in Data and Audio Subchannels), LibCrypt (Sony's PlayStation) and LaserLock. The data saved in Subchannels includes 16bytes (such as Securom and New Securom) and 96bytes (LibCript).

Therefore, the performance of CD-ROM/ CD-RW can read the two Subchannels
include: a. Raw+96, b. Raw+16, c.Raw (the data on Subchannels are unreadable), d. none (both the data on Subchannels and normal bad blocks are unreadable).

http://www.gameburnworld.com/protections_securom.shtml

SecuRom being the first protections used commercially is also one of the oldest protections widely used.  Developed by Sony Technologies. Unlike the SafeDisc protection, the SecuRom protection stores its digital ID in the SubChannel Data of the original CD. SecuRom protected CD's don't contain any unreadable sectors. During Sony DADC痴 mastering process an electronic fingerprint is applied onto the glass master which assigns a unique number to each individual CD. SecuRom is also used on some Playstation titles. For more information on how this protection was developed visit the SecuRom website

http://web.archive.org/web/201506062012 … ecurom.htm

SECUROM:

Securom © Sony Corporation

Check for these files on the CD or in the installation dir:

CMS16.DLL
CMS_95.DLL
CMS_NT.DLL
Or check for this logo on the CD's inner ring:



There's a new version of Securom called Securom NEW (used in e.g. UT2003, V-Rally 2, Diablo II, Ground Control, Music 2000, Soulbringer). There are NO cms*.* files anymore and on some CDs there isn't even the DADC-logo.
The new Securom files are:

SINTF32.DLL
SINTF16.DLL
SINTFNT.DLL
They are copied to Windows system or temp directory during installation!

CloneCD , Alcohol, the Blindread/Blindwrite suite and DiscJuggler 3.x are programs being able to do perfect copies of Securom (Old) protected CDs. In opposite to Safedisc it's easy to do a 1:1 copy of a Securom protected CD - no unreadable sectors. Anyway this copy won't run in many cases. The reason is Securom doesn't use unreadable sectors to verify if the CD is original, it uses data stored in the CD P/Q-subchannel.

If you don't have hardware being able to read & write the 16 byte PQ subchannel data needed to do a perfect copy of securom protected CDs just do a 'normal' 1:1 copy of the CD using one of the burning programs here and use DAEMON Tools to play. Just enable the Securom emulation in DAEMON Tools and your copy will run like the original.

Do you know which sector there is "fingerprint ", "digital ID"?

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2008-03-02
  • Posts: 810

Maybe you can find the answer in the generic securom patches?: http://www.cdmediaworld.com/hardware/cd … urom.shtml

3 Reply by sarami (edited by sarami 2015-12-25 20:19:00)

  • Registered: 2011-02-20
  • Posts: 1,745

I bought some disc and test it.

FIFA 99
http://redump.org/disc/23791/

Either 2 bits or none from both MSFs are modified, CRC-16 is recalculated and XORed with 0x0080.

