1 Topic by reentrant (edited by reentrant 2018-03-06 21:01:09)

  • Registered: 2014-10-06
  • Posts: 725

Hello,
   After some small research I managed to make use of DPM data stored inside MDS file. For this purpose a small helper tool was created: CDArchive (in the attachment)

Example game: http://redump.org/disc/38911/

Basically the result of the tool is this info:

DPM Resolution: 256 // It means that there's one sample of info for each 256 sectors block
DPM Entries: 8037 // 8037 * 256 = how many sectors are covered in this DPM analysis session (could be smaller by few sectors than image size)
DPM Start Sector: 0 // No comment

DPM Data: 0 0 0 2253 // Format: <IsInsideDPMBlock> <SectorStart> <SectorDensityDifference> <SectorReadingTimeUs>
DPM Data: 0 256 -1 2252 // The key thing here is SectorDensityDifference - it's used to detect start and end of DPM range
DPM Data: 0 512 -1 2251 // DPM start area has always positive difference and end area has always negative difference
...
...
...
DPM Data: 0 5888 0 2239
DPM Data: 0 6144 -1 2238
DPM Data: 0 6400 -1 2237
DPM Data: 0 6656 0 2237
DPM Data: 1 6912 29 2266 // DPM area start here
DPM Data: 1 7168 -2 2264
DPM Data: 1 7424 1 2265
DPM Data: 1 7680 -2 2263
DPM Data: 1 7936 0 2263
DPM Data: 1 8192 -1 2262
DPM Data: 1 8448 0 2262
DPM Data: 1 8704 -1 2261
DPM Data: 1 8960 0 2261
DPM Data: 1 9216 -1 2260
DPM Data: 1 9472 -1 2259
DPM Data: 1 9728 0 2259 // DPM area ends here
DPM Data: 0 9984 -30 2229
DPM Data: 0 10240 -1 2228
DPM Data: 0 10496 0 222
...
DPM Data: 0 2056704 -1 970

