1 (edited by reentrant 2018-03-06 21:01:09)

Hello,
   After some small research I managed to make use of DPM data stored inside MDS file. For this purpose a small helper tool was created: CDArchive (in the attachment)

Example game: http://redump.org/disc/38911/

Basically the result of the tool is this info:

DPM Resolution: 256 // It means that there's one sample of info for each 256 sectors block
DPM Entries: 8037 // 8037 * 256 = how many sectors are covered in this DPM analysis session (could be smaller by few sectors than image size)
DPM Start Sector: 0 // No comment

DPM Data: 0 0 0 2253 // Format: <IsInsideDPMBlock> <SectorStart> <SectorDensityDifference> <SectorReadingTimeUs>
DPM Data: 0 256 -1 2252 // The key thing here is SectorDensityDifference - it's used to detect start and end of DPM range
DPM Data: 0 512 -1 2251 // DPM start area has always positive difference and end area has always negative difference
...
...
...
DPM Data: 0 5888 0 2239
DPM Data: 0 6144 -1 2238
DPM Data: 0 6400 -1 2237
DPM Data: 0 6656 0 2237
DPM Data: 1 6912 29 2266 // DPM area start here
DPM Data: 1 7168 -2 2264
DPM Data: 1 7424 1 2265
DPM Data: 1 7680 -2 2263
DPM Data: 1 7936 0 2263
DPM Data: 1 8192 -1 2262
DPM Data: 1 8448 0 2262
DPM Data: 1 8704 -1 2261
DPM Data: 1 8960 0 2261
DPM Data: 1 9216 -1 2260
DPM Data: 1 9472 -1 2259
DPM Data: 1 9728 0 2259 // DPM area ends here
DPM Data: 0 9984 -30 2229
DPM Data: 0 10240 -1 2228
DPM Data: 0 10496 0 222
...
DPM Data: 0 2056704 -1 970

DPM Range: 6912 - 9984 = 3072 [+29 -30]
DPM Range: 14592 - 17408 = 2816 [+30 -30]
DPM Range: 18688 - 19968 = 1280 [+29 -30]
DPM Range: 21504 - 24576 = 3072 [+29 -31]
DPM Range: 27136 - 30464 = 3328 [+27 -29]
DPM Range: 36096 - 37632 = 1536 [+28 -29]
DPM Range: 43264 - 46080 = 2816 [+29 -29]
DPM Range: 50176 - 56320 = 6144 [+27 -29]
DPM Range: 58624 - 60160 = 1536 [+28 -29]
DPM Range: 61952 - 63232 = 1280 [+28 -29]
DPM Range: 64768 - 70912 = 6144 [+28 -28]
DPM Range: 71680 - 77824 = 6144 [+27 -28]
DPM Range: 78848 - 82432 = 3584 [+27 -27]
DPM Range: 93440 - 95232 = 1792 [+26 -27]
DPM Range: 96256 - 100608 = 4352 [+27 -28]
DPM Range: 103680 - 105216 = 1536 [+27 -27]
DPM Range: 107520 - 111104 = 3584 [+27 -28]
DPM Range: 113920 - 115200 = 1280 [+27 -28]
DPM Range: 116480 - 120832 = 4352 [+26 -26]
DPM Range: 122112 - 124160 = 2048 [+26 -27]
DPM Range: 124928 - 128512 = 3584 [+26 -28]
DPM Range: 131072 - 136960 = 5888 [+26 -28]
DPM Range: 276736 - 280320 = 3584 [+23 -24]
DPM Range: 284160 - 287488 = 3328 [+23 -24]
DPM Range: 288768 - 290048 = 1280 [+23 -23]
DPM Range: 291328 - 294400 = 3072 [+22 -23]
DPM Range: 296960 - 300288 = 3328 [+23 -24]
DPM Range: 305664 - 307712 = 2048 [+22 -23]
DPM Range: 313088 - 316160 = 3072 [+24 -23]
DPM Range: 320512 - 326144 = 5632 [+22 -23]
DPM Range: 328960 - 330496 = 1536 [+23 -24]
DPM Range: 332032 - 333824 = 1792 [+22 -23]
DPM Range: 334336 - 340736 = 6400 [+23 -24]
DPM Range: 342016 - 347648 = 5632 [+22 -23]
DPM Range: 349184 - 352000 = 2816 [+23 -23]
DPM Range: 363520 - 365056 = 1536 [+22 -23]
DPM Range: 366080 - 370688 = 4608 [+21 -23]
DPM Range: 373504 - 375296 = 1792 [+21 -22]
DPM Range: 377856 - 381184 = 3328 [+23 -22]
DPM Range: 383488 - 385280 = 1792 [+23 -22]
DPM Range: 386560 - 390912 = 4352 [+22 -21]
DPM Range: 392192 - 393984 = 1792 [+21 -23]
DPM Range: 395264 - 398336 = 3072 [+22 -22]
DPM Range: 400896 - 406784 = 5888 [+22 -23]
DPM Range: 547328 - 550144 = 2816 [+21 -19]
DPM Range: 553984 - 557056 = 3072 [+20 -20]
DPM Range: 558592 - 560128 = 1536 [+20 -20]
DPM Range: 561408 - 564480 = 3072 [+21 -19]
DPM Range: 567552 - 570112 = 2560 [+19 -21]
DPM Range: 575744 - 577536 = 1792 [+19 -20]
DPM Range: 582912 - 586240 = 3328 [+19 -21]
DPM Range: 590336 - 595968 = 5632 [+20 -20]
DPM Range: 599040 - 600832 = 1792 [+20 -20]
DPM Range: 601856 - 603392 = 1536 [+19 -19]
DPM Range: 604672 - 610816 = 6144 [+20 -21]
DPM Range: 611840 - 617728 = 5888 [+20 -20]
DPM Range: 619264 - 622080 = 2816 [+19 -19]
DPM Range: 633600 - 635136 = 1536 [+20 -20]
DPM Range: 636416 - 640512 = 4096 [+18 -18]
DPM Range: 643584 - 645376 = 1792 [+18 -20]
DPM Range: 647936 - 650752 = 2816 [+20 -19]
DPM Range: 653824 - 655104 = 1280 [+19 -19]
DPM Range: 656640 - 661248 = 4608 [+19 -19]
DPM Range: 662016 - 663808 = 1792 [+18 -19]
DPM Range: 665600 - 668416 = 2816 [+19 -20]
DPM Range: 670720 - 677120 = 6400 [+19 -19]
DPM Range: 816896 - 820224 = 3328 [+17 -17]
DPM Range: 824320 - 827136 = 2816 [+17 -18]
DPM Range: 828416 - 829952 = 1536 [+17 -17]
DPM Range: 831488 - 834304 = 2816 [+17 -17]
DPM Range: 837120 - 840192 = 3072 [+17 -17]
DPM Range: 845568 - 847360 = 1792 [+17 -17]
DPM Range: 852992 - 856064 = 3072 [+17 -18]
DPM Range: 860160 - 866304 = 6144 [+16 -16]
DPM Range: 869120 - 870400 = 1280 [+17 -18]
DPM Range: 871936 - 873216 = 1280 [+18 -19]
DPM Range: 874496 - 880640 = 6144 [+17 -17]
DPM Range: 881920 - 887808 = 5888 [+17 -17]
DPM Range: 888832 - 892416 = 3584 [+17 -18]
DPM Range: 903680 - 905216 = 1536 [+17 -17]
DPM Range: 906240 - 910592 = 4352 [+17 -18]
DPM Range: 913664 - 915200 = 1536 [+17 -18]
DPM Range: 918016 - 921088 = 3072 [+17 -18]
DPM Range: 923648 - 925440 = 1792 [+17 -18]
DPM Range: 926720 - 931072 = 4352 [+17 -17]
DPM Range: 932352 - 933888 = 1536 [+18 -18]
DPM Range: 934912 - 938240 = 3328 [+17 -18]
DPM Range: 940800 - 946688 = 5888 [+17 -17]
DPM Ranges Count: 88