LBA[040179, 0x09cf3], Track[01]: Intentional error exists. CRC-16 is recalculated:[866a] and XORed with 0x0080:[86ea]. Sub[12-23]: 41 01 01 00 55 54 00 18 57 54 86 ea
LBA[040275, 0x09d53], Track[01]: Intentional error exists. CRC-16 is recalculated:[4984] and XORed with 0x0080:[4904]. Sub[12-23]: 41 01 01 08 57 40 00 08 59 02 49 04
LBA[040314, 0x09d7a], Track[01]: Intentional error exists. CRC-16 is recalculated:[f87d] and XORed with 0x0080:[f8fd]. Sub[12-23]: 41 01 01 09 57 39 00 88 59 39 f8 fd
LBA[040498, 0x09e32], Track[01]: Intentional error exists. CRC-16 is recalculated:[f5cc] and XORed with 0x0080:[f54c]. Sub[12-23]: 41 01 01 08 5d 73 00 09 21 73 f5 4c
LBA[040537, 0x09e59], Track[01]: Intentional error exists. CRC-16 is recalculated:[a0fd] and XORed with 0x0080:[a07d]. Sub[12-23]: 41 01 01 09 00 3f 00 09 02 27 a0 7d
LBA[040679, 0x09ee7], Track[01]: Intentional error exists. CRC-16 is recalculated:[50c6] and XORed with 0x0080:[5046]. Sub[12-23]: 41 01 01 09 22 29 00 09 00 29 50 46
LBA[040797, 0x09f5d], Track[01]: Intentional error exists. CRC-16 is recalculated:[f611] and XORed with 0x0080:[f691]. Sub[12-23]: 41 01 01 09 03 73 00 09 05 f2 f6 91
LBA[040836, 0x09f84], Track[01]: Intentional error exists. CRC-16 is recalculated:[bdba] and XORed with 0x0080:[bd3a]. Sub[12-23]: 41 01 01 0b 04 36 00 49 06 36 bd 3a
LBA[041020, 0x0a03c], Track[01]: Intentional error exists. CRC-16 is recalculated:[9265] and XORed with 0x0080:[92e5]. Sub[12-23]: 41 01 01 09 0e 70 00 09 18 70 92 e5
LBA[041059, 0x0a063], Track[01]: Intentional error exists. CRC-16 is recalculated:[ffb9] and XORed with 0x0080:[ff39]. Sub[12-23]: 41 01 01 09 07 24 00 09 09 3c ff 39
LBA[041201, 0x0a0f1], Track[01]: Intentional error exists. CRC-16 is recalculated:[0e4a] and XORed with 0x0080:[0eca]. Sub[12-23]: 41 01 01 09 49 26 00 09 13 26 0e ca
LBA[041230, 0x0a10e], Track[01]: Intentional error doesn't exist.
LBA[041306, 0x0a15a], Track[01]: Intentional error doesn't exist.
LBA[041447, 0x0a1e7], Track[01]: Intentional error exists. CRC-16 is recalculated:[e7a6] and XORed with 0x0080:[e726]. Sub[12-23]: 41 01 01 09 12 45 00 09 14 07 e7 26
LBA[041695, 0x0a2df], Track[01]: Intentional error exists. CRC-16 is recalculated:[5b3a] and XORed with 0x0080:[5bba]. Sub[12-23]: 41 01 01 09 11 70 00 09 37 70 5b ba
LBA[041879, 0x0a397], Track[01]: Intentional error exists. CRC-16 is recalculated:[7afc] and XORed with 0x0080:[7a7c]. Sub[12-23]: 41 01 01 09 18 39 00 09 20 21 7a 7c
LBA[041918, 0x0a3be], Track[01]: Intentional error exists. CRC-16 is recalculated:[ae44] and XORed with 0x0080:[aec4]. Sub[12-23]: 41 01 01 29 18 68 00 0d 20 68 ae c4
LBA[042060, 0x0a44c], Track[01]: Intentional error exists. CRC-16 is recalculated:[6877] and XORed with 0x0080:[68f7]. Sub[12-23]: 41 01 01 49 20 60 00 0b 22 60 68 f7
LBA[042306, 0x0a542], Track[01]: Intentional error exists. CRC-16 is recalculated:[4f2b] and XORed with 0x0080:[4fab]. Sub[12-23]: 41 01 01 09 26 06 00 09 66 06 4f ab
LBA[042395, 0x0a59b], Track[01]: Intentional error exists. CRC-16 is recalculated:[bd98] and XORed with 0x0080:[bd18]. Sub[12-23]: 41 01 01 08 25 20 00 89 27 20 bd 18
LBA[042761, 0x0a709], Track[01]: Intentional error exists. CRC-16 is recalculated:[9e3f] and XORed with 0x0080:[9ebf]. Sub[12-23]: 41 01 01 09 30 01 00 09 32 19 9e bf
LBA[042800, 0x0a730], Track[01]: Intentional error exists. CRC-16 is recalculated:[4a87] and XORed with 0x0080:[4a07]. Sub[12-23]: 41 01 01 29 30 50 00 0d 32 50 4a 07
LBA[042900, 0x0a794], Track[01]: Intentional error doesn't exist.
LBA[042942, 0x0a7be], Track[01]: Intentional error exists. CRC-16 is recalculated:[1871] and XORed with 0x0080:[18f1]. Sub[12-23]: 41 01 01 49 32 42 00 0b 34 42 18 f1
LBA[043002, 0x0a7fa], Track[01]: Intentional error doesn't exist.
LBA[043188, 0x0a8b4], Track[01]: Intentional error exists. CRC-16 is recalculated:[26c5] and XORed with 0x0080:[2645]. Sub[12-23]: 41 01 01 09 37 63 00 09 77 63 26 45
LBA[043277, 0x0a90d], Track[01]: Intentional error exists. CRC-16 is recalculated:[4437] and XORed with 0x0080:[44b7]. Sub[12-23]: 41 01 01 08 37 02 00 89 39 02 44 b7
LBA[043460, 0x0a9c4], Track[01]: Intentional error exists. CRC-16 is recalculated:[eb96] and XORed with 0x0080:[eb16]. Sub[12-23]: 41 01 01 09 3d 35 00 09 61 35 eb 16

Diablo II
http://redump.org/disc/25182/

2 bits from both MSFs are modified, original CRC-16 is XORed with 0x8001.

