1 Topic by reentrant (edited by reentrant 2018-03-06 21:01:09)

  • Registered: 2014-10-06
  • Posts: 705

Hello,
   After some small research I managed to make use of DPM data stored inside MDS file. For this purpose a small helper tool was created: CDArchive (in the attachment)

Example game: http://redump.org/disc/38911/

Basically the result of the tool is this info:

DPM Resolution: 256 // It means that there's one sample of info for each 256 sectors block
DPM Entries: 8037 // 8037 * 256 = how many sectors are covered in this DPM analysis session (could be smaller by few sectors than image size)
DPM Start Sector: 0 // No comment

DPM Data: 0 0 0 2253 // Format: <IsInsideDPMBlock> <SectorStart> <SectorDensityDifference> <SectorReadingTimeUs>
DPM Data: 0 256 -1 2252 // The key thing here is SectorDensityDifference - it's used to detect start and end of DPM range
DPM Data: 0 512 -1 2251 // DPM start area has always positive difference and end area has always negative difference
...
...
...
DPM Data: 0 5888 0 2239
DPM Data: 0 6144 -1 2238
DPM Data: 0 6400 -1 2237
DPM Data: 0 6656 0 2237
DPM Data: 1 6912 29 2266 // DPM area start here
DPM Data: 1 7168 -2 2264
DPM Data: 1 7424 1 2265
DPM Data: 1 7680 -2 2263
DPM Data: 1 7936 0 2263
DPM Data: 1 8192 -1 2262
DPM Data: 1 8448 0 2262
DPM Data: 1 8704 -1 2261
DPM Data: 1 8960 0 2261
DPM Data: 1 9216 -1 2260
DPM Data: 1 9472 -1 2259
DPM Data: 1 9728 0 2259 // DPM area ends here
DPM Data: 0 9984 -30 2229
DPM Data: 0 10240 -1 2228
DPM Data: 0 10496 0 222
...
DPM Data: 0 2056704 -1 970

