Copy protection

Copy protection for computer software, especially for games, has been a long cat-and-mouse struggle between publishers and crackers. These were (and are) programmers who defeated copy protection on software as a hobby, add their alias to the title screen, and then distribute the "cracked" product to the network of warez BBSes or Internet sites that specialized in distributing unauthorized copies of software.

When computer software was still distributed in audio cassettes, audio copying was unreliable, while digital copying was time consuming. Software prices were comparable with audio cassette prices.[4][6] To make digital copying more difficult, many programs used non-standard loading methods (loaders incompatible with standard BASIC loaders, or loaders that used different transfer speed).

Unauthorized software copying began to be a problem when floppy disks became the common storage media.[6] The ease of copying depended on the system; Jerry Pournelle wrote in BYTE in 1983 that "CP/M doesn't lend itself to copy protection" so its users "haven't been too worried" about it, while "Apple users, though, have always had the problem. So have those who used TRS-DOS, and I understand that MS-DOS has copy protection features".[7] Apple and Commodore 64 computers were extremely varied and creative because most of the floppy disk reading and writing was controlled by software (or firmware), not by hardware. The first copy protection was for cassette tapes and consisted of a loader at the beginning of the tape, which read a specially formatted section which followed.

The first protection of floppy disks consisted of changing the address marks, bit slip marks, data marks, or end of data marks for each sector. For example, Apple’s standard sector markings were:

• D5 AA 96 for the address mark. That was followed by track, sector, and checksum.
• DE AA EB concluded the address header with what are known as bit slip marks.
• D5 AA AD was used for the data mark and the end of data mark was another DE AA EB.

Changing any of these marks required fairly minimal changes to the software routines in Apple DOS which read and wrote the floppy disk, but produced a disk that could not be copied by any of the standard copiers, such as Apple's COPYA program. Some protection schemes used more complicated systems that changed the marks by track or even within a track.

Pournelle disliked copy protection and, except for games, refused to review software that used it. He did not believe that it was useful, writing in 1983 that "For every copy protection scheme there's a hacker ready to defeat it. Most involve so-called nibble/nybble copiers, which try to analyze the original disk and then make a copy".[7] IBM's Don Estridge agreed: "I guarantee that whatever scheme you come up with will take less time to break than to think of it." While calling piracy "a threat to software development. It's going to dry up the software", he said "It's wrong to copy-protect programs ... There ought to be some way to stop [piracy] without creating products that are unusable."[8]

By 1980, the first 'nibble' copier, Locksmith, was introduced. These copiers reproduced copy protected floppy disks an entire track at a time, ignoring how the sectors were marked. This was harder to do than it sounds for two reasons: firstly, Apple disks did not use the index hole to mark the start of a track; their drives could not even detect the index hole. Tracks could thus start anywhere, but the copied track had to have this "write splice", which always caused some bits to be lost or duplicated due to speed variations, roughly in the same (unused for payload data) place as the original, or it would not work. Secondly, Apple used special "self-sync" bytes to achieve agreement between drive controller and computer about where any byte ended and the next one started on the disk. These bytes were written as normal data bytes followed by a slightly longer than normal pause, which was notoriously unreliable to detect on read-back; still, you had to get the self-sync bytes roughly right as without them being present in the right places, the copy would not work, and with them present in too many places, the track would not fit on the destination disk.

Locksmith copied Apple II disks by taking advantage of the fact that these sync fields between sectors almost always consisted of a long string of FF (hex) bytes. It found the longest string of FFs, which usually occurred between the last and first sectors on each track, and began writing the track in the middle of that; also it assumed that any long string of FF bytes was a sync sequence and introduced the necessary short pauses after writing each of them to the copy. Ironically, Locksmith would not copy itself. The first Locksmith measured the distance between sector 1 of each track. Copy protection engineers quickly figured out what Locksmith was doing and began to use the same technique to defeat it. Locksmith countered by introducing the ability to reproduce track alignment and prevented itself from being copied by embedding a special sequence of nibbles that, if found, would stop the copy process. Henry Roberts (CTO of Nalpeiron), a graduate student in computer science at the University of South Carolina, reverse engineered Locksmith, found the sequence and distributed the information to some of the seven or eight people producing copy protection at the time.