LBA[005008, 0x01390], Track[01]: Intentional error exists. CRC-16 is original:[09ab] and XORed with 0x8001:[89aa] SubQ[12-23]: 41 01 01 05 06 58 00 21 08 58 89 aa
LBA[005110, 0x013f6], Track[01]: Intentional error doesn't exist
LBA[005488, 0x01570], Track[01]: Intentional error doesn't exist
LBA[005800, 0x016a8], Track[01]: Intentional error exists. CRC-16 is original:[f50b] and XORed with 0x8001:[750a] SubQ[12-23]: 41 01 01 11 17 25 00 09 19 25 75 0a
LBA[009160, 0x023c8], Track[01]: Intentional error exists. CRC-16 is original:[113c] and XORed with 0x8001:[913d] SubQ[12-23]: 41 01 01 02 12 10 00 02 0c 10 91 3d
LBA[011078, 0x02b46], Track[01]: Intentional error exists. CRC-16 is original:[9092] and XORed with 0x8001:[1093] SubQ[12-23]: 41 01 01 02 23 53 00 02 09 53 10 93
LBA[011136, 0x02b80], Track[01]: Intentional error exists. CRC-16 is original:[eaf2] and XORed with 0x8001:[6af3] SubQ[12-23]: 41 01 01 0a 28 36 00 12 30 36 6a f3
LBA[011737, 0x02dd9], Track[01]: Intentional error doesn't exist
LBA[013215, 0x0339f], Track[01]: Intentional error exists. CRC-16 is original:[5f29] and XORed with 0x8001:[df28] SubQ[12-23]: 41 01 01 0a 56 15 00 12 58 15 df 28
LBA[013249, 0x033c1], Track[01]: Intentional error doesn't exist
LBA[013739, 0x035ab], Track[01]: Intentional error exists. CRC-16 is original:[217e] and XORed with 0x8001:[a17f] SubQ[12-23]: 41 01 01 13 03 14 00 0b 05 14 a1 7f
LBA[014872, 0x03a18], Track[01]: Intentional error exists. CRC-16 is original:[96b5] and XORed with 0x8001:[16b4] SubQ[12-23]: 41 01 01 13 18 22 00 0b 20 22 16 b4
LBA[016427, 0x0402b], Track[01]: Intentional error exists. CRC-16 is original:[f2d0] and XORed with 0x8001:[72d1] SubQ[12-23]: 41 01 01 03 39 12 00 03 41 0a 72 d1
LBA[018033, 0x04671], Track[01]: Intentional error exists. CRC-16 is original:[d138] and XORed with 0x8001:[5139] SubQ[12-23]: 41 01 01 04 01 33 00 04 82 33 51 39

Vietcong
http://redump.org/disc/33720/

LBA[005000, 0x01388], Track[01]: Intentional error exists. CRC-16 is original:[8a8e] and XORed with 0x8001:[0a8f]. Sub[12-23]: 41 01 01 21 06 50 00 05 08 50 0a 8f
LBA[005960, 0x01748], Track[01]: Intentional error exists. CRC-16 is original:[efff] and XORed with 0x8001:[6ffe]. Sub[12-23]: 41 01 01 01 19 34 00 01 21 b5 6f fe
LBA[006438, 0x01926], Track[01]: Intentional error exists. CRC-16 is original:[83b2] and XORed with 0x8001:[03b3]. Sub[12-23]: 41 01 01 03 25 63 00 41 27 63 03 b3
LBA[006872, 0x01ad8], Track[01]: Intentional error doesn't exist.
LBA[008707, 0x02203], Track[01]: Intentional error exists. CRC-16 is original:[ac51] and XORed with 0x8001:[2c50]. Sub[12-23]: 41 01 01 03 56 07 00 41 58 07 2c 50
LBA[008753, 0x02231], Track[01]: Intentional error exists. CRC-16 is original:[2a14] and XORed with 0x8001:[aa15]. Sub[12-23]: 41 01 01 00 56 53 00 81 58 53 aa 15
LBA[008953, 0x022f9], Track[01]: Intentional error exists. CRC-16 is original:[3ce5] and XORed with 0x8001:[bce4]. Sub[12-23]: 41 01 01 01 51 28 00 02 11 28 bc e4
LBA[009512, 0x02528], Track[01]: Intentional error doesn't exist.
LBA[010143, 0x0279f], Track[01]: Intentional error doesn't exist.
LBA[010434, 0x028c2], Track[01]: Intentional error exists. CRC-16 is original:[1e37] and XORed with 0x8001:[9e36]. Sub[12-23]: 41 01 01 42 19 09 00 00 21 09 9e 36
LBA[011539, 0x02d13], Track[01]: Intentional error doesn't exist.
LBA[013271, 0x033d7], Track[01]: Intentional error doesn't exist.
LBA[013688, 0x03578], Track[01]: Intentional error exists. CRC-16 is original:[319e] and XORed with 0x8001:[b19f]. Sub[12-23]: 41 01 01 03 03 38 00 03 84 38 b1 9f
LBA[014472, 0x03888], Track[01]: Intentional error doesn't exist.
LBA[015762, 0x03d92], Track[01]: Intentional error exists. CRC-16 is original:[f153] and XORed with 0x8001:[7152]. Sub[12-23]: 41 01 01 01 30 12 00 43 32 12 71 52
LBA[018183, 0x04707], Track[01]: Intentional error doesn't exist.
LBA[018225, 0x04731], Track[01]: Intentional error doesn't exist.
LBA[018456, 0x04818], Track[01]: Intentional error doesn't exist.
LBA[042243, 0x0a503], Track[01]: Intentional error doesn't exist.

It seems that the Libcrypt is from 13500 to 18000 and 40500 to 45000 but the securom is different.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • iR0b0t
  • iR0b0t
  • Administrator
  • Offline
  • From: Research equipment
  • Registered: 2008-02-21
  • Posts: 6,703

sarami, do you want the "Old Securom" or securom in any variation?