DPM Range: 6912 - 9984 = 3072 [+29 -30]
DPM Range: 14592 - 17408 = 2816 [+30 -30]
DPM Range: 18688 - 19968 = 1280 [+29 -30]
DPM Range: 21504 - 24576 = 3072 [+29 -31]
DPM Range: 27136 - 30464 = 3328 [+27 -29]
DPM Range: 36096 - 37632 = 1536 [+28 -29]
DPM Range: 43264 - 46080 = 2816 [+29 -29]
DPM Range: 50176 - 56320 = 6144 [+27 -29]
DPM Range: 58624 - 60160 = 1536 [+28 -29]
DPM Range: 61952 - 63232 = 1280 [+28 -29]
DPM Range: 64768 - 70912 = 6144 [+28 -28]
DPM Range: 71680 - 77824 = 6144 [+27 -28]
DPM Range: 78848 - 82432 = 3584 [+27 -27]
DPM Range: 93440 - 95232 = 1792 [+26 -27]
DPM Range: 96256 - 100608 = 4352 [+27 -28]
DPM Range: 103680 - 105216 = 1536 [+27 -27]
DPM Range: 107520 - 111104 = 3584 [+27 -28]
DPM Range: 113920 - 115200 = 1280 [+27 -28]
DPM Range: 116480 - 120832 = 4352 [+26 -26]
DPM Range: 122112 - 124160 = 2048 [+26 -27]
DPM Range: 124928 - 128512 = 3584 [+26 -28]
DPM Range: 131072 - 136960 = 5888 [+26 -28]
DPM Range: 276736 - 280320 = 3584 [+23 -24]
DPM Range: 284160 - 287488 = 3328 [+23 -24]
DPM Range: 288768 - 290048 = 1280 [+23 -23]
DPM Range: 291328 - 294400 = 3072 [+22 -23]
DPM Range: 296960 - 300288 = 3328 [+23 -24]
DPM Range: 305664 - 307712 = 2048 [+22 -23]
DPM Range: 313088 - 316160 = 3072 [+24 -23]
DPM Range: 320512 - 326144 = 5632 [+22 -23]
DPM Range: 328960 - 330496 = 1536 [+23 -24]
DPM Range: 332032 - 333824 = 1792 [+22 -23]
DPM Range: 334336 - 340736 = 6400 [+23 -24]
DPM Range: 342016 - 347648 = 5632 [+22 -23]
DPM Range: 349184 - 352000 = 2816 [+23 -23]
DPM Range: 363520 - 365056 = 1536 [+22 -23]
DPM Range: 366080 - 370688 = 4608 [+21 -23]
DPM Range: 373504 - 375296 = 1792 [+21 -22]
DPM Range: 377856 - 381184 = 3328 [+23 -22]
DPM Range: 383488 - 385280 = 1792 [+23 -22]
DPM Range: 386560 - 390912 = 4352 [+22 -21]
DPM Range: 392192 - 393984 = 1792 [+21 -23]
DPM Range: 395264 - 398336 = 3072 [+22 -22]
DPM Range: 400896 - 406784 = 5888 [+22 -23]
DPM Range: 547328 - 550144 = 2816 [+21 -19]
DPM Range: 553984 - 557056 = 3072 [+20 -20]
DPM Range: 558592 - 560128 = 1536 [+20 -20]
DPM Range: 561408 - 564480 = 3072 [+21 -19]
DPM Range: 567552 - 570112 = 2560 [+19 -21]
DPM Range: 575744 - 577536 = 1792 [+19 -20]
DPM Range: 582912 - 586240 = 3328 [+19 -21]
DPM Range: 590336 - 595968 = 5632 [+20 -20]
DPM Range: 599040 - 600832 = 1792 [+20 -20]
DPM Range: 601856 - 603392 = 1536 [+19 -19]
DPM Range: 604672 - 610816 = 6144 [+20 -21]
DPM Range: 611840 - 617728 = 5888 [+20 -20]
DPM Range: 619264 - 622080 = 2816 [+19 -19]
DPM Range: 633600 - 635136 = 1536 [+20 -20]
DPM Range: 636416 - 640512 = 4096 [+18 -18]
DPM Range: 643584 - 645376 = 1792 [+18 -20]
DPM Range: 647936 - 650752 = 2816 [+20 -19]
DPM Range: 653824 - 655104 = 1280 [+19 -19]
DPM Range: 656640 - 661248 = 4608 [+19 -19]
DPM Range: 662016 - 663808 = 1792 [+18 -19]
DPM Range: 665600 - 668416 = 2816 [+19 -20]
DPM Range: 670720 - 677120 = 6400 [+19 -19]
DPM Range: 816896 - 820224 = 3328 [+17 -17]
DPM Range: 824320 - 827136 = 2816 [+17 -18]
DPM Range: 828416 - 829952 = 1536 [+17 -17]
DPM Range: 831488 - 834304 = 2816 [+17 -17]
DPM Range: 837120 - 840192 = 3072 [+17 -17]
DPM Range: 845568 - 847360 = 1792 [+17 -17]
DPM Range: 852992 - 856064 = 3072 [+17 -18]
DPM Range: 860160 - 866304 = 6144 [+16 -16]
DPM Range: 869120 - 870400 = 1280 [+17 -18]
DPM Range: 871936 - 873216 = 1280 [+18 -19]
DPM Range: 874496 - 880640 = 6144 [+17 -17]
DPM Range: 881920 - 887808 = 5888 [+17 -17]
DPM Range: 888832 - 892416 = 3584 [+17 -18]
DPM Range: 903680 - 905216 = 1536 [+17 -17]
DPM Range: 906240 - 910592 = 4352 [+17 -18]
DPM Range: 913664 - 915200 = 1536 [+17 -18]
DPM Range: 918016 - 921088 = 3072 [+17 -18]
DPM Range: 923648 - 925440 = 1792 [+17 -18]
DPM Range: 926720 - 931072 = 4352 [+17 -17]
DPM Range: 932352 - 933888 = 1536 [+18 -18]
DPM Range: 934912 - 938240 = 3328 [+17 -18]
DPM Range: 940800 - 946688 = 5888 [+17 -17]
DPM Ranges Count: 88

So as you see I managed to identify 88 areas with smaller density on the disc. I'd like to see this info in the DB someday. There's also a possibility to generate MDS file with this info (or rather patch existing MDS with this info).

Supported protections:
- SecuROM

To Check:
- Tages Twin Sectors
- StarForce

Tool usage: CDArchive -x i -d <SomeDirectory (not used)> -a <mdsFilePath> <minDensityDifference> <minDpmRangeLenSectors>

Example: CDArchive -x i -d D:\Test -a D:\Test\gta.mds 10 100

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Post's attachments

CDArchive.rar 194.84 kb, 64 downloads since 2018-02-05 

gta.rar 4.47 kb, 56 downloads since 2018-02-05 

gtasa.rar 30.16 kb, 46 downloads since 2018-02-05 

You don't have the permssions to download the attachments of this post.
  • Registered: 2011-02-20
  • Posts: 1,766

reentrant wrote:

it has some other functions like ripping sectors which require admin.

