SafeDisc is a CD/DVD copy prevention program for Windows applications and games, developed by Macrovision Corporation, aiming to prevent software copying, as well as resisting home media duplication devices, professional duplicators, and reverse engineering attempts. There have been several editions of SafeDisc over the years, each one has the goals of making discs harder to copy. The current revision is marketed as SafeDisc Advanced. Though SafeDisc protection effectively prevents regular home users from creating functional copies of CDs or DVDs, it is quite easy for skilled software crackers to bypass. The early versions of SafeDisc did not make the discs very difficult to copy. Recent versions 2.9+ can produce discs that are difficult to copy or reverse engineer, requiring specific burners capable of burning the "weak sectors" and odd data formats that are characteristic of SafeDisc.
Previous versions of SafeDisc were overcome by loopback mount software such as Daemon Tools and Alcohol 120%. SafeDisc currently blacklists such software, meaning that those who want to use this method must install additional software to cloak the mounter. Examples include CureRom. Another potential attack on SafeDisc is to pull the encrypted application out of the archive it is contained in. All SafeDisc encrypted discs contain an ICD file, an encrypted format used by SafeDisc to ensure that the original CD is loaded. UnSafeDisc circumvents and decrypts SafeDisc encrypted files by opening the ICD file format, decrypting it, and converting it to an EXE file. However each program requires a specific patch to enable full functionality.
Contents |
Operation
SafeDisc adds a unique digital signature to the optical media at the time of replication. Each time the SafeDisc-protected program run, the SafeDisc authenticator performs various security checks and verifies the SafeDisc signature on the optical media. The authentication process takes about 10 to 20 seconds. Once verification has been established, the sequence is complete and the program will start normally. The SafeDisc signature is designed to be difficult to copy or transfer from the original media. Certain multimedia programs are designed to run from the PC hard drive without accessing files from the program disc after the initial installation. SafeDisc will permit this as long as the consumer retains the original CD or DVD disc, which is required for authentication each time the program is launched. Failure to place the original disc in the drive when loading the program will prevent validation of the SafeDisc signature.
Version History
SafeDisc (V1)
SafeDisk V1 protected CDs can be recognized by several files on the CD:
- 00000001.TMP
- CLCD16.DLL
- CLCD32.DLL
- CLOKSPL.EXE
- DPLAYERX.DLL
And also by the existence of two files <GAME>.EXE and <GAME>.ICD (where <GAME> is replaced with the actual game's name). The EXE executable is only a loader which decrypts and loads the protected game executable in the encrypted ICD file. The initial version of SafeDisc was easy for home users and professional duplicators alike to copy, due to the fact that the ICD file can be decrypted and converted into an EXE file.
SafeDisc (V2)
The following files should exist on every original CD:
- 00000001.TMP
- 00000002.TMP (not always present)
The loader file (<GAME>.EXE) is now integrated into the main executable, making the <GAME>.ICD file obsolete. Also the CLOKSPL.EXE file, which was present in SafeDisc v1, no longer exists. The SD2 version can be found inside the <GAME>.EXE file through its string: "BoG_ *90.0&!! Yy>", followed by three unsigned longs, these are the version, subversion and revision numbers (in hex). When making a backup, read errors will be encountered between sectors 822-10255. The protection also has "weak" sectors, introduced with this version, which causes synchronization problems with certain CD-Writers. Digital signatures are still present in this version. But this has no effect on disc images mounted in Daemon Tools or similar programs. In addition, SafeDisc Version 2.50 added ATIP detection making it impossible to use a copy in a burner unless software that masks this is used (CloneCD has the ability to do this). SafeDisc Versions 2.90 and above make burning copies more difficult requiring burners that are capable of burning the "weak sectors"; these drives are uncommon.
SafeDisc (V3)
SafeDisc v3 uses a key to encrypt the main executable (EXE or DLL) and creates a corresponding digital signature which is added to the CD-ROM/DVD-ROM when they are replicated. The size of the digital signature varies from 3 to 20 MB depending how good the encryption must be. The authentication process takes about 10 to 20 seconds. SafeDisc v3 is capable of encrypting multiple executables over one or more CD/DVD medias, as long as the executables are encrypted with the same key and the digital signature is added to each media. SafeDisc v3 supports Virtual Drives as long as the original CD/DVD is available. Once the CD has been authenticated the game should continue to run from the virtual drive (as long as the virtual drive software has not been blacklisted...). With the introduction of SafeDisc Version 3 which included support for CD/DVD media, as well as virtual drives, the difficulty of burning a copy increased even further.
SafeDisc (V4)
The current SafeDisc version in use is Version 4. Over 40% of games are protected since August 2004, including Quake 4.
SafeDisс driver Vulnerability
SafeDisc installs its own Windows device driver to the user's computer, named secdrv.sys. In addition to enabling the copy protection, it grants ring 0 access to the running application. This is a potential security risk, since trojans and other malware could use the driver to obtain administrator access to the machine, even if the programs are running under a limited account. Even worse is that (beside the default configuration on Windows XP), most installers don't set the security configuration appropriately, allowing every user to let the driver configuration point at an arbitrarily chosen executable which (at the next reboot) is started with administrator privileges. On November 7, 2007 Microsoft stated that there is vulnerability in Macrovision SECDRV.SYS driver [1]. on Windows and it could allow elevation of privilege. This vulnerability does not affect Windows Vista. The driver, secdrv.sys, is used by games which use Macrovision SafeDisc. Without the driver, games with SafeDisc protection would be unable to play on Windows.