PX-760A (+30), PX-W4824TA (+98), GSA-H42L (+667), GDR-8164B (+102), SH-D162D (+6), SOHD-167T (+12)
  • Registered: 2011-02-20
  • Posts: 1,745

from version 1 to 4.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

6 Reply by sarami (edited by sarami 2015-12-25 20:21:03)

  • Registered: 2011-02-20
  • Posts: 1,745

Empire Earth - The Art of Conquest Expansion (USA)
// This doesn't exist in db

LBA[005000, 0x01388], Track[01]: Intentional error exists. CRC-16 is original:[8a8e] and XORed with 0x8001:[0a8f]. Sub[12-23]: 41 01 01 21 06 50 00 05 08 50 0a 8f
LBA[006711, 0x01a37], Track[01]: Intentional error exists. CRC-16 is original:[1db1] and XORed with 0x8001:[9db0]. Sub[12-23]: 41 01 01 01 2b 36 00 01 71 36 9d b0
LBA[006906, 0x01afa], Track[01]: Intentional error exists. CRC-16 is original:[01df] and XORed with 0x8001:[81de]. Sub[12-23]: 41 01 01 41 32 06 00 03 34 06 81 de
LBA[008153, 0x01fd9], Track[01]: Intentional error exists. CRC-16 is original:[399a] and XORed with 0x8001:[b99b]. Sub[12-23]: 41 01 01 01 58 53 00 01 58 53 b9 9b
LBA[012364, 0x0304c], Track[01]: Intentional error exists. CRC-16 is original:[37f0] and XORed with 0x8001:[b7f1]. Sub[12-23]: 41 01 01 02 45 64 00 02 c6 64 b7 f1
LBA[013178, 0x0337a], Track[01]: Intentional error doesn't exist.
LBA[013509, 0x034c5], Track[01]: Intentional error exists. CRC-16 is original:[90b5] and XORed with 0x8001:[10b4]. Sub[12-23]: 41 01 01 03 00 01 00 03 02 19 10 b4
LBA[015142, 0x03b26], Track[01]: Intentional error exists. CRC-16 is original:[8ed6] and XORed with 0x8001:[0ed7]. Sub[12-23]: 41 01 01 23 21 67 00 07 23 67 0e d7
LBA[015561, 0x03cc9], Track[01]: Intentional error exists. CRC-16 is original:[194b] and XORed with 0x8001:[994a]. Sub[12-23]: 41 01 01 03 27 16 00 03 29 32 99 4a
LBA[016897, 0x04201], Track[01]: Intentional error exists. CRC-16 is original:[3adf] and XORed with 0x8001:[bade]. Sub[12-23]: 41 01 01 01 45 22 00 43 47 22 ba de
LBA[017360, 0x043d0], Track[01]: Intentional error exists. CRC-16 is original:[e815] and XORed with 0x8001:[6814]. Sub[12-23]: 41 01 01 03 53 35 00 03 13 35 68 14

Unreal Tournament 2003 (Disc 1)
http://redump.org/disc/9600/

LBA[005000, 0x01388], Track[01]: Intentional error exists. CRC-16 is original:[8a8e] and XORed with 0x8001:[0a8f]. Sub[12-23]: 41 01 01 21 06 50 00 05 08 50 0a 8f
LBA[005395, 0x01513], Track[01]: Intentional error exists. CRC-16 is original:[ab14] and XORed with 0x8001:[2b15]. Sub[12-23]: 41 01 01 41 11 70 00 03 13 70 2b 15
LBA[007203, 0x01c23], Track[01]: Intentional error exists. CRC-16 is original:[31e1] and XORed with 0x8001:[b1e0]. Sub[12-23]: 41 01 01 21 36 03 00 05 38 03 b1 e0
LBA[007509, 0x01d55], Track[01]: Intentional error exists. CRC-16 is original:[f9ea] and XORed with 0x8001:[79eb]. Sub[12-23]: 41 01 01 03 40 09 00 41 42 09 79 eb
LBA[008865, 0x022a1], Track[01]: Intentional error exists. CRC-16 is original:[801e] and XORed with 0x8001:[001f]. Sub[12-23]: 41 01 01 01 58 05 00 02 00 1d 00 1f
LBA[012521, 0x030e9], Track[01]: Intentional error exists. CRC-16 is original:[fa26] and XORed with 0x8001:[7a27]. Sub[12-23]: 41 01 01 02 46 61 00 02 48 79 7a 27
LBA[013837, 0x0360d], Track[01]: Intentional error exists. CRC-16 is original:[4e0b] and XORed with 0x8001:[ce0a]. Sub[12-23]: 41 01 01 43 04 37 00 01 06 37 ce 0a
LBA[013877, 0x03635], Track[01]: Intentional error exists. CRC-16 is original:[71d5] and XORed with 0x8001:[f1d4]. Sub[12-23]: 41 01 01 03 04 02 00 03 87 02 f1 d4
LBA[017187, 0x04323], Track[01]: Intentional error exists. CRC-16 is original:[a254] and XORed with 0x8001:[2255]. Sub[12-23]: 41 01 01 03 4d 12 00 03 71 12 22 55
LBA[017238, 0x04356], Track[01]: Intentional error exists. CRC-16 is original:[7b35] and XORed with 0x8001:[fb34]. Sub[12-23]: 41 01 01 43 49 63 00 01 51 63 fb 34
DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2011-11-08
  • Posts: 523

dunno can it helpful or not, try my best for it.
hope you can solve the problem.