For some time, Locksmith continued to defeat virtually all of the copy protection systems in existence. The next advance came from Henry Roberts' thesis on software copy protection, which devised a way of replacing Apple’s sync field of FFs with random appearing patterns of bytes. Because the graduate student had frequent copy protection discussions with Apple’s copy protection engineer, Apple developed a copy protection system which made use of this technique. Henry Roberts then wrote a competitive program to Locksmith, Back It UP. He devised several methods for defeating that, and ultimately a method was devised for reading self sync fields directly, regardless of what nibbles they contained.

Copy protection sometimes caused software to not run on clones, such as the Apple II-compatible Laser 128.[9] The back and forth struggle between copy protection engineers and nibble copiers continued until the Apple II became obsolete and was replaced by the IBM PC and its clones.

In 1989 Gilman Louie, head of Spectrum Holobyte, stated that copy protection added about $0.50 per copy to the cost of production of a game.[10] Other software relied on complexity; Antic in 1988 observed that WordPerfect for the Atari ST "is almost unusable without its manual of over 600 pages!".[11] (The magazine was mistaken; the ST version was so widely pirated that the company threatened to discontinue it.[12][13])

Floppy disks were later displaced by CDs as the preferred method of distribution, with companies like Macrovision and Sony providing copy protection schemes that worked by writing data to places on the CD-ROM where a CD-R drive cannot normally write. Such a scheme had been used for the PlayStation and could not be circumvented easily without the use of a modchip.

For software publishers, a less expensive method of copy protection is to write the software so that it requires some evidence from the user that they have actually purchased the software, usually by asking a question that only a user with a software manual could answer (for example, "What is the 4th word on the 6th line of page 37?"). However, this approach can be exploited with the patience to copy the manual with a photocopier, and it also suffers from the issue of making the product more inconvenient for the end user to use.

It has become very common for software to require activation by entering some proof of legal purchase such as:

• Name & Serial, a name and serial number that is given to the user at the time the software is purchased
• A phone activation code, which requires the user to call a number and register the product to receive a computer-specific serial number.
• Device ID, specifically tying a copy of software to a computer or mobile device based on a unique identifier only known to that device (like the IMEI of a smartphone).

To limit reusing activation keys to install the software on multiple machines, it has been attempted to tie the installed software to a specific machine by involving some unique feature of the machine. Serial number in ROM could not be used because some machines do not have them. Some popular surrogate for a machine serial number were date and time (to the second) of initialization of the hard disk or MAC address of Ethernet cards (although this is programmable on modern cards). With the rise of virtualization, however, the practice of locking has to add to these simple hardware parameters to still prevent copying.[14]

Another approach to associating user and/or machine with serial number is product activation over the Internet, where users are required to have access to the Internet so the information on which serial number is installed on which machine gets sent to a server to be authenticated. Unauthorized users are not allowed to install or use the software. Microsoft's Windows Genuine Advantage system is a far-reaching example of this. With the rise of Cloud computing, requiring Internet access is becoming more popular for software verification. Beyond online authentication, a standalone software may be integrated with the cloud so that key data or code is stored online. This could greatly strengthen the protection; for example, the software could store a property file or execute a process needed by the application in the cloud instead on the user's computer.

The copy protection schemes described above have all been criticized for causing problems for validly licensed users who upgrade to a new machine, or have to reinstall the software after reinitializing their hard disk. Some Internet product activation products allow replacement copies to be issued to registered users or multiple copies to the same license. Like all software, copy-protection software sometimes contains bugs, whose effect may be to deny access to validly licensed users. Most copy protection schemes are easy to crack, and once crackers circumvent the copy protection, the resulting cracked software is then more convenient and hence more valuable than the non-cracked version, because users can make additional copies of the software. Due to this problem, user-interactive copy protection by asking questions from manuals has mostly disappeared.

In his 1976 Open Letter to Hobbyists, Bill Gates complained that "most of you steal your software." However, Gates initially rejected copy protection and said "It just gets in the way."

There is also the tool of software blacklisting that is used to enhance certain copy protection schemes.

During the 1980s and 1990s, video games sold on audio cassette and floppy disks were sometimes protected with an external user-interactive method that demanded the user to have the original package or a part of it, usually the manual. Copy protection was activated not only at installation, but every time the game was executed.[15][16]

Sometimes the copy protection code was needed not at launch, but at a later point in the game. This helped the gamer to experience the game (e.g. as a demonstration) and perhaps could convince them to buy it by the time the copy protection point was reached.

