Tweet
First, four notes:
1. I didn't invent 95% of this - very smart people in Russia did.
2. It works ONLY if you have the original game on CD, not DVD.
3. This method is for ADVANCED USERS ONLY.
4. I don't know a single free bus analyzer for Windows so this method is more expensive in the long term than simply buying two copies of the game and using the other as backup. Maybe there are such tools for Linux?
4.1. SFCure is a nice hack but it's still a hack. It's code actually redirects calls to dt driver/netbt/classpn.sys functions from io(f)calldriver and sets their adress as it's own return address in stack (to simulate call). But before ending, it adds 4 to address so first instruction of target function is not executed. The next Starforce version will fix this, they seem to simply missed this call in their FS protection driver. This method should survive the SF 3.x generation.
OK, now to make a working backup CD (image won't work) you'll first need:
-the original game in CD format
-CD-R(W) burner capable of 2448 bytes RAW+SUB format and overburning
-get a SCSI-/USB CD READER or put one on a RAID card. IDE/SATA won't work. CD-RW won't work!
-download tools sfcdvd and sfmdf.
-get a bus monitoring tool like bushound or bustrace, virtual PC emulators' logging won't work. Disk-/Filemon won't either (too high level: the Starforce driver interferes). Starwind trial works if you patch it to allow local connections, use logging level 4 and MS iSCSI client 1.06 or newer.
Bushound costs $800.
First: uninstall Daemon Tools, Alcohol, Blindwrite and CloneCD, anything else that might be blacklisted. Don't use Starfuck or any other anti-blacklisting tools. Uninstall SFCure if installed. Physically remove your CD-RW drive. Disable data execution protection if running XP SP2 (the NX bit stuff).
Alcohol 120% DPM data is too inaccurate for Starforce so we'll need to get good DPMS data first. Before measuring install the game from your READER and make sure it works fine from your drive. Leave your original in your drive, start your bus monitor and run:
sfcdvd //./x: myfavoritegame.cfg
Replace x: with your drive letter.
The measurement will take 2-3 minutes.
After that run sfcdvd //./x: myfavoritegame2.cfg
Now stop logging and open the .cfg files, then find the sector numbers mentioned there on your bustrace log. You'll find a key on one of those sectors, make sure to write it down!
Then from both .cfg files get the timing data, average them and write results to a new file myfavoritegame3.cfg
File format is as follows:
Block 1: CD label
Block 2: fake CD key, ignore this
Block 3: beginning of DPM check
Block 4: sectors per track (average this line!)
Block 5: end of DPM check
The deviation must not exceed 0,15%, if it does make a third run!
If after 5-6 tries it's still too much your drive can't make accurate enough DPM data - you'll need to get another reader like Plextor or Toshiba
Also, if any sector numbers are negative your drive doesn't read the disc correctly.
Then make image from your CD, use RAW + NO subchannel mode (2352 bytes). Other modes won't work!
Then patch your image:
sfmdf myfavoritegame3.cfg original_image.bin fixed_image.bin
Now connect your burner and burn in RAW mode WITH SUBCHANNEL DATA (2448 bytes, others won't work!) on a good quality CD-R (not -RW!), make sure to disable "correct subchannel data" in your burning software. Also, your burner must be able to overburn into Lead-out area (copy will be bigger than original).
Then physically disconnect your burner, start your game with the backup in the reading drive, Starforce will ask for a key. This is not your original CD key, use the key you extracted from the bus logger.
The key is stored on an encrypted .DLL like Protect.dll, that's why we need to sniff the bus.
After ~5 seconds (much faster than original on my PC) enjoy your working SF3 backup and promise yourself not to buy any SF3 protected titles in the future unless you are a masochist like I am
Note that your backup works only on the reader you used, if it breaks you'll need to repeat the entire process.
This procedure would work on DVDs if you could make and burn a raw image. With DVD+RW and Mount Rainier compatible drive it might work if you abuse the drive (weak sectors again). I don't know enough about Mt Rainier so I can't help you with that.
Games tested and working (all English European versions):
Obscure (CD version only!)