http://redump.org/disc/27407/

Device: Plextor PX-W4012TA 1.06(+98)(Overread Lead-In and Lead-Out)
Tool: DiscImageCreator v.Test(20151024)


Log: https://mega.nz/#!KNVA2bhI
key: !FkqxKxcrfYSerDQcby067txtkp21BmyGpRsctOWtUng

8 Reply by sarami (edited by sarami 2015-11-16 11:57:29)

  • Registered: 2011-02-20
  • Posts: 1,745

How many the securom version?

ProtectionID (Protection Checking)
http://pid.gamecopyworld.com/
A-Ray Scanner (Protection Checking)
http://www.mediafire.com/download.php?ttzyzjiczzj

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2011-11-08
  • Posts: 523

PID detect failed.

ProtectionID Protection Report (txt format)

14:42:58 | H:\SecuROM\Cms32_nt.dll | SecuROM 5 or lower cms32_nt.dll module | Petite v1.2 
14:42:59 | H:\SecuROM\cms32_95.dll | SecuROM 5 or lower cms32_95.dll module | Petite v1.2
  • Registered: 2011-02-20
  • Posts: 1,745

It seems that the internal sub error doesn't exist in your log.
It may be that these files(cms32_xx.dll) is inactive. But I don't understand the details...

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2011-11-08
  • Posts: 523

Cool, the game was very old ASUS motherboard free bonus.

Maybe they mastering it as DRM-free for avoid system unstable.

Thanks for the test report.

  • Registered: 2012-06-10
  • Posts: 143

Have also here a game with that protection from the Gold Games 4 collection called Conflict: FreeSpace - The Great War also known as Descent: FreeSpace - The Great War is listed here http://www.cdmediaworld.com/hardware/cd … urom.shtml under SecuROM R2 i have also the two files on the disc cms32_95.dll and cms32_nt.dll but i miss the DADC logo on the disc so maybe they removed the protection for the Gold Games 4 collection.

13 Reply by Jackal (edited by Jackal 2017-03-13 07:06:02)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

@sarami,

here is the data track .sub for Turok 2 - Seeds of Evil (Europe) (En,Fr,Es,It) - http://redump.org/disc/5331/ - http://www90.zippyshare.com/v/RHIsgwRc/file.html
I dumped it from 2 discs using CDTool (001b and 100b modes) with 2 drives, Sony Optiarc & Plextor Premium. Then I cleaned random errors with CDGTool and by comparing the dumps.
The end result is a .sub with 24 sectors containing modified Q-channel bytes. I'm pretty sure that this dump is fully correct now.

The thing that bothers me is that subdump -i ?: -f test.sub -mode 6 -rereadnum 25 -speed 4 -flushspeed 4 -fix 2 and even without -fix 2 gives a totally different output on these sectors with no modified bytes, but instead repeated sectors! Here is the plextor subdump dump with above parameters and -fix 2 (also verified from 2 discs): http://www24.zippyshare.com/v/obES60fB/file.html

Another thing that I noticed is that SecuROM games dumped with DIC using the D8 output often result in a bad dump of the data track (with multiple errors, instead of just the 1 error at the end where mode1=mode2 and vice versa), with shifted sectors. So it seems that D8 reading mode has problems with these discs, and it also results in bad subchannels.

I also tried subdump after swapping with an audio disc, but the issues remain. The only conclusion I can reach so far is that subdump and the recommended parameters used by rawdump are not safe for archiving these discs and the resulting output is incorrect. Also, Rawdump claims that "SecuROM Has 10 errors in Q-channel + 1 Q-channel error in the last sector of pregap", but the old version (also on FIFA 99) apparently has 24 errors.

Questions:
- Do the t2final.sub errors occur in the same range as documented in DIC? So should the latest DIC and /se parameter dump these errors correctly always?

/se     Not fix SubQ (RMSF, AMSF, CRC) (RMSFs 01:06:50 - 04:02:74)
                                            or (RMSFs 08:55:50 - 09:38:74)
                        For intentional subchannel error of a SecuRom

- Can you check the 24 sectors in the t2final.sub to confirm that they are all intentional errors (with XOR 0x0080 or 0x8001)?
- Did you also check the Track01 pregap of your discs for intentional errors?

Since this protection is so similar to LibCrypt, I think it might be a good idea to preserve these modified bytes on the dump page. But first we need to do more tests and come up with a foolproof method for dumping these sectors.
If it turns out that there is no reliable dumping method, or if sectors from the pregap are also needed, then I guess Daemon Tools' SecuROM emulation remains the only solution for us.