What function is it?

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2014-10-06
  • Posts: 725

I think CreateFile requires admin to open device E: for write access (required by SPTI).

  • Registered: 2018-01-04
  • Posts: 142

Great tool and research!

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Does that mean that the tool has the ability to rip the DPM information from the CD/DVD itself?

ASUS BW-16D1HT 3.10 (Ribshark firmware) | Plextor W4012TA | LiteOn SOHD-167T | Sony Optiarc AD-7290H
  • Registered: 2014-10-06
  • Posts: 725

No, it's just the tool to get the data from MDS.

  • Registered: 2011-02-20
  • Posts: 1,766

Tested. (Alcohol 52% 2.0.3 Build 10203) (Plextor PX-755SA)
1: Inugami.mds http://redump.org/disc/25198/
This disc has Starforce and 52% says "Detected DPM".

DPM Ranges Count: 0

2: MS_FANDISK.mds http://redump.org/disc/18729/
This disc has Starforce and 52% says "Detected DPM".

DPM Range: 99500 - 100000 = 500 [+16 -25]
DPM Range: 178000 - 178500 = 500 [+11 -17]
DPM Ranges Count: 2

3. Audio CD.mds
This disc hasn't a protect and 52% say "Can't detect DPM".

DPM Range: 223500 - 224000 = 500 [+12 -15]
DPM Ranges Count: 1
Post's attachments

test.7z 15.36 kb, 26 downloads since 2018-02-12 

You don't have the permssions to download the attachments of this post.
DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

7 Reply by reentrant (edited by reentrant 2018-02-12 23:50:33)

  • Registered: 2014-10-06
  • Posts: 725

I haven't tested yet CDs smile

The data in your logs doesn't look promising. What speed have you read your discs at?

8 Reply by Jackal (edited by Jackal 2018-09-12 18:48:58)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

Bump.. there was a discussion on discord about (the lack of) DPM preservation.

Jackal:
they are basically read timings that vary for each drive and read speed, so we can't just store this info in a database
I dont see any way of producing "verifiable" DPM data, unless we start rounding off the timings

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

@reentrant + sarami.. do you have any idea on how we could achieve verifiable results between different drives and speeds?

Maybe we could all buy the same game(s), then dump it with different speeds and drives, and see if there is a graph that could be generated by some standard algoritm? And also test different minimum and maximum values to to find any boundaries in the protection.

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

  • Registered: 2006-12-24
  • Posts: 3,847

Jackal wrote:

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

That tool was Advanced MDS Editor, btw - http://waper.ru/file/518320/download/7e … dit055.zip

Jackal wrote:

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

https://defacto2.net/d/b2233ae?filename=rld-sfrt.zip -- try to dig here

Technically, if someone leaks the 'main' StarForce tool some day, it should be possible to generate a new key for any image/burned disc.

  • Registered: 2011-02-20
  • Posts: 1,766

I researched Alcohol 52% using Bus Hound 6.01 and added a measurement function in DIC.
http://www.mediafire.com/file/w2p4z8cps … pm.7z/file

This function outputs read time in _disc.txt like this.

========== Data Position Measurement (DPM) ==========
Entry: 1798, Resolution: 50
---------------------------
   1 (     0), ReadTime 154.500100[msec]
   2 (    50), ReadTime 154.566300[msec]
   3 (   100), ReadTime 154.758100[msec]
   4 (   150), ReadTime 154.850500[msec]
   5 (   200), ReadTime 154.853000[msec]
   6 (   250), ReadTime 155.114800[msec]
   7 (   300), ReadTime 155.013000[msec]
   8 (   350), ReadTime 155.249500[msec]
   9 (   400), ReadTime 155.350000[msec]
  10 (   450), ReadTime 155.493100[msec]
  11 (   500), ReadTime 155.512100[msec]
  12 (   550), ReadTime 155.672400[msec]
  13 (   600), ReadTime 155.690200[msec]
  14 (   650), ReadTime 155.774200[msec]
  15 (   700), ReadTime 156.011200[msec]
  16 (   750), ReadTime 156.051600[msec]
  17 (   800), ReadTime 156.179200[msec]
  18 (   850), ReadTime 156.326700[msec]
  19 (   900), ReadTime 156.385200[msec]
  20 (   950), ReadTime 156.486800[msec]
:
:

CD: reading speed is 4x. resolution is 50.
DVD: reading speed is 4x. resolution is 256.