Several imaginative and creative methods have been employed, in order to be both fun and hard to copy. These include:[17]

• The most common method was requiring the player to enter a specific word (often chosen at random) from the manual. A variant of this technique involved matching a picture provided by the game to one in the manual and providing an answer pertaining to the picture (Ski or Die, 4D Boxing and James Bond 007; the Stealth Affair used this technique). Buzz Aldrin's Race Into Space (in the floppy version but not the CD version) required the user to input an astronaut's total duration in space (available in the manual) before the launch of certain missions. If the answer were incorrect, the mission would suffer a catastrophic failure.
• Manuals containing information and hints vital to the completion of the game, like answers to riddles (Conquests of Camelot, King's Quest 6), recipes of spells (King's Quest 3), keys to deciphering non-Latin writing systems (Ultima series, see also Ultima writing systems), maze guides (Manhunter), dialogue spoken by other characters in the game (Wasteland, Dragon Wars), excerpts of the storyline (most Advanced Dungeons and Dragons games and Wing Commander I), or a radio frequency to use to communicate with a character to further a game (Metal Gear Solid).
• Some sort of code with symbols, not existing on the keyboard or the ASCII code. This code was arranged in a grid, and had to be entered via a virtual keyboard at the request "What is the code at line 3 row 2?". These tables were printed on dark paper (Maniac Mansion, Uplink), or were visible only through a red transparent layer (Indiana Jones and the Last Crusade), making the paper very difficult to photocopy. Another variant of this method—most famously used on the ZX Spectrum version of Jet Set Willy—was a card with color sequences at each grid reference that had to be entered before starting the game. This also prevented monochrome photocopying. It had been thought that the codes in the tables were based on a mathematical formula which could be calculated by using the row, line and page number if the formula was known, a function of the disk space requirement of the data. Later research proved that this wasn't the case.[18]
• The Secret of Monkey Island offered a rotating wheel with halves of pirate's faces. The game showed a face composed of two different parts and asked when this pirate was hanged on a certain island. The player then had to match the faces on the wheel, and enter the year that appeared on the island-respective hole. Its sequel had the same concept, but with magic potion ingredients. Other games that employed the code wheel system include Star Control.
• Zork games such as Beyond Zork and Zork Zero came with "feelies" which contained information vital to the completion of the game. For example, the parchment found from Zork Zero contained clues vital to solving the final puzzle. However, whenever the player attempts to read the parchment, they are referred to the game package.
• The Lenslok system used a plastic prismatic device, shipped with the game, which was used to descramble a code displayed on screen.[19][20]

All of these methods proved to be troublesome and tiring for the players, and as such greatly declined in usage by the mid-1990s, at which point the emergence of CDs as the primary video game medium made copy protection largely redundant, since CD copying technology was not widely available at the time.[15]

While not strictly a software protection, some game companies offered "value-added" goodies with the package, like funny manuals, posters, comics, storybooks or fictional documentation concerning the game (e.g. the Grail Diary for Indiana Jones or a police cadet notebook with Police Quest or the Hero's manual of Quest for Glory or a copy of the National Inquisitor newspaper in Zak McKracken) in order to entice gamers to buy the package. This trend is re-emerging in modern gaming as an incentive to both buy games and discourage their resale; some games like Forza Motorsport 3 and Dragon Age: Origins provide bonus in-game material that will only be given if one buys the game new.

When Sega's Dreamcast was released in 1998, it came with a newer disc format, called the GD-ROM. Using a modified CD player, one could access the game functionality. Using a special swap method could allow reading a GD-ROM game through a CD-ROM just using common MIL-CD (standard CD Boot loading, commonly found on Windows Installation Discs, Linux Live CDs, and others). Dreamcasts sold after October 2000 contain a newer firmware update, not allowing MIL-CD boot.

The Xbox has a specific function: Non-booting or non-reading from CDs and DVD-Rs as a method of game copy protection. Also, the Xbox is said to use a different DVD file system (instead of UDF). It has been theorized that the discs have a second partition that is read from the outside in (opposite current standards thus making the second partition unreadable in PC DVD drives) which give the tracks the appearance that the disc was spun backwards during manufacture. The Xbox 360 copy protection functions by requesting the DVD drive compute the angular distance between specific data sectors on the disc. A duplicated DVD returns different values than does a pressed original.