Tomorrow I will post the results of another disc ( http://redump.org/disc/41170/ )

14 Reply by Jackal (edited by Jackal 2017-03-13 20:23:24)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

NFS3 sub (again, 24 intentional error sectors): http://www75.zippyshare.com/v/LYV46pWC/file.html
subdump (-mode 6 -rereadnum 25 -speed 4 -flushspeed 4 -fix 2): http://www87.zippyshare.com/v/hI5Ag4zn/file.html

I also checked both games for intentional errors in the Track01 pregap, but did not find any.. I hope sarami can check the pregap of newer SecuROM discs, but it seems unlikely that intentional errors are placed there, because many drives can't even read the pregap?

  • Registered: 2011-02-20
  • Posts: 1,745

Jackal wrote:

Another thing that I noticed is that SecuROM games dumped with DIC using the D8 output often result in a bad dump of the data track (with multiple errors, instead of just the 1 error at the end where mode1=mode2 and vice versa), with shifted sectors.

All disc? or specified disc?

Jackal wrote:

- Do the t2final.sub errors occur in the same range as documented in DIC? So should the latest DIC and /se parameter dump these errors correctly always?

This range is temporary. Fixed. (LBA  5000 - 18199) or (LBA 40100 - 43799) The more disc test, the more precise.
http://www.mediafire.com/file/eq80y20l9 … or_test.7z

Jackal wrote:

- Can you check the 24 sectors in the t2final.sub to confirm that they are all intentional errors (with XOR 0x0080 or 0x8001)?

I confirmed apparent 16 error, couldn't find the rest.

Jackal wrote:

- Did you also check the Track01 pregap of your discs for intentional errors?

I checked this. http://redump.org/disc/8632/ But I couldn't find apparent error.

Jackal wrote:

I think it might be a good idea to preserve these modified bytes on the dump page. But first we need to do more tests and come up with a foolproof method for dumping these sectors.

I think so too.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

sarami wrote:
Jackal wrote:

Another thing that I noticed is that SecuROM games dumped with DIC using the D8 output often result in a bad dump of the data track (with multiple errors, instead of just the 1 error at the end where mode1=mode2 and vice versa), with shifted sectors.

All disc? or specified disc?

People reported these issues before. Maybe only old SecuROM discs are affected and maybe it explains why subdump is giving me bad dumps on these discs. Did you try to dump FIFA 99 with DIC and subdump to see if you get repeated/shifted sectors?

Jackal wrote:

- Do the t2final.sub errors occur in the same range as documented in DIC? So should the latest DIC and /se parameter dump these errors correctly always?

This range is temporary. Fixed. (LBA  5000 - 18199) or (LBA 40100 - 43799) The more disc test, the more precise.
http://www.mediafire.com/file/eq80y20l9 … or_test.7z

Jackal wrote:

- Can you check the 24 sectors in the t2final.sub to confirm that they are all intentional errors (with XOR 0x0080 or 0x8001)?

I confirmed apparent 16 error, couldn't find the rest.

Did you also include the NFS3 results in the new error range?
There are really 24 errors in the Turok 2 and NFS3 subs.
Turok 2:
41 01 01 18 55 10 00 00 57 10  58 D0
41 01 01 18 58 36 00 01 00 36  37 1E
41 01 01 08 79 65 00 09 05 65  B7 EF
41 01 01 09 09 66 00 09 13 66  3D 76
41 01 01 08 02 43 00 89 04 43  B8 2F
41 01 01 09 24 66 00 09 02 66  76 7F
41 01 01 19 10 20 00 01 12 20  36 14
41 01 01 09 11 59 00 09 13 41  17 22
41 01 01 09 1B 50 00 09 05 50  92 99
41 01 01 09 54 27 00 09 14 27  79 EA
41 01 01 09 36 50 00 09 1C 50  50 39
41 01 01 09 59 31 00 09 23 31  10 83
41 01 01 49 21 49 00 0B 23 49  0B E5
41 01 01 09 23 70 00 09 25 54  FE 81
41 01 01 09 24 25 00 09 26 67  53 C6
41 01 01 09 26 51 00 09 28 D0  B8 35
41 01 01 09 29 33 00 09 31 71  3C 49
41 01 01 09 38 33 00 09 22 33  5D CB
41 01 01 09 32 48 00 09 34 6C  28 7F
41 01 01 09 33 47 00 09 35 05  C6 98
41 01 01 09 35 69 00 09 37 E8  C6 84
41 01 01 09 38 4B 00 09 40 09  B8 31
41 01 01 09 31 51 00 09 51 51  59 98
41 01 01 09 43 26 00 09 C4 26  04 78

Jackal wrote:

- Did you also check the Track01 pregap of your discs for intentional errors?

I checked this. http://redump.org/disc/8632/ But I couldn't find apparent error.

gorelord4e says that sector -1 should have an error, for SecuROM v3 discs at least, but we need to check other versions too. These 2 old version discs don't seem to have any errors in pregap.

17 Reply by Jackal (edited by Jackal 2017-03-14 20:52:48)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

Turns out I did have a SecuROM NEW (5.00.03.0005) game lying around: Sonic Adventure DX: Director's Cut (Disc 1): http://www97.zippyshare.com/v/Yf3QRgpx/file.html

10 errors + 1 in pregap (sector -1), as previously confirmed by gorelord4e..

