Software cracking is the modification of software to remove or disable features which are considered undesirable by the person cracking the software, usually related to
protection methods: (
copy protection,
protection against the manipulation of software), trial/demo version,
serial number, hardware key, date checks, CD check or software
annoyances like nag screens and adware.
The distribution and use of cracked copies is illegal in most countries.
There have been lawsuits over cracking software.
History
The first software copy protection was from Apple II, Atari 800 and Commodore 64.
Software publishers, particularly of gaming software, have over time
resorted to increasingly complex measures to try to stop unauthorized
copying of their software.
On the Apple II, unlike modern computers that use standardized device
drivers to manage device communications, the operating system directly
controlled the step motor that moves the floppy drive head, and also
directly interpreted the raw data called
nibbles read from each
track to find the data sectors. This allowed complex disk-based software
copy protection, by storing data on half tracks (0, 1, 2.5, 3.5, 5,
6...), quarter tracks (0, 1, 2.25, 3.75, 5, 6...), and any combination
thereof. In addition, tracks did not need to be perfect rings, but could
be sectioned so that sectors could be staggered across overlapping
offset tracks, the most extreme version being known as spiral tracking.
It was also discovered that many floppy drives did not have a fixed
upper limit to head movement, and it was sometimes possible to write an
additional 36th track above the normal 35 tracks. The standard Apple II
copy programs could not read such protected floppy disks, since the
standard DOS assumed that all disks had a uniform 35-track, 13- or
16-sector layout. Special nibble-copy programs such as Locksmith and
Copy II Plus could sometimes duplicate these disks by using a reference
library of known protection methods; when protected programs were
cracked they would be completely stripped of the copy protection system,
and transferred onto a standard format disk that any normal Apple II
copy program could read.
One of the primary routes to hacking these early copy protections was
to run a program that simulates the normal CPU operation. The CPU
simulator provides a number of extra features to the hacker, such as the
ability to single-step through each processor instruction and to
examine the CPU registers and modified memory spaces as the simulation
runs. The Apple II provided a built-in opcode disassembler, allowing raw
memory to be decoded into CPU opcodes, and this would be utilized to
examine what the copy-protection was about to do next. Generally there
was little to no defense available to the copy protection system, since
all its secrets are made visible through the simulation. But because the
simulation itself must run on the original CPU, in addition to the
software being hacked, the simulation would often run extremely slowly
even at maximum speed.
On Atari 8-bit computers, the most common protection method was via
"bad sectors". These were sectors on the disk that were intentionally
unreadable by the disk drive. The software would look for these sectors
when the program was loading and would stop loading if an error code was
not returned when accessing these sectors. Special copy programs were
available that would copy the disk and remember any bad sectors. The
user could then use an application to spin the drive by constantly
reading a single sector and display the drive RPM. With the disk drive
top removed a small screwdriver could be used to slow the drive RPM
below a certain point. Once the drive was slowed down the application
could then go and write "bad sectors" where needed. When done the drive
RPM was sped up back to normal and an uncracked copy was made. Of course
cracking the software to expect good sectors made for readily copied
disks without the need to meddle with the disk drive. As time went on
more sophisticated methods were developed, but almost all involved some
form of malformed disk data, such as a sector that might return
different data on separate accesses due to bad data alignment. Products
became available (from companies such as Happy Computers)
which replaced the controller BIOS in Atari's "smart" drives. These
upgraded drives allowed the user to make exact copies of the original
program with copy protections in place on the new disk.
On the Commodore 64, several methods were used to protect software. For software distributed on ROM cartridges,
subroutines were included which attempted to write over the program
code. If the software was on ROM, nothing would happen, but if the
software had been moved to RAM,
the software would be disabled. Because of the operation of Commodore
floppy drives, one write protection scheme would cause the floppy drive
head to bang against the end of its rail, which could cause the drive
head to become misaligned. In some cases, cracked versions of software
were desirable to avoid this result. A misaligned drive head was rare
usually fixing itself by smashing against the rail stops. Another brutal
protection scheme was grinding from track 1 to 40 and back a few times.
Oddly the first duplication of computer software id witnessed was a
tape format that had been put into a twin high speed cassette stereo
player and dubbed. Compressed tape data required a higher quality
recordable cassette.
Most of the early software crackers were computer hobbyists who often
formed groups that competed against each other in the cracking and
spreading of software. Breaking a new copy protection scheme as quickly
as possible was often regarded as an opportunity to demonstrate one's
technical superiority rather than a possibility of money-making. Some
low skilled hobbyists would take already cracked software and edit
various unencrypted strings of text in it to change messages a game
would tell a game player, often something not suitable for children.
