1 (edited by reentrant 2018-03-06 21:01:09)

Hello,
   After some small research I managed to make use of DPM data stored inside MDS file. For this purpose a small helper tool was created: CDArchive (in the attachment)

Example game: http://redump.org/disc/38911/

Basically the result of the tool is this info:

DPM Resolution: 256 // It means that there's one sample of info for each 256 sectors block
DPM Entries: 8037 // 8037 * 256 = how many sectors are covered in this DPM analysis session (could be smaller by few sectors than image size)
DPM Start Sector: 0 // No comment

DPM Data: 0 0 0 2253 // Format: <IsInsideDPMBlock> <SectorStart> <SectorDensityDifference> <SectorReadingTimeUs>
DPM Data: 0 256 -1 2252 // The key thing here is SectorDensityDifference - it's used to detect start and end of DPM range
DPM Data: 0 512 -1 2251 // DPM start area has always positive difference and end area has always negative difference
...
...
...
DPM Data: 0 5888 0 2239
DPM Data: 0 6144 -1 2238
DPM Data: 0 6400 -1 2237
DPM Data: 0 6656 0 2237
DPM Data: 1 6912 29 2266 // DPM area start here
DPM Data: 1 7168 -2 2264
DPM Data: 1 7424 1 2265
DPM Data: 1 7680 -2 2263
DPM Data: 1 7936 0 2263
DPM Data: 1 8192 -1 2262
DPM Data: 1 8448 0 2262
DPM Data: 1 8704 -1 2261
DPM Data: 1 8960 0 2261
DPM Data: 1 9216 -1 2260
DPM Data: 1 9472 -1 2259
DPM Data: 1 9728 0 2259 // DPM area ends here
DPM Data: 0 9984 -30 2229
DPM Data: 0 10240 -1 2228
DPM Data: 0 10496 0 222
...
DPM Data: 0 2056704 -1 970