DPM Range: 6912 - 9984 = 3072 [+29 -30]
DPM Range: 14592 - 17408 = 2816 [+30 -30]
DPM Range: 18688 - 19968 = 1280 [+29 -30]
DPM Range: 21504 - 24576 = 3072 [+29 -31]
DPM Range: 27136 - 30464 = 3328 [+27 -29]
DPM Range: 36096 - 37632 = 1536 [+28 -29]
DPM Range: 43264 - 46080 = 2816 [+29 -29]
DPM Range: 50176 - 56320 = 6144 [+27 -29]
DPM Range: 58624 - 60160 = 1536 [+28 -29]
DPM Range: 61952 - 63232 = 1280 [+28 -29]
DPM Range: 64768 - 70912 = 6144 [+28 -28]
DPM Range: 71680 - 77824 = 6144 [+27 -28]
DPM Range: 78848 - 82432 = 3584 [+27 -27]
DPM Range: 93440 - 95232 = 1792 [+26 -27]
DPM Range: 96256 - 100608 = 4352 [+27 -28]
DPM Range: 103680 - 105216 = 1536 [+27 -27]
DPM Range: 107520 - 111104 = 3584 [+27 -28]
DPM Range: 113920 - 115200 = 1280 [+27 -28]
DPM Range: 116480 - 120832 = 4352 [+26 -26]
DPM Range: 122112 - 124160 = 2048 [+26 -27]
DPM Range: 124928 - 128512 = 3584 [+26 -28]
DPM Range: 131072 - 136960 = 5888 [+26 -28]
DPM Range: 276736 - 280320 = 3584 [+23 -24]
DPM Range: 284160 - 287488 = 3328 [+23 -24]
DPM Range: 288768 - 290048 = 1280 [+23 -23]
DPM Range: 291328 - 294400 = 3072 [+22 -23]
DPM Range: 296960 - 300288 = 3328 [+23 -24]
DPM Range: 305664 - 307712 = 2048 [+22 -23]
DPM Range: 313088 - 316160 = 3072 [+24 -23]
DPM Range: 320512 - 326144 = 5632 [+22 -23]
DPM Range: 328960 - 330496 = 1536 [+23 -24]
DPM Range: 332032 - 333824 = 1792 [+22 -23]
DPM Range: 334336 - 340736 = 6400 [+23 -24]
DPM Range: 342016 - 347648 = 5632 [+22 -23]
DPM Range: 349184 - 352000 = 2816 [+23 -23]
DPM Range: 363520 - 365056 = 1536 [+22 -23]
DPM Range: 366080 - 370688 = 4608 [+21 -23]
DPM Range: 373504 - 375296 = 1792 [+21 -22]
DPM Range: 377856 - 381184 = 3328 [+23 -22]
DPM Range: 383488 - 385280 = 1792 [+23 -22]
DPM Range: 386560 - 390912 = 4352 [+22 -21]
DPM Range: 392192 - 393984 = 1792 [+21 -23]
DPM Range: 395264 - 398336 = 3072 [+22 -22]
DPM Range: 400896 - 406784 = 5888 [+22 -23]
DPM Range: 547328 - 550144 = 2816 [+21 -19]
DPM Range: 553984 - 557056 = 3072 [+20 -20]
DPM Range: 558592 - 560128 = 1536 [+20 -20]
DPM Range: 561408 - 564480 = 3072 [+21 -19]
DPM Range: 567552 - 570112 = 2560 [+19 -21]
DPM Range: 575744 - 577536 = 1792 [+19 -20]
DPM Range: 582912 - 586240 = 3328 [+19 -21]
DPM Range: 590336 - 595968 = 5632 [+20 -20]
DPM Range: 599040 - 600832 = 1792 [+20 -20]
DPM Range: 601856 - 603392 = 1536 [+19 -19]
DPM Range: 604672 - 610816 = 6144 [+20 -21]
DPM Range: 611840 - 617728 = 5888 [+20 -20]
DPM Range: 619264 - 622080 = 2816 [+19 -19]
DPM Range: 633600 - 635136 = 1536 [+20 -20]
DPM Range: 636416 - 640512 = 4096 [+18 -18]
DPM Range: 643584 - 645376 = 1792 [+18 -20]
DPM Range: 647936 - 650752 = 2816 [+20 -19]
DPM Range: 653824 - 655104 = 1280 [+19 -19]
DPM Range: 656640 - 661248 = 4608 [+19 -19]
DPM Range: 662016 - 663808 = 1792 [+18 -19]
DPM Range: 665600 - 668416 = 2816 [+19 -20]
DPM Range: 670720 - 677120 = 6400 [+19 -19]
DPM Range: 816896 - 820224 = 3328 [+17 -17]
DPM Range: 824320 - 827136 = 2816 [+17 -18]
DPM Range: 828416 - 829952 = 1536 [+17 -17]
DPM Range: 831488 - 834304 = 2816 [+17 -17]
DPM Range: 837120 - 840192 = 3072 [+17 -17]
DPM Range: 845568 - 847360 = 1792 [+17 -17]
DPM Range: 852992 - 856064 = 3072 [+17 -18]
DPM Range: 860160 - 866304 = 6144 [+16 -16]
DPM Range: 869120 - 870400 = 1280 [+17 -18]
DPM Range: 871936 - 873216 = 1280 [+18 -19]
DPM Range: 874496 - 880640 = 6144 [+17 -17]
DPM Range: 881920 - 887808 = 5888 [+17 -17]
DPM Range: 888832 - 892416 = 3584 [+17 -18]
DPM Range: 903680 - 905216 = 1536 [+17 -17]
DPM Range: 906240 - 910592 = 4352 [+17 -18]
DPM Range: 913664 - 915200 = 1536 [+17 -18]
DPM Range: 918016 - 921088 = 3072 [+17 -18]
DPM Range: 923648 - 925440 = 1792 [+17 -18]
DPM Range: 926720 - 931072 = 4352 [+17 -17]
DPM Range: 932352 - 933888 = 1536 [+18 -18]
DPM Range: 934912 - 938240 = 3328 [+17 -18]
DPM Range: 940800 - 946688 = 5888 [+17 -17]
DPM Ranges Count: 88

So as you see I managed to identify 88 areas with smaller density on the disc. I'd like to see this info in the DB someday. There's also a possibility to generate MDS file with this info (or rather patch existing MDS with this info).

Supported protections:
- SecuROM

To Check:
- Tages Twin Sectors
- StarForce

Tool usage: CDArchive -x i -d <SomeDirectory (not used)> -a <mdsFilePath> <minDensityDifference> <minDpmRangeLenSectors>

Example: CDArchive -x i -d D:\Test -a D:\Test\gta.mds 10 100

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Post's attachments

CDArchive.rar 194.84 kb, 63 downloads since 2018-02-05 

gta.rar 4.47 kb, 54 downloads since 2018-02-05 

gtasa.rar 30.16 kb, 44 downloads since 2018-02-05 

You don't have the permssions to download the attachments of this post.
  • Registered: 2011-02-20
  • Posts: 1,749

reentrant wrote:

it has some other functions like ripping sectors which require admin.

What function is it?

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Registered: 2014-10-06
  • Posts: 705

I think CreateFile requires admin to open device E: for write access (required by SPTI).