Worms 4
Soldiers - Heroes of WW2
Still Life
Cossacs 2
Not working:
Splinter Cell - if this game is available on CD please let me know
Any other DVD only release
1. I didn't invent 95% of this - very smart people in Russia did.
2. It works ONLY if you have the original game on CD, not DVD.
3. This method is for ADVANCED USERS ONLY.
4. I don't know a single free bus analyzer for Windows so this method is more expensive in the long term than simply buying two copies of the game and using the other as backup. Maybe there are such tools for Linux?
4.1. SFCure is a nice hack but it's still a hack. It's code actually redirects calls to dt driver/netbt/classpn.sys functions from io(f)calldriver and sets their adress as it's own return address in stack (to simulate call). But before ending, it adds 4 to address so first instruction of target function is not executed. The next Starforce version will fix this, they seem to simply missed this call in their FS protection driver. This method should survive the SF 3.x generation.
OK, now to make a working backup CD (image won't work) you'll first need:
-the original game in CD format
-CD-R(W) burner capable of 2448 bytes RAW+SUB format and overburning
-get a SCSI-/USB CD READER or put one on a RAID card. IDE/SATA won't work. CD-RW won't work!
-download tools sfcdvd and sfmdf.
-get a bus monitoring tool like bushound or bustrace, virtual PC emulators' logging won't work. Disk-/Filemon won't either (too high level: the Starforce driver interferes). Starwind trial works if you patch it to allow local connections, use logging level 4 and MS iSCSI client 1.06 or newer.
Bushound costs $800.
First: uninstall Daemon Tools, Alcohol, Blindwrite and CloneCD, anything else that might be blacklisted. Don't use Starfuck or any other anti-blacklisting tools. Uninstall SFCure if installed. Physically remove your CD-RW drive. Disable data execution protection if running XP SP2 (the NX bit stuff).
Alcohol 120% DPM data is too inaccurate for Starforce so we'll need to get good DPMS data first. Before measuring install the game from your READER and make sure it works fine from your drive. Leave your original in your drive, start your bus monitor and run:
sfcdvd //./x: myfavoritegame.cfg
Replace x: with your drive letter.
The measurement will take 2-3 minutes.
After that run sfcdvd //./x: myfavoritegame2.cfg
Now stop logging and open the .cfg files, then find the sector numbers mentioned there on your bustrace log. You'll find a key on one of those sectors, make sure to write it down!
Then from both .cfg files get the timing data, average them and write results to a new file myfavoritegame3.cfg
File format is as follows:
Block 1: CD label
Block 2: fake CD key, ignore this
Block 3: beginning of DPM check
Block 4: sectors per track (average this line!)
Block 5: end of DPM check
The deviation must not exceed 0,15%, if it does make a third run!
If after 5-6 tries it's still too much your drive can't make accurate enough DPM data - you'll need to get another reader like Plextor or Toshiba
Also, if any sector numbers are negative your drive doesn't read the disc correctly.
Then make image from your CD, use RAW + NO subchannel mode (2352 bytes). Other modes won't work!
Then patch your image:
sfmdf myfavoritegame3.cfg original_image.bin fixed_image.bin
Now connect your burner and burn in RAW mode WITH SUBCHANNEL DATA (2448 bytes, others won't work!) on a good quality CD-R (not -RW!), make sure to disable "correct subchannel data" in your burning software. Also, your burner must be able to overburn into Lead-out area (copy will be bigger than original).
Then physically disconnect your burner, start your game with the backup in the reading drive, Starforce will ask for a key. This is not your original CD key, use the key you extracted from the bus logger.
The key is stored on an encrypted .DLL like Protect.dll, that's why we need to sniff the bus.
After ~5 seconds (much faster than original on my PC) enjoy your working SF3 backup and promise yourself not to buy any SF3 protected titles in the future unless you are a masochist like I am
Note that your backup works only on the reader you used, if it breaks you'll need to repeat the entire process.
This procedure would work on DVDs if you could make and burn a raw image. With DVD+RW and Mount Rainier compatible drive it might work if you abuse the drive (weak sectors again). I don't know enough about Mt Rainier so I can't help you with that.
Games tested and working (all English European versions):
Obscure (CD version only!)
Worms 4
Soldiers - Heroes of WW2
Still Life
Cossacs 2
Not working:
Splinter Cell - if this game is available on CD please let me know
Any other DVD only release
Comment