DPM Range: 6912 - 9984 = 3072 [+29 -30]
DPM Range: 14592 - 17408 = 2816 [+30 -30]
DPM Range: 18688 - 19968 = 1280 [+29 -30]
DPM Range: 21504 - 24576 = 3072 [+29 -31]
DPM Range: 27136 - 30464 = 3328 [+27 -29]
DPM Range: 36096 - 37632 = 1536 [+28 -29]
DPM Range: 43264 - 46080 = 2816 [+29 -29]
DPM Range: 50176 - 56320 = 6144 [+27 -29]
DPM Range: 58624 - 60160 = 1536 [+28 -29]
DPM Range: 61952 - 63232 = 1280 [+28 -29]
DPM Range: 64768 - 70912 = 6144 [+28 -28]
DPM Range: 71680 - 77824 = 6144 [+27 -28]
DPM Range: 78848 - 82432 = 3584 [+27 -27]
DPM Range: 93440 - 95232 = 1792 [+26 -27]
DPM Range: 96256 - 100608 = 4352 [+27 -28]
DPM Range: 103680 - 105216 = 1536 [+27 -27]
DPM Range: 107520 - 111104 = 3584 [+27 -28]
DPM Range: 113920 - 115200 = 1280 [+27 -28]
DPM Range: 116480 - 120832 = 4352 [+26 -26]
DPM Range: 122112 - 124160 = 2048 [+26 -27]
DPM Range: 124928 - 128512 = 3584 [+26 -28]
DPM Range: 131072 - 136960 = 5888 [+26 -28]
DPM Range: 276736 - 280320 = 3584 [+23 -24]
DPM Range: 284160 - 287488 = 3328 [+23 -24]
DPM Range: 288768 - 290048 = 1280 [+23 -23]
DPM Range: 291328 - 294400 = 3072 [+22 -23]
DPM Range: 296960 - 300288 = 3328 [+23 -24]
DPM Range: 305664 - 307712 = 2048 [+22 -23]
DPM Range: 313088 - 316160 = 3072 [+24 -23]
DPM Range: 320512 - 326144 = 5632 [+22 -23]
DPM Range: 328960 - 330496 = 1536 [+23 -24]
DPM Range: 332032 - 333824 = 1792 [+22 -23]
DPM Range: 334336 - 340736 = 6400 [+23 -24]
DPM Range: 342016 - 347648 = 5632 [+22 -23]
DPM Range: 349184 - 352000 = 2816 [+23 -23]
DPM Range: 363520 - 365056 = 1536 [+22 -23]
DPM Range: 366080 - 370688 = 4608 [+21 -23]
DPM Range: 373504 - 375296 = 1792 [+21 -22]
DPM Range: 377856 - 381184 = 3328 [+23 -22]
DPM Range: 383488 - 385280 = 1792 [+23 -22]
DPM Range: 386560 - 390912 = 4352 [+22 -21]
DPM Range: 392192 - 393984 = 1792 [+21 -23]
DPM Range: 395264 - 398336 = 3072 [+22 -22]
DPM Range: 400896 - 406784 = 5888 [+22 -23]
DPM Range: 547328 - 550144 = 2816 [+21 -19]
DPM Range: 553984 - 557056 = 3072 [+20 -20]
DPM Range: 558592 - 560128 = 1536 [+20 -20]
DPM Range: 561408 - 564480 = 3072 [+21 -19]
DPM Range: 567552 - 570112 = 2560 [+19 -21]
DPM Range: 575744 - 577536 = 1792 [+19 -20]
DPM Range: 582912 - 586240 = 3328 [+19 -21]
DPM Range: 590336 - 595968 = 5632 [+20 -20]
DPM Range: 599040 - 600832 = 1792 [+20 -20]
DPM Range: 601856 - 603392 = 1536 [+19 -19]
DPM Range: 604672 - 610816 = 6144 [+20 -21]
DPM Range: 611840 - 617728 = 5888 [+20 -20]
DPM Range: 619264 - 622080 = 2816 [+19 -19]
DPM Range: 633600 - 635136 = 1536 [+20 -20]
DPM Range: 636416 - 640512 = 4096 [+18 -18]
DPM Range: 643584 - 645376 = 1792 [+18 -20]
DPM Range: 647936 - 650752 = 2816 [+20 -19]
DPM Range: 653824 - 655104 = 1280 [+19 -19]
DPM Range: 656640 - 661248 = 4608 [+19 -19]
DPM Range: 662016 - 663808 = 1792 [+18 -19]
DPM Range: 665600 - 668416 = 2816 [+19 -20]
DPM Range: 670720 - 677120 = 6400 [+19 -19]
DPM Range: 816896 - 820224 = 3328 [+17 -17]
DPM Range: 824320 - 827136 = 2816 [+17 -18]
DPM Range: 828416 - 829952 = 1536 [+17 -17]
DPM Range: 831488 - 834304 = 2816 [+17 -17]
DPM Range: 837120 - 840192 = 3072 [+17 -17]
DPM Range: 845568 - 847360 = 1792 [+17 -17]
DPM Range: 852992 - 856064 = 3072 [+17 -18]
DPM Range: 860160 - 866304 = 6144 [+16 -16]
DPM Range: 869120 - 870400 = 1280 [+17 -18]
DPM Range: 871936 - 873216 = 1280 [+18 -19]
DPM Range: 874496 - 880640 = 6144 [+17 -17]
DPM Range: 881920 - 887808 = 5888 [+17 -17]
DPM Range: 888832 - 892416 = 3584 [+17 -18]
DPM Range: 903680 - 905216 = 1536 [+17 -17]
DPM Range: 906240 - 910592 = 4352 [+17 -18]
DPM Range: 913664 - 915200 = 1536 [+17 -18]
DPM Range: 918016 - 921088 = 3072 [+17 -18]
DPM Range: 923648 - 925440 = 1792 [+17 -18]
DPM Range: 926720 - 931072 = 4352 [+17 -17]
DPM Range: 932352 - 933888 = 1536 [+18 -18]
DPM Range: 934912 - 938240 = 3328 [+17 -18]
DPM Range: 940800 - 946688 = 5888 [+17 -17]
DPM Ranges Count: 88

So as you see I managed to identify 88 areas with smaller density on the disc. I'd like to see this info in the DB someday. There's also a possibility to generate MDS file with this info (or rather patch existing MDS with this info).

