hacking games with starforce

[BarryB]

As I understand it there are different levels of how to implement SF3 protection.

One is to just protect the EXE, not too difficult to deal with. I believe Gangland and Singles are examples of this

Another method involves not only protecting the EXE but encrypting data files too, look at Dead To Rights for an example of that! The 'crack' was nearly a whole CD!

Then there are the 'emulated functions'. As I understand it from a reliable source, it's these 'active protected functions' in the EXE that are the bitch that has stopped the release of titles like Beyond Divinity, TOCA2 and Killswitch as they are time consuming to find/trace!!

Please correct me if I'm wrong on any of those points

[michse]

Welll SF3 isnt the real problem, the main problem is always the VM Pcode.
which means even if u dumped en encrypted exe there are still crypted functions that point somewhere but not into the place the data code is located.

If pcode is present can be easely detected by everyone

always there is a "protect.dll" - it has .sforce section but musten be named protect.dll - Version of this .dll is the starforce version and if the dll file is biggern then 4MB pcode is present.

Normaly per 1MB bigger then 4MB its 7 pcoded functions that got to be fixed after dumping and rebuilding the exe and their apis.

there are mainly 4 different versions of starforce

light (dll smaller 2mb)
normal (dll between 2 and 4mb)
hard (dll bigger then 4mb)
hardest (dll bigger then 4mb and a .dat file addionaly on CD - like seen in Dday demo and german retail)

hard and hardest i dont think you wont see a crack as no cracker takes a month or longer to fix the pcode which is a allbyhand job. no game is worth the time you need to crack that.

[Hexana]

Originally Posted by michse

there are mainly 4 different versions of starforce

light (dll smaller 2mb)
normal (dll between 2 and 4mb)
hard (dll bigger then 4mb)
hardest (dll bigger then 4mb and a .dat file addionaly on CD - like seen in Dday demo and german retail)

hard and hardest i dont think you wont see a crack as no cracker takes a month or longer to fix the pcode which is a allbyhand job. no game is worth the time you need to crack that.

The game "Black Mirror" has
Bmirror.dll with over 5 MB with starforce,
exe over 2 MB,
data.adb over 2 MB with starforce
and two small files with 59 KB also with starforce.

It was published in October or November last year and only a few days later the group immersion released a fully working crack.
So it seeems to be possible, doesn't it???
Unfortunately immersion seems to no longer exist :-(

[michse]

Black Mirror isnt that hard as not much pcoded functions.

And yes IMS did a nice job on it but it was also handmade.
I dont say it is impossible but twhen u get f.e. Obscure or D-Day which have 27 or 34 pcoded functions you dont want to invest the time. Black mirror had 5 pcodes, the german one 7 or so dunno. but thats alot less.

there are some freaks that can surely crack sf3 fastern then that but todays crackers have a rl

[Hexana]

@michse

You seem to be an expert in that kind of things. ;-)
So let me ask you:
If it's too time intensive for those harder protected games,
would it be possible or realistic to make a "global" starforce crack, I mean an application that modifies installed starforce drivers in the system or
an application that installs own drivers that go deeper in the system as the starforce drivers and knocks them out?

[michse]

Yes from my point of view it is possible to either emulate the starforce drivers or at least patch em that every copy with dpms included will run.

If your able to code a tool that hook every single pcode function ... no matter what they do or if they are protection relevant or not then your able todo a generic tool. In my eyes it is possible and there are some guys trying this already as i saw already outputs from such tools in develop but it is a real hard stuff. You need alot more skills then just debugging, dumping hooking i think and btw im not a real expert in it but i try to understand more and more until the russians find a new **** that gets you back to the basics again