  • Registered: 2018-01-04
  • Posts: 132

Great tool and research!

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Does that mean that the tool has the ability to rip the DPM information from the CD/DVD itself?

ASUS BW-16D1HT 3.10 (Ribshark firmware) | Plextor W4012TA | LiteOn SOHD-167T | Sony Optiarc AD-7290H
  • Registered: 2014-10-06
  • Posts: 705

No, it's just the tool to get the data from MDS.

  • Registered: 2011-02-20
  • Posts: 1,749

Tested. (Alcohol 52% 2.0.3 Build 10203) (Plextor PX-755SA)
1: Inugami.mds http://redump.org/disc/25198/
This disc has Starforce and 52% says "Detected DPM".

DPM Ranges Count: 0

2: MS_FANDISK.mds http://redump.org/disc/18729/
This disc has Starforce and 52% says "Detected DPM".

DPM Range: 99500 - 100000 = 500 [+16 -25]
DPM Range: 178000 - 178500 = 500 [+11 -17]
DPM Ranges Count: 2

3. Audio CD.mds
This disc hasn't a protect and 52% say "Can't detect DPM".

DPM Range: 223500 - 224000 = 500 [+12 -15]
DPM Ranges Count: 1
Post's attachments

test.7z 15.36 kb, 24 downloads since 2018-02-12 

You don't have the permssions to download the attachments of this post.
DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

7 Reply by reentrant (edited by reentrant 2018-02-12 23:50:33)

  • Registered: 2014-10-06
  • Posts: 705

I haven't tested yet CDs smile

The data in your logs doesn't look promising. What speed have you read your discs at?

8 Reply by Jackal (edited by Jackal 2018-09-12 18:48:58)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

Bump.. there was a discussion on discord about (the lack of) DPM preservation.

Jackal:
they are basically read timings that vary for each drive and read speed, so we can't just store this info in a database
I dont see any way of producing "verifiable" DPM data, unless we start rounding off the timings

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

@reentrant + sarami.. do you have any idea on how we could achieve verifiable results between different drives and speeds?

Maybe we could all buy the same game(s), then dump it with different speeds and drives, and see if there is a graph that could be generated by some standard algoritm? And also test different minimum and maximum values to to find any boundaries in the protection.

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

  • Registered: 2006-12-24
  • Posts: 3,847

Jackal wrote:

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

That tool was Advanced MDS Editor, btw - http://waper.ru/file/518320/download/7e … dit055.zip

Jackal wrote:

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

https://defacto2.net/d/b2233ae?filename=rld-sfrt.zip -- try to dig here

Technically, if someone leaks the 'main' StarForce tool some day, it should be possible to generate a new key for any image/burned disc.

  • Registered: 2011-02-20
  • Posts: 1,749

I researched Alcohol 52% using Bus Hound 6.01 and added a measurement function in DIC.
http://www.mediafire.com/file/w2p4z8cps … pm.7z/file

This function outputs read time in _disc.txt like this.

========== Data Position Measurement (DPM) ==========
Entry: 1798, Resolution: 50
---------------------------
   1 (     0), ReadTime 154.500100[msec]
   2 (    50), ReadTime 154.566300[msec]
   3 (   100), ReadTime 154.758100[msec]
   4 (   150), ReadTime 154.850500[msec]
   5 (   200), ReadTime 154.853000[msec]
   6 (   250), ReadTime 155.114800[msec]
   7 (   300), ReadTime 155.013000[msec]
   8 (   350), ReadTime 155.249500[msec]
   9 (   400), ReadTime 155.350000[msec]
  10 (   450), ReadTime 155.493100[msec]
  11 (   500), ReadTime 155.512100[msec]
  12 (   550), ReadTime 155.672400[msec]
  13 (   600), ReadTime 155.690200[msec]
  14 (   650), ReadTime 155.774200[msec]
  15 (   700), ReadTime 156.011200[msec]
  16 (   750), ReadTime 156.051600[msec]
  17 (   800), ReadTime 156.179200[msec]
  18 (   850), ReadTime 156.326700[msec]
  19 (   900), ReadTime 156.385200[msec]
  20 (   950), ReadTime 156.486800[msec]
:
:

CD: reading speed is 4x. resolution is 50.
DVD: reading speed is 4x. resolution is 256.

