Conference noted::hackers_v1

I'll start the discussion but I'm sure this is what the original NOTEr
intented:

First, Digital Equipment Corporation will certainly become the target of
legal actions by software vendors if specific products and a successful
violation of their copy-protection is discussed here.  Lotus Development
obtained a very favorable settlement with Rixon, a modem manufacturer,
that shamelessly broke 1-2-3's copy protection and made a wide distribution
of their software.

Secondly, NOTErs here and Richard Stallman in public press
correctly point out that using up a few cycles on some turkey's computer
doesn't exactly constitute "damage" to the owner of the computer,  especially
if the purpose of the use of the computer time is educational and no
alternative existed.

When one copies software illegally there always are two alternatives: 
(1) Don't use the software.  What's the compulsion?
(2) Pay for the software.  If the price isn't "fair", then buy a similar
package that's cheaper.

Finally, if those who argue that it's OK to rip off software, will they please
define what kind of intellectual property they would say its not OK
to rip off, or in fact are we just dealing here with petty cheapness?

Pat "not a pirate" Sweeney

Okay, a quick contribution - a certain adventure game on the TRS-80 was
protected by (a) having no DOS on the disk, just a custom-written header
(b) removing track 0 sector 2 from the format of track 0.  When the
software booted from track 0, it would check this sector - if found, it
knew it had been track-for-track copied and would not boot.

The Acornsoft game ELITE goes one stage further by having the tracks formatted
in curious ways and with non-sequential numbers - the simplest hack is to
issue commands to the disk controller to copy each track lock, stock and
barrel including any weird ID fields, CRC errors and the like.

Protecting a program on disk effectively is very hard.  DOSes that support
sophisticated protection - like, surprisingly, TRSDOS, which has up to two
passwords per file, one master password for the disk and a system whereby
a count on the disk can be decremented each time it is backed up; when it
reaches zero any files marked protected won't be copied; it also supports
execute-only access to files - can be hacked quite easily by the dedicated;
in the case of TRSDOS, it was fairly simple to produce utilities to allow
the novice user to alter the backup protection or count himself with a simple
commend.  Disks with their own loaders and weird formatting (eg ELITE, and
the adventure game) can be got round with track-for-track copying.  One
partial solution was implemented by me on a program disk currently being
sold in the UK; in addition to a serial number (stored encrypted with a check
digit) which is displayed on loading, if the program thinks it has been hacked
(backup count on disk <>0) then it goes on the offensive by formatting the
directory track!  No special message is displayed, and the drive is already
near the directory track when the software loads.  Too evil?

The previous response was written without timezone correction.  Please 
use Notes-11 or VAX Notes and define NOTES$TIMEZONE.

tom_p

	[RE .2]:  You can crack any disk by track-for-track copying and reading
a machine code dump of it.
#6	<_Jym_>\

...assuming it isn't on one of those disk drives with programmable variable
speeds and the protected program uses that fact to vary the speed of the drive.
(Some of the protection techniques used are SNEAKY!)


-Mike 

Another sneaky technique which doesn't require the exotic drives mentioned
in -1 (well, not so exotic - my MAC has two of them) is to "skew" the tracks
- that is, to begin the track at some known offset from the timing hole on
the disk, and then to have the software check for the delay.  Track copy
routines generally don't allow for this offset, since it usually is without
meaning and can adversely affect access time.  "Track copies" generally (but
not always) copy such security features as bad index and address marks. 
These "features" will never show up in a dump - neither will deviations from
standard sector or header formats.  These copy-protection techniques will
throw a standard disk driver into a tailspin, but most protected programs
don't actually use these "bad" tracks and sectors - they merely check for
their existence during the initialization procedure, then make sure that
the O/S avoids them thereafter.
                                                             

    re .2: trashing a disk when a copy is 'detected'
    
    Yes, I think it is too evil, unless you are willing to replace the
    disk FREE OF CHARGE (including postage reimbursement) 
    when this happens to a legitimate disk. (If it is a serious program,
    the company should also be liable for incidental damage to the purchaser.)
    
    I had a copy of WIZARDRY by SIR-TECH Software trash itself within
    a month after I bought it, when the write-protect switch on my drive
    failed, and the drive was out of alignment sufficiently for it to
    think it was a copy.  The drive worked perfectly for Apple software:
    it was just far enough off to fail with the protection scheme used.
    This was a game, so it did not cause me great loss, but it was still
    annoying.
        
    The scheme you describe could cause severe problems for a business
    relying on that program, especially if data were on the same disk.
    We all know how important backups are, so I am against copy protected
    business software, as it can then cause a business to lose quite
    a bit of money. Imagine if a tax preparation program failed just
    before tax time. It would at least cost additional interest charges
    to accumulate while a new copy is ordered.