  • Registered: 2011-02-20
  • Posts: 1,745

FIFA99

LBA[040169, 0x09ce9],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:44], AMSF[08:57:44], RtoW[0, 0, 0, 0]
LBA[040170, 0x09cea],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:45], AMSF[08:57:45], RtoW[0, 0, 0, 0]
LBA[040171, 0x09ceb],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:47], AMSF[08:57:47], RtoW[0, 0, 0, 0]
LBA[040172, 0x09cec],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:48], AMSF[08:57:48], RtoW[0, 0, 0, 0]
LBA[040173, 0x09ced],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:49], AMSF[08:57:49], RtoW[0, 0, 0, 0]
LBA[040174, 0x09cee],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:50], AMSF[08:57:50], RtoW[0, 0, 0, 0]
LBA[040175, 0x09cef],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:51], AMSF[08:57:51], RtoW[0, 0, 0, 0]
LBA[040176, 0x09cf0],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:52], AMSF[08:57:52], RtoW[0, 0, 0, 0]
LBA[040177, 0x09cf1],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:53], AMSF[08:57:53], RtoW[0, 0, 0, 0]
LBA[040178, 0x09cf2],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:54], AMSF[08:57:54], RtoW[0, 0, 0, 0]
LBA[040179, 0x09cf3],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[00:55:54], AMSF[18:57:54], RtoW[0, 0, 0, 0]
LBA[040180, 0x09cf4],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:55], AMSF[08:57:55], RtoW[0, 0, 0, 0]
LBA[040181, 0x09cf5],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:56], AMSF[08:57:56], RtoW[0, 0, 0, 0]

LBA[040170] is normal subchannel
LBA[040171] to LBA[040178] (8 sector): RMSF/AMSF is shifted
LBA[040179] is intentional error subchannel
LBA[040180] is normal subchannel
I confirmed this type is repeated 24 times.
coded this. http://www.mediafire.com/file/eq80y20l9 … or_test.7z

Jackal wrote:

Turns out I did have a SecuROM NEW (5.00.03.0005) game lying around: Sonic Adventure DX: Director's Cut (Disc 1): http://www97.zippyshare.com/v/Yf3QRgpx/file.html

10 errors + 1 in pregap (sector -1), as previously confirmed by gorelord4e..

I confirmed this too in Unreal Tournament 2004 (Disc 6) (Play Disc)

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

19 Reply by Jackal (edited by Jackal 2017-03-15 21:36:02)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

sarami wrote:

FIFA99

LBA[040169, 0x09ce9],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:44], AMSF[08:57:44], RtoW[0, 0, 0, 0]
LBA[040170, 0x09cea],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:45], AMSF[08:57:45], RtoW[0, 0, 0, 0]
LBA[040171, 0x09ceb],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:47], AMSF[08:57:47], RtoW[0, 0, 0, 0]
LBA[040172, 0x09cec],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:48], AMSF[08:57:48], RtoW[0, 0, 0, 0]
LBA[040173, 0x09ced],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:49], AMSF[08:57:49], RtoW[0, 0, 0, 0]
LBA[040174, 0x09cee],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:50], AMSF[08:57:50], RtoW[0, 0, 0, 0]
LBA[040175, 0x09cef],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:51], AMSF[08:57:51], RtoW[0, 0, 0, 0]
LBA[040176, 0x09cf0],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:52], AMSF[08:57:52], RtoW[0, 0, 0, 0]
LBA[040177, 0x09cf1],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:53], AMSF[08:57:53], RtoW[0, 0, 0, 0]
LBA[040178, 0x09cf2],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:54], AMSF[08:57:54], RtoW[0, 0, 0, 0]
LBA[040179, 0x09cf3],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[00:55:54], AMSF[18:57:54], RtoW[0, 0, 0, 0]
LBA[040180, 0x09cf4],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:55], AMSF[08:57:55], RtoW[0, 0, 0, 0]
LBA[040181, 0x09cf5],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:56], AMSF[08:57:56], RtoW[0, 0, 0, 0]

LBA[040170] is normal subchannel
LBA[040171] to LBA[040178] (8 sector): RMSF/AMSF is shifted
LBA[040179] is intentional error subchannel
LBA[040180] is normal subchannel
I confirmed this type is repeated 24 times.
coded this. http://www.mediafire.com/file/eq80y20l9 … or_test.7z

I guess that's what is causing the errors in the main dump image? But the protection only scans for the intentional errors I suppose?