There is not a special flag to get this log.
CD

DiscImageCreator.exe cd <driveletter> <filename> <drivespeed>

DVD

DiscImageCreator.exe dvd <driveletter> <filename> <drivespeed>

**TODO**
1. I don't know how to convert this reading time to DPM data.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Nexy
  • Nexy
  • Dumper
  • Offline
  • Registered: 2009-10-24
  • Posts: 867

Oh nice sarami, glad to see you working on this! smile

Plextor PX-760A 1.07 (+30) : Plextor PX-716SA 1.11 (+30) : Plextor PX-W5224A 1.04 (+30) : Plextor PX-W4824 1.07 (+30) : Plextor PX-W4012TA 1.07 (+98) : Plextor PX-W1610TA (+99) : Plextor PX-W1210TA 1.10 (+99) : Lite-On LTR-48246S (+6) : Lite-On LTR-52246S (+6) : Lite-On LH-20A1H LL0DN (+6) : BenQ DW1655 BCIB (+618) : ASUS DRW-2014L1 1.02 (+6) : Yamaha CRW-F1 (+733) : Optiarc SA-7290H5 1H44 (+48) : ASUS BW-16D1HT 3.02 (+6)

12 Reply by Jackal (edited by Jackal 2020-04-07 05:31:13)

  • Jackal
  • Moderator (Retired)
  • Offline
  • Registered: 2006-12-23
  • Posts: 4,132

Do we have anybody who would be able to extract a DPM "signature" from the executable? That way we would be able to get the exact timing ranges that the game is looking for.

  • Registered: 2011-02-20
  • Posts: 1,749

Memo
----
. SecuROM DLL (Sintf16.dll, Sintf32.dll, SintfNT.dll) is combined in the exe of SecuROM 4.xx disc.
. These dlls are being compressed by petite (https://www.un4seen.com/petite/) and can decompress by enlarger v1.3 (http://www.angelfire.com/electronic/oldskool/stuff.htm)
. If someone can disassemble these dlls, it may be revealed what it is.

DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), recompressTo7z_20150109.bat

sarami's Website

  • Nexy
  • Nexy
  • Dumper
  • Offline
  • Registered: 2009-10-24
  • Posts: 867

Rib ran a patent search for SecuROM, document here https://patentimages.storage.googleapis … 2631A1.pdf

Rib/Wiggy2k found the one for CDilla/SafeDisc as well here https://patentimages.storage.googleapis … 353890.pdf

Plextor PX-760A 1.07 (+30) : Plextor PX-716SA 1.11 (+30) : Plextor PX-W5224A 1.04 (+30) : Plextor PX-W4824 1.07 (+30) : Plextor PX-W4012TA 1.07 (+98) : Plextor PX-W1610TA (+99) : Plextor PX-W1210TA 1.10 (+99) : Lite-On LTR-48246S (+6) : Lite-On LTR-52246S (+6) : Lite-On LH-20A1H LL0DN (+6) : BenQ DW1655 BCIB (+618) : ASUS DRW-2014L1 1.02 (+6) : Yamaha CRW-F1 (+733) : Optiarc SA-7290H5 1H44 (+48) : ASUS BW-16D1HT 3.02 (+6)
  • Registered: 2023-03-03
  • Posts: 112

Hello reentrant

Having also tried cdarchive for a cd, some 'ranges' appear to be missing. I was able to visually identify 4x25=100 'spikes' on the graph drawn by alcohol, but the program only saw 34 according to the ranges count. The 'data' values clearly differ from the example you had given when approaching one 'area' :

DPM Data: 0 1550 -1 1304
DPM Data: 0 1600 1 1305
DPM Data: 0 1650 1 1306
DPM Data: 1 1700 15 1321
DPM Data: 0 1750 17 1338
DPM Data: 0 1800 4 1342
DPM Data: 0 1850 1 1343

There's a second positive 'sector density difference' right after the first one here, so that could partially explain the issue? A resolution of 1 value every 50 sectors used by the high precision sampling is way more likely to have this case.

Maybe you already fixed it since the thread was created. By the way, have you found how to patch a MDS file?

Post's attachments

results.7z 32.62 kb, 15 downloads since 2023-03-17 

You don't have the permssions to download the attachments of this post.

16 Reply by Nemok (edited by Nemok 2023-12-04 06:40:29)

  • Registered: 2023-03-03
  • Posts: 112

For anyone that still tries to get the best DPM approximation possible.

I have written a small bash script program that moves the DPM content into an old format MDS container (convert). This allows manual editing of the DPM values with Advanced MDS editor 0.5.5 and BWA edit 1.1 since these are incompatible with what the latest Alcohol releases create. The edited DPM content may then be put back inside its new format container (rebuild).

Post's attachments

convert.zip 1.26 kb, 8 downloads since 2023-12-04 

rebuild.zip 417 b, 6 downloads since 2023-12-04 

You don't have the permssions to download the attachments of this post.