The PlayStation 2 has a map file that contains all of the exact positions and file size info of the CD in it, which is stored at a position that is beyond the file limit. The game directly calls the position at where the map file is supposed to be. This means that if the file is moved inside the limit, it is useless since the game is looking outside the limit for it, and the file will not work outside of the limit, making any copied disc unusable without a mod chip or the use of FMCB (free memory card boot). FMCB uses the memory card to trick the built-in DVD video software into booting copied games. Before a copied game can be played, it must have been patched with a free application.

Nintendo's Wii and Nintendo GameCube have their own specialty format for copy protection. It is based on DVD/miniDVD (Game Cube) technology; each disc contains some deliberately placed defects. The exact positions of these defects, which differ for each produced disc, is encoded encrypted in the BCA of each disc. The BCA is readable on most standard DVD-ROM Drives, but consumer burners can reproduce neither the BCA nor the defects. As an additional obfuscation mechanism, the on-disc sector format is a little bit different from normal DVDs. Nevertheless, it can be read using some consumer DVD-ROM drives with a firmware modification or "debug mode". It is also possible to hack the Wii to install unlicensed software, some of which can use the Wii's own drive to create disc images and then play these copies.

The PSP, except the PSP Go, uses the Universal Media Disc, a media format similar to a MiniDisc. It holds about 1.2 GB. Although it cannot be copied, one can make an ISO image (a file version of the UMD) on a memory card and play it on custom firmware, which can be installed on the PSP.

The PlayStation 3, Xbox One, and PlayStation 4 use Blu-ray BD-ROM discs. In addition to any protection provided by the consoles themselves, the BD-ROM format's specification allows for a ROM-Mark which cannot be duplicated by consumer-level recorders. While the BD-ROM format does provide considerable capacity (up to 100 gigabytes per disc with potential revision to provide more), increased consumer bandwidth availability combined with the increased size of games distributed through online channels (approaching 100 gigabytes for some titles) is rendering this point moot. To prevent the consoles themselves being hacked and used as a means to defeat these protections (as happened with the Wii and partially with the PlayStation 3), contemporary consoles employ trusted hardware paths that authenticate the internal hardware and software prior to operation.

Some game developers, such as Markus Persson,[21] have encouraged consumers and other developers to embrace the reality of unlicensed copying and utilize it positively to generate increased sales and marketing interest.

Companies such as Macrovision and Dwight Cavendish provided schemes to videotape publishers making copies unusable if they were created with a normal VCR. All major videotape duplicators licensed Macrovision or similar technologies to copy protect video cassettes for their clients or themselves.

Starting in 1985 with the video release of The Cotton Club (Beta and VHS versions only), Macrovision licensed to publishers a technology that exploits the automatic gain control feature of VCRs by adding pulses to the vertical blanking sync signal.[22] These pulses do not affect the image a consumer sees on their TV, but do confuse the recording-level circuitry of consumer VCRs. This technology, which is aided by U.S. legislation mandating the presence of automatic gain-control circuitry in VCRs, is said to "plug the analog hole" and make VCR-to-VCR copies impossible, although an inexpensive circuit is widely available that will defeat the protection by removing the pulses. Macrovision has patented methods of defeating copy prevention,[23] giving it a more straightforward basis to shut down manufacture of any device that descrambles it than often exists in the DRM world.

Another form of copy protection, MicroVision, was designed to prevent VCRs from recording a television program. Cable movie channels rejected it; Michael J. Fuchs of HBO said in 1985 that MicroVision was "not good technology" because it reduced picture quality and consumers could easily bypass it, while Peter Chernin of Showtime said "we want to accommodate our subscribers and we know they like to tape our movies".[24]

Consumer CD recorders included the Serial Copy Management System (SCMS), which allowed copies to be made from an original, but did not allow a copy of a copy. Professional equipment, including all computer drives, ignores SCMS. Since computer drives ignored SCMS, copies could be made freely, which led to record labels introducing additional copy protection measures.

By 2000, Napster had seen mainstream adoption, and several music publishers responded by starting to sell some CDs with various copy protection schemes. Most of these were playback restrictions that aimed to make the CD unusable in computers with CD-ROM drives, leaving only dedicated audio CD players for playback. This did not, however, prevent such a CD from being copied via an analogue connection or by ripping the CD under operating systems such as Linux, which was effective since copy-protection software was generally written for Microsoft Windows. These weaknesses led critics to question the usefulness of such protection.