Could you maybe add a function to DiscImageCreator to extract the SecuROM data from the disc, or maybe parse it from the .sub?
I don't know if you already added this function for LibCrypt. We will use the same format for SecuROM:

MSF: 03:09:56 Q-Data: 410101 07:07:56 00 23:09:56 dfde

http://i.imgur.com/C21DXDr.png

edit: psxt001z --libcrypt *.sub

seems to work fine for this purspose smile but it only works if the .sub starts at 02:00.

psxt001z by Dremora, v0.20 beta 13 derus fix

MSF: 01:08:50 Q-Data: 410101 21:06:50 00 05:08:50 0a8f  xor 8001 3237 P1 xor 20 04
MSF: 01:38:50 Q-Data: 410101 11:36:50 00 09:38:50 2096  xor 8001 1edb P1 xor 10 08
MSF: 01:51:22 Q-Data: 410101 01:41:22 00 01:41:22 166b  xor 8001 8e30 P2 xor 08 10
MSF: 01:56:64 Q-Data: 410101 01:54:74 00 01:56:6c 2fd4  xor 8001 0553 P3 xor 10 08
MSF: 02:02:33 Q-Data: 410101 02:10:33 00 02:0a:33 42bc  xor 8001 132c P2 xor 10 08
MSF: 02:50:26 Q-Data: 410101 02:58:26 00 02:58:26 28aa  xor 8001 132c P2 xor 10 08
MSF: 02:55:35 Q-Data: 410101 06:53:35 00 22:55:35 c6a3  xor 8001 c701 P1 xor 04 20
MSF: 03:03:31 Q-Data: 410101 03:41:31 00 03:01:31 dfbd  xor 8001 8c73 P2 xor 40 02
MSF: 03:10:62 Q-Data: 410101 0b:08:62 00 13:10:62 5009  xor 8001 50cf P1 xor 08 10
MSF: 03:24:70 Q-Data: 410101 03:22:71 00 03:24:f0 58f8  xor 8001 bbd8 P3 xor 01 80
Number of modified sectors: 10

And for the SecuROM OLD it outputs 24 * 9 = 216 modified sectors. Added them here as an example: http://redump.org/disc/5331/

And here I only added the 24 intentional errors:  http://redump.org/disc/41170/

Here is SecuROM NEW: http://redump.org/disc/31548/

  • Registered: 2011-02-20
  • Posts: 1,745

Could you maybe add a function to DiscImageCreator to extract the SecuROM data from the disc, or maybe parse it from the .sub?

MSF: 03:09:56 Q-Data: 410101 07:07:56 00 23:09:56 dfde

Should I output the text data like this to file?

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

sarami wrote:

Could you maybe add a function to DiscImageCreator to extract the SecuROM data from the disc, or maybe parse it from the .sub?

MSF: 03:09:56 Q-Data: 410101 07:07:56 00 23:09:56 dfde

Should I output the text data like this to file?

Yes

22 Reply by sarami (edited by sarami 2017-03-17 06:50:08)

  • Registered: 2011-02-20
  • Posts: 1,745

Coded: http://www.mediafire.com/file/eq80y20l9 … or_test.7z
  Output in <filename>_subIntention.txt

Tested 3 discs
FIFA 99 http://redump.org/disc/23791/
Die Hard: Nakatomi Plaza http://redump.org/disc/35826/
Unreal Tournament 2004 (USA) (En,Fr,Es,It) (Disc 6) (Play Disc) // This doesn't exist in db.
These subs and logs http://www.mediafire.com/file/ubs6v8rbn … omSubs3.7z

In this reserch, I knew there are 3 types(v1.x - v3.x a.k.a OLD, v4.x a.k.a NEW, v5 a.k.a NEW?) at a mininum in CD. But there are yet many version in securom according to this site (http://www.cdmediaworld.com/hardware/cd … urom.shtml),  So We need to continue to test. http://redump.org/discs/quicksearch/sec … ction/only

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

sarami wrote:

Coded: http://www.mediafire.com/file/eq80y20l9 … or_test.7z
  Output in <filename>_subIntention.txt

Tested 3 discs
FIFA 99 http://redump.org/disc/23791/
Die Hard: Nakatomi Plaza http://redump.org/disc/35826/
Unreal Tournament 2004 (USA) (En,Fr,Es,It) (Disc 6) (Play Disc) // This doesn't exist in db.
These subs and logs http://www.mediafire.com/file/ubs6v8rbn … omSubs3.7z

In this reserch, I knew there are 3 types(v1.x - v3.x a.k.a OLD, v4.x a.k.a NEW, v5 a.k.a NEW?) at a mininum in CD. But there are yet many version in securom according to this site (http://www.cdmediaworld.com/hardware/cd … urom.shtml),  So We need to continue to test. http://redump.org/discs/quicksearch/sec … ction/only

Thx.. is it also possible to add the pregap sector to the log for SecuROM NEW? or could you give it manually for Die Hard: Nakatomi Plaza?

24 Reply by Jackal (edited by Jackal 2017-03-18 10:46:00)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

Hi, Zapper was missing 1 sector in DIC output: http://redump.org/disc/40768/

MSF: 01:55:27 Q-Data: 410101 01:13:27 00 01:57:27 35db

Maybe there was a random error that caused it to skip this sector?

  • Registered: 2011-02-20
  • Posts: 1,745

Jackal wrote:

is it also possible to add the pregap sector to the log for SecuROM NEW?

Jackal wrote:

Hi, Zapper was missing 1 sector in DIC output: http://redump.org/disc/40768/

MSF: 01:55:27 Q-Data: 410101 01:13:27 00 01:57:27 35db

Maybe there was a random error that caused it to skip this sector?

Probably fixed: http://www.mediafire.com/file/eq80y20l9 … or_test.7z
Dumped Die Hard: http://forum.redump.org/topic/15796/ibm … omi-plaza/

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website