There is not a special flag to get this log.
CD

DiscImageCreator.exe cd <driveletter> <filename> <drivespeed>

DVD

DiscImageCreator.exe dvd <driveletter> <filename> <drivespeed>

**TODO**
1. I don't know how to convert this reading time to DPM data.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Nexy
  • Nexy
  • Dumper
  • Offline
  • Registered: 2009-10-24
  • Posts: 867

Oh nice sarami, glad to see you working on this! smile

Plextor PX-760A 1.07 (+30) : Plextor PX-716SA 1.11 (+30) : Plextor PX-W5224A 1.04 (+30) : Plextor PX-W4824 1.07 (+30) : Plextor PX-W4012TA 1.07 (+98) : Plextor PX-W1610TA (+99) : Plextor PX-W1210TA 1.10 (+99) : Lite-On LTR-48246S (+6) : Lite-On LTR-52246S (+6) : Lite-On LH-20A1H LL0DN (+6) : BenQ DW1655 BCIB (+618) : ASUS DRW-2014L1 1.02 (+6) : Yamaha CRW-F1 (+733) : Optiarc SA-7290H5 1H44 (+48) : ASUS BW-16D1HT 3.02 (+6)

12 Reply by Jackal (edited by Jackal 2020-04-07 05:31:13)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

Do we have anybody who would be able to extract a DPM "signature" from the executable? That way we would be able to get the exact timing ranges that the game is looking for.

  • Registered: 2011-02-20
  • Posts: 1,766

Memo
----
. SecuROM DLL (Sintf16.dll, Sintf32.dll, SintfNT.dll) is combined in the exe of SecuROM 4.xx disc.
. These dlls are being compressed by petite (https://www.un4seen.com/petite/) and can decompress by enlarger v1.3 (http://www.angelfire.com/electronic/oldskool/stuff.htm)
. If someone can disassemble these dlls, it may be revealed what it is.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Nexy
  • Nexy
  • Dumper
  • Offline
  • Registered: 2009-10-24
  • Posts: 867

Rib ran a patent search for SecuROM, document here https://patentimages.storage.googleapis … 2631A1.pdf

Rib/Wiggy2k found the one for CDilla/SafeDisc as well here https://patentimages.storage.googleapis … 353890.pdf

Plextor PX-760A 1.07 (+30) : Plextor PX-716SA 1.11 (+30) : Plextor PX-W5224A 1.04 (+30) : Plextor PX-W4824 1.07 (+30) : Plextor PX-W4012TA 1.07 (+98) : Plextor PX-W1610TA (+99) : Plextor PX-W1210TA 1.10 (+99) : Lite-On LTR-48246S (+6) : Lite-On LTR-52246S (+6) : Lite-On LH-20A1H LL0DN (+6) : BenQ DW1655 BCIB (+618) : ASUS DRW-2014L1 1.02 (+6) : Yamaha CRW-F1 (+733) : Optiarc SA-7290H5 1H44 (+48) : ASUS BW-16D1HT 3.02 (+6)
  • Registered: 2023-03-03
  • Posts: 121

Hello reentrant

Having also tried cdarchive for a cd, some 'ranges' appear to be missing. I was able to visually identify 4x25=100 'spikes' on the graph drawn by alcohol, but the program only saw 34 according to the ranges count. The 'data' values clearly differ from the example you had given when approaching one 'area' :

DPM Data: 0 1550 -1 1304
DPM Data: 0 1600 1 1305
DPM Data: 0 1650 1 1306
DPM Data: 1 1700 15 1321
DPM Data: 0 1750 17 1338
DPM Data: 0 1800 4 1342
DPM Data: 0 1850 1 1343

There's a second positive 'sector density difference' right after the first one here, so that could partially explain the issue? A resolution of 1 value every 50 sectors used by the high precision sampling is way more likely to have this case.

Maybe you already fixed it since the thread was created. By the way, have you found how to patch a MDS file?

Post's attachments

results.7z 32.62 kb, 16 downloads since 2023-03-17 

You don't have the permssions to download the attachments of this post.

16 Reply by Nemok (edited by Nemok 2023-12-04 06:40:29)

  • Registered: 2023-03-03
  • Posts: 121

For anyone that still tries to get the best DPM approximation possible.

I have written a small bash script program that moves the DPM content into an old format MDS container (convert). This allows manual editing of the DPM values with Advanced MDS editor 0.5.5 and BWA edit 1.1 since these are incompatible with what the latest Alcohol releases create. The edited DPM content may then be put back inside its new format container (rebuild).

