RoboCop 3 - Dongle Anti-Piracy that Failed

[Shoonay]

Originally Posted by Dastardly

Could the top level crackers themselves have created an uncrackable protection system, or is it just not possible?

Not possible. Anything one man can make other man can figure out.
Assuming you have access to it, that's why some closed systems are so hard to crack but Amiga definitely wasn't difficult to access.

[Dunny]

Originally Posted by Dastardly

Very interesting video. A lot of the techy stuff was beyond me, but it was still done in an enjoyable way.

Fascinating to hear about what went on behind the scenes back then. Could the top level crackers themselves have created an uncrackable protection system, or is it just not possible?

It's not possible. Your only hope is, as Mr Bracey said, is to delay the crackers by a couple of weeks - that way your largest proportion of sales has happened and the cracked version has a much lower impact on your profits.

Of course, this was cracked within hours so was a spectacular failure to even delay the crackers.

[AmigaHope]

The only way for a dongle to render the game near-uncrackable is if it provides some sort of enhancement to the hardware itself that the internal hardware can't do. Some sort of inexpensive but hard-to-emulate coprocessor. It can't be the same on tons of games though as eventually someone will crack it so that they all work on the same dongle, or sell a hardware replacement for it.

Consider the SuperFX chip on the SNES, it thwarted copiers pretty well. Now obviously Nintendo had the advantage of being a huge company that could roll its own silicon, but even using an off-the-shelf component would have provided a lot of deterrence to the simple schoolyard copying back in the day.

[jotd]

it could have been better by not hiding the dongle check but by using checksums to make sure that the check code wasn't altered. Or avoiding the hype altogether by using a standard protection + code checksums.

Checksums are much much stealthier, specially when you don't have an MMU or an emulator to catch reads in a given area

And of course, a failed checksum would not crash the game immediately. Just change something so the game fails after a while, becomes too hard, something subtle.

So creating a dongle wasn't much better than mastering disks that you could not copy without a hardware copier. If you can copy disks only with an hardware copier, it means that you cannot spread it electronically. and the checksums prevent you to change the code easily & convert to standard format. Lemmings had some checksums. It was cracked but I bet that it wasn't immediately.

Now it's all moot with emulation of course, but back in 1991 it was difficult to track down those checksums. If the crackers miss one protection and spread the disk(s) like that, the publishers have won (First Samurai comes to mind)

[Flimbo]

After watching a few of MVG piracy videos (there was also a great interview with Galahad on Retro Hour from a few years ago [ Show youtube player ] ) I started getting adverts for XCOPY themed merchandise on Etsy. There was also an XCOPY themed cushion

[Galahad/FLT]

Originally Posted by cynix

Interesting video, thanks. I didn't know about that dongle protection on the Amiga version.

The ST version didn't use a dongle protection, it sounds like it used the same protection as the Amiga "Platinum" version as there was lots of trace decoding encryption on the front end, a manual word protection + a special disk format that I had to convert to a normal 11 sector format to make it copyable.

Maybe when the "Platinum" version was released on the Amiga they realised how weak the dongle protection had been so just used the same protection method they'd used earlier on the ST.

The dongle checks do seem to have been very poorly implemented, to do that stuff well you need to have a 2 way communication with the game code sending data out to the dongle and the dongle sending data back that's actually used by the game code. Just checking for preset inputs as they did made it no better than a normal disk protection type check and so it could be cracked in the same way.

In all honesty, the entire protection was poorly implemented.

There was subtle variations in some of the dongle checks, but not enough to stop you finding them via either of the two tell tales that always appeared.

And the TVD encrypted code was a massive waste of time. It wasn't explained in too great detail, but I would imagine they did the same on the ST version, is they setup their one and only disk loader which wasn't encrypted at boot time, which meant you could latch onto the loader to crack the game.

Didn't even need to touch the TVD encrypted code, because the next time it accessed the very same loader, you knew the TVD had done its work and the code was now exposed for cracking.

Considering all the bragging, its was a monumentally not very well implemented protection, and its clear whoever wrote it, was getting bored toward the end because the same routines would pop up again and again.

The ones you need to watch for are the ones that don't announce themselves at all like Unreal by Ubisoft, that was some fucking work, made the protection on Robocop 3 look like a Codemasters budget game.

[m4d]

Well that was a nice watch! I had that game back then (FLT version) and me and my friends thought it was rather good. It was still the dawn of the realtime 3d gaming era and it felt modern and fresh at that time. Like the video already stated it didn't age as good as some other games though.

Cheers!

[Dastardly]

I seem to remember copied versions being about on release so even the delay of copy protection wasn't very effective it seems.

Is there a game that is universally recognised as being the toughest to crack and what made it so?

[DamienD]

I still don't think there's a working Arcticfox .ADF.

