hacking games with starforce

[BarryB]

As I understand it there are different levels of how to implement SF3 protection.

One is to just protect the EXE, not too difficult to deal with. I believe Gangland and Singles are examples of this

Another method involves not only protecting the EXE but encrypting data files too, look at Dead To Rights for an example of that! The 'crack' was nearly a whole CD!

Then there are the 'emulated functions'. As I understand it from a reliable source, it's these 'active protected functions' in the EXE that are the bitch that has stopped the release of titles like Beyond Divinity, TOCA2 and Killswitch as they are time consuming to find/trace!!

Please correct me if I'm wrong on any of those points

[Morglum007]

U re right barry, but lets say the problem is not to trace such functions, but "create" the VM SF code that is removed when a dump is made.

Thats the problem with SF, finding and linking the so called p-code table to make an "universal" crack that just works for every game release, and not only in the native cracked release.

Good luck!

[Antenna]

As far as I know, StarForce3 sneakily install hidden hardware devices (software dongles).

This degrades system speed/stability, and soon tools like Spybot S&D or AdAware will have no other option than to scan for, and remove these illegal "installs".

[BarryB]

I'm not sure a 'universal' crack could be made Morglum, maybe coded tools to help in the tracing/creating these functions that don't get dumped, or maybe you mean once dumped, then fix it with a universal tool? Still not sure it's that easy, the developers of this protection meant it to be tough to crack, and it's proving just that!

[Morglum007]

Originally Posted by BarryB

I'm not sure a 'universal' crack could be made Morglum, maybe coded tools to help in the tracing/creating these functions that don't get dumped, or maybe you mean once dumped, then fix it with a universal tool? Still not sure it's that easy, the developers of this protection meant it to be tough to crack, and it's proving just that!

Well, i think it is possible. The problem is to hook EVERY p-code, used or not, and not just the minimum required to launch with a specific release of the game. Thats like the API calls in SecuROM. In SF there is a p-code table and a "translation table" found in near .dll ( not protect.dll) The problem is to get all translated. With US/UK/german releases, it is fixed just the p-code to make working such releases, but not every one, so other releases in other countries do not have "support". the way of obtain such table will make a "universal" way of procceding.

Good luck!

[ByteMare]

Ok, what about those "Active protection functions",something similar to sexxurom triggers? Just checked out a "known title" and *wow* hooking every p-code sure as hell gonna take some time....nice antidebug, it took me 3 beers to get around (and some reboots) I should join your forums, Morglum..this starts to look like a real challenge heh

[Morglum007]

Well, that "Active protection functions" are too easy to find in SecuROM. It is just API call. SF works in another way.

Good luck!