Post's attachments

convert.zip 1.26 kb, 9 downloads since 2023-12-04 

rebuild.zip 417 b, 7 downloads since 2023-12-04 

You don't have the permssions to download the attachments of this post.
  • Registered: 2023-03-03
  • Posts: 121

I did my own research and wrote a program that analyzes DPM timings from MDS files, allowing to identify low quality dumps, and helps to find best performing drives.

DPM SCN supports :
- CD and DVD sampling rates
- curve quality score
- layout detection
- critical error detection
- reliability checks

Compatible with MDS files created by Alcohol v2.0 or later.

Windows : https://github.com/jonblau/dpmscn/relea … x86_64.zip
Linux : https://github.com/jonblau/dpmscn/relea … _64.tar.gz

  • Registered: 2014-10-06
  • Posts: 725

Hi Nemok. I didn't look at this stuff for ages. Nice work, btw. For a reference I am attaching src of dpm module from cd archive app. It's very simple, just a PoC...

Post's attachments

alc.7z 2.7 kb, 2 downloads since 2025-03-06 

You don't have the permssions to download the attachments of this post.
  • Registered: 2023-03-03
  • Posts: 121

Thank you for sharing that code reentrant.

That's indeed the core logic involving the use of thresholds, obviously due to the analog nature of DPM. Even as is, it already worked quite well with DVDs because what you called 'readingTimeDifference' was spread across significantly less sectors than the length in sectors that's used for sampling (corresponding to the 'resolution') which made the detection of a 'range' in the same pass way more feasible. For CDs however, 2 to 3 samples are actually needed to describe that timing difference...

  • Registered: 2011-02-20
  • Posts: 1,766

@Nemok, reentrant
Good work. If only I could figure out how to calculate the 4 byte enumeration in the DPM block, I could support mdf/mds...

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2014-10-06
  • Posts: 725

Which 4 byte enumeration?

  • Registered: 2023-03-03
  • Posts: 121

reentrant wrote:

Which 4 byte enumeration?

The DPM sample itself I guess.

DPM sample     value     timing

1C 05 00 00    1308
38 0A 00 00    2616      1308
53 0F 00 00    3923      1307
6E 14 00 00    5230      1307
88 19 00 00    6536      1306
A2 1E 00 00    7842      1306
BB 23 00 00    9147      1305
D4 28 00 00    10452     1305
ED 2D 00 00    11757     1305
05 33 00 00    13061     1304
1D 38 00 00    14365     1304

sarami,
If I rely on the values you were getting in 2020, the sampling seems to be wrong in the first place :

value ?        timing ?

154.500100
154.566300     0,0662
154.758100     0,1918
154.850500     0,0924
154.853000     0,0025
155.114800     0,2618
155.013000     −0,1018
155.249500     0,2365
155.350000     0,1005
155.493100     0,1431
155.512100     0,019
155.672400     0,1603
155.690200     0,0178
155.774200     0,084
156.011200     0,237
156.051600     0,0404
156.179200     0,1276
156.326700     0,1475
156.385200     0,0585
156.486800     0,1016

These timings look inconsistent. I would be curious to see if they also vary across multiple dumps though (same disc, same drive, same settings).

  • Registered: 2011-02-20
  • Posts: 1,766

Nemok wrote:

The DPM sample itself I guess.

Ah, yes. I don't know yet how A120% outputs these values.

Nemok wrote:

These timings look inconsistent.

Yes. It's a research phase and useless.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2023-03-03
  • Posts: 121

About reverse engineering, I'm not sure that the alcohol application is the best candidate to start from. I've only recently discovered that the old .bwa file format used by Blindwrite back in 2002 was in fact storing DPM information the exact same way than the very latest Alcohol 120% version released in 2023.

The thing is that those .bwa files were created by a much smaller dedicated stand-alone program called BWA builder. Since smaller probably also means it's simpler, it might be more interesting to analyze it with Bus Hound, or even to decompile it.

  • Registered: 2014-10-06
  • Posts: 725

This is used by BWA Builder in the driver: https://learn.microsoft.com/en-us/windo … ncecounter

ULONGLONG performanceFrequency = 0;
ULONGLONG performanceCounter = KeQueryPerformanceCounter(&performanceFrequency);
ULONGLONG ticksMicroSeconds = 1000000 * performanceCounter / performanceFrequency;

I guess on APP side (before DeviceIoControl is made to ASPI driver) the same value is calculated (QueryPerformanceCounter / QueryPerformanceFrequency) and substracted after the call.

There's no driver in DIC but I think it can be emulated purely in user mode just by (QueryPerformanceCounter / QueryPerformanceFrequency) and slow read speed.