From memory Sting was working on this though.

[mcgeezer]

I'd be interested to know from @Galahad, what in his opinion was a successful copy protection time wise? For example, if a game took one week to crack then was that seen as a win for the software house or the crackers?

[jotd]

I cracked Arctic Fox, for whdload.

@mcgeezer I think if a game took 1 week to crack then yes, definitely it was a major gain to the software companies. Of course, even better if the crack missed a protection or is spread with corrupt tracks

[DamienD]

Originally Posted by jotd

I cracked Arctic Fox, for whdload.

Sure, but that's not the disk version is it?

This thread is really talking about games cracked and provided on disk from "back in the day"; which definitely excludes anything WHDLoad.

[Galahad/FLT]

Originally Posted by mcgeezer

I'd be interested to know from @Galahad, what in his opinion was a successful copy protection time wise? For example, if a game took one week to crack then was that seen as a win for the software house or the crackers?

With the exception of some of the really early stuff like Dragons Lair, no game took a week to crack unless there was a general apathy to doing it (i.e. the game was a load of crap, and a prospective cracker weighed up the effort to crack with the likelihood people would take one look at the game and copy over with something else).

Usually, something that was especially tricky would be at least a 2 day crack, and part of the problem was that if you're having a bad day with a crack, you get disenchanted with it, because you're also reasoning "X from Y group is also doing it/got it" and you're putting all this effort into something you feel you're going to get beaten on.

It was usually the one off copy protections that took the longest, with a few notable exceptions like Jurassic Park.

Developers were lazy, they reused the same disk formats over and over.

I know I wasn't alone, but I had ready built readers for: Psygnosis MFM, Arc Developments MFM, RNC PDOS, Gremlin MFM, Sensible Software MFM, Vectordean MFM and ZZKJ MFM.

Which meant that for a Team 17 game, I would just get the supplied to get me the bootblock and any AmigaDOS tracks from the first disk, that way I could get to the 32bit disk ID that was passed to the RNC PDOS loader, give the original supplier a 1k file to copy into RAM, and then it would image the disk as if it were an ADF file.

And because Team 17 were so obliging, they used rather idiotic 32bit disk ID's, disk 1 of one game was $11111111, needless to say, it took no effort to guess the disk id for disk 2 ffs!!!

But when it was a one off copy protection, you didn't have a ready built reader to image the disk(s), which put you behind right away, which is frankly, the way it should be.

And its not difficult to delay crackers even with an established MFM format, changing the SYNC mark, changing the track size even so its a few bytes less/more than the older format, changing the decoding slightly, it can take a games programmer ten minutes to change the format with no discernible problems for him and the publisher, but to a cracker, could have caused a few issues where the cracker is making an assumption on the MFM format, but its not imaging/reading properly.

OK, it might have only delayed the reading of the disks for a couple of hours, but you've just added a couple of hours and the cracker still hasn't cracked it yet.

If you can delay a crack for more than 2 days (which i'm not sure that happened), then obviously thats even better, but you're virtually guaranteed a 100% crack at that point, because some poor sod has spent all that time ensuring that it is.


If you can delay a 100% cracked version for at least 2 days, you have to figure the time it takes to get to everyone once its done, and if people see its on the shelf for sale, and their mate still hasn't got it, then obviously for some they will just go buy it.

But more than anything, if you can promote such distrust in a crack, then that can't hurt. Robocop 2 ironically took 3 attempts before NOMAD got it 100%, which I can't imagine hurt sales as those that really wanted to play it, went out and bought it.

You've got to think that it must have sold pretty well, because Ocean ensured they got each successive Robocop licence, and likely had to pay more each time, and also after the success of the first game, likely had competition to get the licence for the next one.

Some people will wait as long as they have to, to get a cracked copy, some will wait a few days, they see it in the shop and go buy it, but if the cracked version had appeared first would likely have settled for that, and some titles are just worth buying right from the start.

I know I was itching to play F-29 Retaliator, and I queued outside Woolworths at 8am on a Saturday morning so I could get it...... bugs and all!

[mcgeezer]

Originally Posted by Galahad/FLT

With the exception of some of the really early stuff like Dragons Lair, no game took a week to crack unless there was a general apathy to doing it (i.e. the game was a load of crap, and a prospective cracker weighed up the effort to crack with the likelihood people would take one look at the game and copy over with something else).

.....

Thanks for that nice response Galahad. So probably 2-3 days would be seen as a win for the software house in delaying a 100% cracked version.

What if you had a particularly long game with many levels, would you just play through every level in the game to make sure it didn't have any hidden protection checks or would you take the risk of releasing it due to time pressure?

I think you're right that there were always going to be people who would buy a game on release regardless back then, I was probably one of them as I recall queuing for Alien Breed, Pinball Dreams, Lotus, Project X and Zool...probably a few others too.