Supported protections:
- SecuROM

To Check:
- Tages Twin Sectors
- StarForce

Tool usage: CDArchive -x i -d <SomeDirectory (not used)> -a <mdsFilePath> <minDensityDifference> <minDpmRangeLenSectors>

Example: CDArchive -x i -d D:\Test -a D:\Test\gta.mds 10 100

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Post's attachments

CDArchive.rar 194.84 kb, 12 downloads since 2018-02-05 

gta.rar 4.47 kb, 7 downloads since 2018-02-05 

gtasa.rar 30.16 kb, 6 downloads since 2018-02-05 

You don't have the permssions to download the attachments of this post.

reentrant wrote:

it has some other functions like ripping sectors which require admin.

What function is it?

I think CreateFile requires admin to open device E: for write access (required by SPTI).

Great tool and research!

Tool must be run as admin because it has some other functions like ripping sectors which require admin.

Does that mean that the tool has the ability to rip the DPM information from the CD/DVD itself?

No, it's just the tool to get the data from MDS.

Tested. (Alcohol 52% 2.0.3 Build 10203) (Plextor PX-755SA)
1: Inugami.mds http://redump.org/disc/25198/
This disc has Starforce and 52% says "Detected DPM".

DPM Ranges Count: 0

2: MS_FANDISK.mds http://redump.org/disc/18729/
This disc has Starforce and 52% says "Detected DPM".

DPM Range: 99500 - 100000 = 500 [+16 -25]
DPM Range: 178000 - 178500 = 500 [+11 -17]
DPM Ranges Count: 2

3. Audio CD.mds
This disc hasn't a protect and 52% say "Can't detect DPM".

DPM Range: 223500 - 224000 = 500 [+12 -15]
DPM Ranges Count: 1
Post's attachments

test.7z 15.36 kb, 4 downloads since 2018-02-12 

You don't have the permssions to download the attachments of this post.

7 (edited by reentrant 2018-02-12 23:50:33)

I haven't tested yet CDs smile

The data in your logs doesn't look promising. What speed have you read your discs at?

8 (edited by Jackal 2018-09-12 18:48:58)

Bump.. there was a discussion on discord about (the lack of) DPM preservation.

Jackal:
they are basically read timings that vary for each drive and read speed, so we can't just store this info in a database
I dont see any way of producing "verifiable" DPM data, unless we start rounding off the timings

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

@reentrant + sarami.. do you have any idea on how we could achieve verifiable results between different drives and speeds?

Maybe we could all buy the same game(s), then dump it with different speeds and drives, and see if there is a graph that could be generated by some standard algoritm? And also test different minimum and maximum values to to find any boundaries in the protection.

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

Jackal wrote:

F1ReB4LL:
I remember tools that draw some graph based on those values, then let you to anti-alias it
Then fix the values according to the new graph

That tool was Advanced MDS Editor, btw - http://waper.ru/file/518320/download/7e … dit055.zip

Jackal wrote:

And I'm guessing that there are no known cases of someone obtaining valid DPM ranges by reverse engineering any game executables?

https://defacto2.net/d/b2233ae?filename=rld-sfrt.zip -- try to dig here

Technically, if someone leaks the 'main' StarForce tool some day, it should be possible to generate a new key for any image/burned disc.

I researched Alcohol 52% using Bus Hound 6.01 and added a measurement function in DIC.
http://www.mediafire.com/file/w2p4z8cps … pm.7z/file

This function outputs read time in _disc.txt like this.