CD copy protection is achieved by assuming certain feature levels in the drives. The CD Digital Audio is the oldest CD standard and forms the basic feature set beyond which dedicated audio players need no instructions. CD-ROM drives additionally need to support mixed mode CDs (combined audio and data tracks) and multi-session CDs (multiple data recordings each superseding and incorporating data of the previous session).

The play preventions in use intentionally deviate from the standards and intentionally include malformed multisession data or similar with the purpose of confusing the CD-ROM drives to prevent correct function. Simple dedicated audio CD players would not be affected by the malformed data since these are for features they do not support—for example, an audio player will not even look for a second session containing the copy protection data.

In practice, results vary wildly. CD-ROM drives may be able to correct the malformed data and still play them to an extent that depends on the make and version of the drive. On the other hand, some audio players may be built around drives with more than the basic features required for audio playback. Some car radios with CD playback, portable CD players, CD players with additional support for data CDs containing MP3 files, and DVD players have had problems with these CDs.

The deviation from the Red Book standard that defines audio CDs required the publishers of these copy-protected CDs to refrain from using the official CDDA logo on the discs or the cases. The logo is a trademark owned by Philips and Sony and licensed to identify compliant audio discs only. To prevent dissatisfied customers from returning CDs which were misrepresented as compliant audio CDs, such CDs also started to carry prominent notices on their covers.

In general the audio can always be extracted by applying the principle of the analog hole. Additionally, such programs as IsoBuster may be capable of producing hidden audio files.

Examples of CD copy protection schemes are Cactus Data Shield, Copy Control, and Data Position Measurement.

More recently, publishers of music and films in digital form have turned to encryption to make copying more difficult. CSS, which is used on DVDs, is a famous example of this. It is a form of copy protection that uses 40-bit encryption. Copies will not be playable since they will be missing the key, which is not writable on regular DVD-R or DVD-RW discs (except with special Qflix DVD-recorders and media). With this technique, the work is encrypted using a key only included in the firmware of "authorized" players, which allow only "legitimate" uses of the work (usually restricted forms of playback, but no conversion or modification). The controversial Digital Millennium Copyright Act provides a legal protection for this in the US, that would make it illegal to distribute "unauthorized" players—which was supposed to eliminate the possibility of building a DVD copier. However, encryption schemes designed for mass-market standardized media such as DVD suffer from the fundamental weaknesses that consumers have physical access to the devices containing the keys, and once implemented, the copy-protection scheme can never be changed without breaking the forward compatibility of older devices (or the backward compatibility of newer media).

Since consumers are highly unlikely to buy new hardware for the sole purpose of preserving copy protection, manufacturers have been prevented from enhancing their DRM technology until recently, with the release of next-generation media such as HD DVD and Blu-ray Disc. This period represents more than enough time for the encryption scheme to be defeated by determined attackers. For example, the CSS encryption system used on DVD Video was broken within three years of its market release in November 1996 (see DeCSS), but has not been changed since, because doing so would immediately render all DVD players sold prior to the change incapable of reading new DVDs—this would not only provoke a backlash amongst consumers, but also restrict the market that the new DVDs could be sold to. More recent DVDs have attempted to augment CSS with additional protection schemes. Most modern schemes like ARccOS Protection use tricks of the DVD format in an attempt to defeat copying programs, limiting the possible avenues of protection—and making it easier for hackers to learn the innards of the scheme and find ways around it.

The newest generations of optical disc media, HD DVD and Blu-ray Disc, attempt to address this issue. Both formats employ the Advanced Access Content System, which provides for several hundred different decryption keys (for the varying models of players to hit the market), each of which can be invalidated ("revoked") should one of the keys be compromised. Revoked keys simply will not appear on future discs, rendering the compromised players useless for future titles unless they are updated to fix the issue. For this reason, all HD-DVD players and some Blu-ray players include an ethernet port, to give them the ability to download DRM updates. Blu-ray Disc goes one step further with a separate technique called BD+, a virtual machine that can execute code included on discs to verify, authorize, revoke, and update players as the need arises. Since the protection program is on the disc rather than the player, this allows for updating protection programs within BD's working life by simply having newer programs included on newer discs.

4K resolution Blu-ray discs augment the existing Blu-ray protections. First, players must be dedicated devices that use protected hardware paths to ensure the entire process chain (from media to display) is not compromised. Second, some media require the use of players able to access the Internet for additional verification.