I do regret not buying Hybris and Battle Squadron or any of the Turrican games... all of which I had cracked copies of and played regular. As for the other cracked games I had...very little regret, they were simply too expensive and not worth £25 (probably upwards of £40 nowadays).

Geezer

[Galahad/FLT]

Originally Posted by mcgeezer

Thanks for that nice response Galahad. So probably 2-3 days would be seen as a win for the software house in delaying a 100% cracked version.

What if you had a particularly long game with many levels, would you just play through every level in the game to make sure it didn't have any hidden protection checks or would you take the risk of releasing it due to time pressure?

I think you're right that there were always going to be people who would buy a game on release regardless back then, I was probably one of them as I recall queuing for Alien Breed, Pinball Dreams, Lotus, Project X and Zool...probably a few others too.

I do regret not buying Hybris and Battle Squadron or any of the Turrican games... all of which I had cracked copies of and played regular. As for the other cracked games I had...very little regret, they were simply too expensive and not worth £25 (probably upwards of £40 nowadays).

Geezer

Depends on the game. Some games had lots of levels, but used the same code for every level which made life easier.

As a cracker, you have to weigh up when you've reasonably gone through the game and not encountered anything, with the likelihood that there "might" be an additional check with being hassled by the original supplier and group leader to get the game released.

Typically you could make educated guesses on games as to whether or not it had additional checks.

If it was a Teque game of a conversion for Ocean, there was virutally zero chance they'd put anything in extra other than the copylock, so once that was cracked, you would assume it was done.

Same for Arc Developments, once you got through the copylock and their custom MFM system, you were done, they didn't do anything extra.

Oddly, after Alien Breed, Team 17 didn't make much effort on protection anymore, even more oddly they adopted Rob Northen copylock and PDOS which just seemed daft to me.

Most programmers if they did do additional checks did so within the first couple of levels. I think if they had adopted checks halfway through the game, which the average player was at least sure to get to, then that could have yielded good results for the publishers, because then we as crackers would be seen as unreliable, and if its a proper mega title like Lemmings or Cannon Fodder, you absolutely HAVE to get them right, otherwise your name is pretty much fucked.

In all cases, developers needed to be subtle about their protections, but they rarely were.

The constant relying on trying to crash the Amiga, is just so ridiculous, it just screams "protection!!!", it should always be subtle.

Hook was an excellent example, Gods was not.

F-29 Retaliator was a good idea, but poorly implemented, same with Battle Command.

Sleepwalker was an excellent idea, though it still burns me that a Fairlight cracker was caught out by it, because he didn't follow the rules of cracking a Copylock, i.e. providing the game the serial key in the expected place!

[jotd]

first samurai had copylock to access level 1. then manual protection then comylock at level 4

then again at level 9 of 10 (last).

first crack i got hold of only allowed to play the first level. then i got the manual check ... and went out buying the original.

[mcgeezer]

Originally Posted by jotd

first samurai had copylock to access level 1. then manual protection then comylock at level 4

then again at level 9 of 10 (last).

first crack i got hold of only allowed to play the first level. then i got the manual check ... and went out buying the original.

I'm nearly sure the first level of that game was on a cover disk before release.

I'll have a look for it.

Edit - issue 28 of Amiga Format.

[StingRay]

Originally Posted by DamienD

I still don't think there's a working Arcticfox .ADF.

From memory Sting was working on this though.

That's correct. The game is working (completely converted to DOS files) but there's one annoying problem with the mouse pointer sprite I didn't find a good solution for yet. Thanks for the reminder, may have a look at it again in the next days.

Originally Posted by jotd

I cracked Arctic Fox, for whdload.

WHDLoad version uses a rather dirty approach to crack the protection and the protection layer is not completely removed even though that's possible once you defeat the encryption.

[malko]

I dont have a precise example in mind but at that time it seems to me that it was common for a group to "crack sugar on the back" of another group by criticizing their inability to crack a game properly, like :
" <group_name> presents <game_name> 100% !!!
Dont use <other_group_name> version as it's badly cracked, etc... "

[jotd]

I remember Silkworm: thanks to Il Scuro for providing the original (they couldn't crack it)

@Stingray I knew you were going to criticize my crack Yes, I didn't reverse the encryption / the disk check. All I did was to save memory before & after, skipped the disk check, and applied the diffs. My idea has always been "if I can copy a few kb of data and by pass the protection, then so be it". I know it hurts some people pure way of doing things, and I can understand that to some extent.

I did that a long time ago, using only an amiga and the original disk that Angus sent me. I did the same for a lot of games (sometimes failing to make it work, see LOTRS or Sinbad, that Stingray properly cracked). But for Arctic Fox, it works. Good enough.