So as you see I managed to identify 88 areas with smaller density on the disc. I'd like to see this info in the DB someday. There's also a possibility to generate MDS file with this info (or rather patch existing MDS with this info).

Supported protections:
- SecuROM

To Check:
- Tages Twin Sectors
- StarForce

Tool usage: CDArchive -x i -d <SomeDirectory (not used)> -a <mdsFilePath> <minDensityDifference> <minDpmRangeLenSectors>

Example: CDArchive -x i -d D:\Test -a D:\Test\gta.mds 10 100

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Post's attachments

CDArchive.rar 194.84 kb, 9 downloads since 2018-02-05 

gta.rar 4.47 kb, 7 downloads since 2018-02-05 

gtasa.rar 30.16 kb, 5 downloads since 2018-02-05 

You don't have the permssions to download the attachments of this post.

reentrant wrote:

it has some other functions like ripping sectors which require admin.

What function is it?

I think CreateFile requires admin to open device E: for write access (required by SPTI).

Great tool and research!

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Does that mean that the tool has the ability to rip the DPM information from the CD/DVD itself?

No, it's just the tool to get the data from MDS.

Tested. (Alcohol 52% 2.0.3 Build 10203) (Plextor PX-755SA)
1: Inugami.mds http://redump.org/disc/25198/
This disc has Starforce and 52% says "Detected DPM".

DPM Ranges Count: 0

2: MS_FANDISK.mds http://redump.org/disc/18729/
This disc has Starforce and 52% says "Detected DPM".

DPM Range: 99500 - 100000 = 500 [+16 -25]
DPM Range: 178000 - 178500 = 500 [+11 -17]
DPM Ranges Count: 2

3. Audio CD.mds
This disc hasn't a protect and 52% say "Can't detect DPM".

DPM Range: 223500 - 224000 = 500 [+12 -15]
DPM Ranges Count: 1
Post's attachments

test.7z 15.36 kb, 3 downloads since 2018-02-12 

You don't have the permssions to download the attachments of this post.

7 (edited by reentrant 2018-02-12 23:50:33)

I haven't tested yet CDs smile

The data in your logs doesn't look promising. What speed have you read your discs at?

8 (edited by Jackal 2018-09-12 18:48:58)

Bump.. there was a discussion on discord about (the lack of) DPM preservation.

Jackal:
they are basically read timings that vary for each drive and read speed, so we can't just store this info in a database
I dont see any way of producing "verifiable" DPM data, unless we start rounding off the timings

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

@reentrant + sarami.. do you have any idea on how we could achieve verifiable results between different drives and speeds?

Maybe we could all buy the same game(s), then dump it with different speeds and drives, and see if there is a graph that could be generated by some standard algoritm? And also test different minimum and maximum values to to find any boundaries in the protection.

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

Jackal wrote:

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

That tool was Advanced MDS Editor, btw - http://waper.ru/file/518320/download/7e … dit055.zip

Jackal wrote:

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

https://defacto2.net/d/b2233ae?filename=rld-sfrt.zip -- try to dig here

Technically, if someone leaks the 'main' StarForce tool some day, it should be possible to generate a new key for any image/burned disc.