Cracking Clever Content

by Tokachu

At first when I had heard about Clever Content from PEI Magazine and what it was capable of, I was, to say the least, quite intrigued.  It seemed that this was some new (insanely overpriced) technology by Alchemedia to protect images by preventing them from being printed, saved, or otherwise captured.  After a lot of experimenting, I found that Clever Content has multiple safeguards.

How It Works

The first safeguard is the easiest to get past.  It's the HTML encoding parameter.

To prevent viewing the source in Internet Explorer, the Content-Encoding parameter is changed to iso-8859-1.  This disables Save, Print, and View Source in Internet Explorer (it doesn't disable Edit though!).

Next, a special DLL is used to invoke a special method of drawing the image.  Since it doesn't use GDI in an ordinary way, the image cannot be captured by ordinary means.

The DLL is named CSCCTRL.DLL, and is usually located in the %windir%\Downloaded Program Files directory.

By looking in the Registry, you can see that its ActiveX name is CscClnt, and that its CLSID is: 0122955E-1FB0-11D2-A238-006097FAEE8B

Another safeguard within the ActiveX DLL is a routine that detects screen-capture and debugging programs.  If it finds either one, it will not work.  Luckily, it wouldn't detect the Microsoft Visual Studio debugger.

With further debugging, I found the Type Library for the control.  There were lots of interesting settings, such as a RightClick event.  The values for these properties can be found within the embedded JavaScript file in the HTML page (Alchemedia encoded most of them in escape sequences - not that hard to decode.)

How to Capture Images

It took me a bit of time to figure it out, but I finally found out how to capture images "protected" by Clever Content.

First, get a copy of Lotus ScreenCam 97 (it's free from IBM).  With the protected image being shown, start a video-only capture that lasts for at least one second.

Save the video as an uncompressed AVI at 2 frames-per-second, and load it into AVIedit (another freeware program, available from Microsoft's website).

Navigate to the frame where the protected image is displayed and hit Print Screen.  Paste the bitmap into Paint, crop it, and save it.  Poof!  No more protected image.

Conclusion

Hopefully Alchemedia has learned that, once something is posted on a web site, you cannot protect it, no matter how many plug-ins you coax your customers into downloading.