========== Data Position Measurement (DPM) ==========
Entry: 1798, Resolution: 50
---------------------------
   1 (     0), ReadTime 154.500100[msec]
   2 (    50), ReadTime 154.566300[msec]
   3 (   100), ReadTime 154.758100[msec]
   4 (   150), ReadTime 154.850500[msec]
   5 (   200), ReadTime 154.853000[msec]
   6 (   250), ReadTime 155.114800[msec]
   7 (   300), ReadTime 155.013000[msec]
   8 (   350), ReadTime 155.249500[msec]
   9 (   400), ReadTime 155.350000[msec]
  10 (   450), ReadTime 155.493100[msec]
  11 (   500), ReadTime 155.512100[msec]
  12 (   550), ReadTime 155.672400[msec]
  13 (   600), ReadTime 155.690200[msec]
  14 (   650), ReadTime 155.774200[msec]
  15 (   700), ReadTime 156.011200[msec]
  16 (   750), ReadTime 156.051600[msec]
  17 (   800), ReadTime 156.179200[msec]
  18 (   850), ReadTime 156.326700[msec]
  19 (   900), ReadTime 156.385200[msec]
  20 (   950), ReadTime 156.486800[msec]
:
:

CD: reading speed is 4x. resolution is 50.
DVD: reading speed is 4x. resolution is 256.

There is not a special flag to get this log.
CD

DiscImageCreator.exe cd <driveletter> <filename> <drivespeed>

DVD

DiscImageCreator.exe dvd <driveletter> <filename> <drivespeed>

**TODO**
1. I don't know how to convert this reading time to DPM data.

Oh nice sarami, glad to see you working on this! smile

Plextor PX-760A 1.07 (+30) : Plextor PX-716SA 1.11 (+30) : Plextor PX-W5224A 1.04 (+30) : Plextor PX-W4824 1.07 (+30) : Plextor PX-W4012TA 1.07 (+98) : Plextor PX-W1610TA (+99) : Plextor PX-W1210TA 1.10 (+99) : Lite-On LTR-48246S (+6) : Lite-On LTR-52246S (+6) : Lite-On LH-20A1H LL0DN (+6) : BenQ DW1655 BCIB (+618) : ASUS DRW-2014L1 1.02 (+6) : Yamaha CRW-F1 (+733) : Optiarc SA-7290H5 1H44 (+48) : ASUS BW-16D1HT 3.02 (+6)

12 (edited by Jackal 2020-04-07 05:31:13)

Do we have anybody who would be able to extract a DPM "signature" from the executable? That way we would be able to get the exact timing ranges that the game is looking for.

Memo
----
. SecuROM DLL (Sintf16.dll, Sintf32.dll, SintfNT.dll) is combined in the exe of SecuROM 4.xx disc.
. These dlls are being compressed by petite (https://www.un4seen.com/petite/) and can decompress by enlarger v1.3 (http://www.angelfire.com/electronic/oldskool/stuff.htm)
. If someone can disassemble these dlls, it may be revealed what it is.

Rib ran a patent search for SecuROM, document here https://patentimages.storage.googleapis … 2631A1.pdf

Rib/Wiggy2k found the one for CDilla/SafeDisc as well here https://patentimages.storage.googleapis … 353890.pdf

Plextor PX-760A 1.07 (+30) : Plextor PX-716SA 1.11 (+30) : Plextor PX-W5224A 1.04 (+30) : Plextor PX-W4824 1.07 (+30) : Plextor PX-W4012TA 1.07 (+98) : Plextor PX-W1610TA (+99) : Plextor PX-W1210TA 1.10 (+99) : Lite-On LTR-48246S (+6) : Lite-On LTR-52246S (+6) : Lite-On LH-20A1H LL0DN (+6) : BenQ DW1655 BCIB (+618) : ASUS DRW-2014L1 1.02 (+6) : Yamaha CRW-F1 (+733) : Optiarc SA-7290H5 1H44 (+48) : ASUS BW-16D1HT 3.02 (+6)