Then pass the altered copy along in the pirate networks, mainly for
laughs among adult users. The cracker groups of the 1980s started to
advertise themselves and their skills by attaching animated screens
known as
crack intros
in the software programs they cracked and released. Once the technical
competition had expanded from the challenges of cracking to the
challenges of creating visually stunning intros, the foundations for a
new subculture known as
demoscene
were established. Demoscene started to separate itself from the illegal
"warez scene" during the 1990s and is now regarded as a completely
different subculture. Many software crackers have later grown into
extremely capable software reverse engineers; the deep knowledge of
assembly required in order to crack protections enables them to
reverse engineer drivers in order to port them from binary-only drivers for Windows to drivers with source code for
Linux and other free
operating systems. Also because music and game intro was such an
integral part of gaming the music format and graphics became very
popular when hardware became affordable for the home user.
With the rise of the Internet,
software crackers developed secretive online organizations. In the
latter half of the nineties, one of the most respected sources of
information about "software protection reversing" was
Fravia's website.
Most of the well-known or "elite" cracking groups make software cracks entirely for respect in the "
The Scene",
not profit. From there, the cracks are eventually leaked onto public
Internet sites by people/crackers who use well-protected/secure FTP
release archives, which are made into pirated copies and sometimes sold
illegally by other parties.
The Scene today is formed of small groups of skilled people, who informally compete to have the best crackers, methods of cracking, and
reverse engineering.
Methods
The most common software crack is the modification of an
application's binary to cause or prevent a specific key branch in the
program's execution. This is accomplished by
reverse engineering the compiled program code using a
debugger such as
SoftICE,
OllyDbg,
GDB, or
MacsBug until the software cracker reaches the
subroutine that contains the primary method of protecting the software (or by
disassembling an executable file with a program such as
IDA). The binary is then modified using the
debugger or a
hex editor or
monitor in a manner that replaces a prior branching
opcode with its complement or a
NOP opcode so the key branch will either always execute a specific
subroutine or skip over it. Almost all common software cracks are a variation of this type.
Proprietary software developers are constantly developing techniques such as
code obfuscation,
encryption, and
self-modifying code
to make this modification increasingly difficult. Even with these
measures being taken, developers struggle to combat software cracking.
This is because it is very common for a professional to publicly release
a simple cracked EXE or
Retrium Installer for public download, eliminating the need for inexperienced users to crack the software themselves.
A specific example of this technique is a crack that removes the
expiration period from a time-limited trial of an application. These
cracks are usually programs that patch the program executable and
sometimes the
.dll or .so linked to the application. Similar cracks are available for software that requires a hardware
dongle. A company can also break the copy protection of programs that they have legally purchased but that are
licensed
to particular hardware, so that there is no risk of downtime due to
hardware failure (and, of course, no need to restrict oneself to running
the software on bought hardware only).
Another method is the use of special software such as
CloneCD
to scan for the use of a commercial copy protection application. After
discovering the software used to protect the application, another tool
may be used to remove the copy protection from the software on the
CD or
DVD. This may enable another program such as
Alcohol 120%,
CloneDVD,
Game Jackal, or
Daemon Tools
to copy the protected software to a user's hard disk. Popular
commercial copy protection applications which may be scanned for include
SafeDisc and
StarForce.
[2]
In other cases, it might be possible to
decompile a program in order to get access to the original
source code or code on a
level higher than
machine code. This is often possible with
scripting languages and languages utilizing
JIT compilation. An example is cracking (or debugging) on the .NET platform where one might consider manipulating
CIL to achieve one's needs.
Java's bytecode
also works in a similar fashion in which there is an intermediate
language before the program is compiled to run on the platform dependent
machine code.
Advanced reverse engineering for protections such as
Securom,
Safedisc or
StarForce
requires a cracker, or many crackers to spend much time studying the
protection, eventually finding every flaw within the protection code,
and then coding their own tools to "unwrap" the protection automatically
from executable (.EXE) and library (.DLL) files.
There are a number of sites on the Internet that let users download
cracks for popular games and applications (although at the danger of
acquiring malicious software that is sometimes distributed via such
sites). Although these cracks are used by legal buyers of software, they
can also be used by people who have downloaded or otherwise obtained
pirated software (often through
P2P networks).
