Log in

View Full Version : FADE Protection


Kayaker
January 30th, 2004, 02:25
Hi all,

Some may have heard of this protection before, apparently it's been around for a few years though there seem to be a few more recent press releases, I was just wondering if anyone has looked into the mechanics of it closer. There has been a small mention of it at club.cdfreaks.com and the Codemasters site for example, but little discussion on the details.

Here is a relatively recent article from
http://www.newscientist.com/news/news.jsp?id=ns99994248

--------------------------------
'Subversive' code could kill off software piracy

Software pirates who make illegal copies of a particular computer game are finding the games companies are coming up with a radical new anti-copying strategy.

Illegally copied games protected by the system work properly at first, but start to fall apart after the player has had just enough time to get hooked. As a result, the pirated discs actually encourage people to buy the genuine software, the developers say.

The new protection system, called Fade, is being introduced by Macrovision, a company in
Santa Clara, California, that specialises in digital rights management, and the British games developer Codemasters, based in Leamington Spa. It makes unauthorised copies of games slowly degrade, so that cars no long steer, guns cannot be aimed and footballs fly away into space. But by that time the player has become addicted to the game.

Fade exploits the systems for error correction that computers use to cope with CD-ROMs or DVDs that have become scratched. Software protected by Fade contains fragments of "subversive" code designed to seem like scratches. The bogus scratches are arranged on the disc in a subtle pattern that the game's master program looks for. If it finds them, the game plays as usual.

When someone tries to copy the disc on a PC, however, the error-correcting routines built into the computer attempt to fix the bogus scratches. When the copied disc is played, the master program then cannot find the pattern it is looking for, so it knows the disc is a copy.


Promotion tool

What happens next turns the usual rules of software protection on their head. Instead of switching off the game and preventing it from playing at all, the master program begins to disable it. In the game Operation Flashpoint, which has been the proving ground for Fade, players soon find that their guns shoot off target and run out of bullets.

"The beauty of this is that the degrading copy becomes a sales promotion tool. People go out and buy an original version," claims Bruce Everiss of Codemasters.

The idea intrigues Alistair Kelman, an independent lawyer who specialises in copyright: "Fade is entirely in keeping with the spirit and great traditions of copyright." He points out that books tend to deteriorate with use and this prevents the secondhand market from competing with the market for new books. Why not the same for software?

Following its success with Operation Flashpoint, Codemasters is also using Fade with a new snooker game. Copies play normally for a while, but after a predetermined number of potshots, gravity is progressively turned off so the balls start behaving oddly and end up floating over the table.

Fade was devised by Richard Darling, who founded Codemasters 16 years ago, and has now been included in Macrovision's SafeDisc anti-piracy system. Next year, Macrovision plans to release a DVD movie protection system called SafeDVD, which will use a similar technique to make copied discs stop playing at a key point in the movie's plot.
--------------------------


I had heard about this idea of "fake" CD scratches before, but to be able to create code which fools the systems natural error correction routines which compensate for scratched CDs sounds very intriguing. It also reflects a high degree of understanding of just what these correction mechanisms are and how they work. From the description this sounds like the mechanism is built into the OS as opposed to being part of the CD burners software?

Does anyone have any idea of how this is implemented or what the code that emulates a "scratch" might look like? CD protections aren't really my forte, my interest is more from the hardware/OS code/programming side of how the protection might work.

I like the "confuse-a-cracker" aspect of the protection too, instead of the "you have Softice installed therefore you are bad and I will not run at all" strategy

Kayaker

evlncrn8
January 30th, 2004, 03:26
fade was used by codemasters on operation flashpoint, it turned out that the 'fade' protection wasnt quite what it was made out to be, infact it was more or less a glorified cdkey check, however i believe that on playstations etc fade does exist, however for the pc, (esp. in the cases of op. flashpoint)it was one big spoof.. it would seem the protectionists are trying to marry their protections with the games at source code level, making it (in theory) harder to crack

naides
January 30th, 2004, 08:47
Hi Kayaker:

This commentary is made out of my absolute ignorance in this theme.
If what they claim is true, and that is a big IF, the spirit of the protection is the same as Safe-Disc, which has been defeated with raw-mode CD burners, which copy everything, mistakes included, into the New CD.
To defeat it at a software level, I presume a point of attack would involve isolating the routines that access the disk data in low level mode to detect the disk mistakes, then deactivating those routines.

This protection is probably intended for the copy and share kid, rather than a more academic cracker. It is only a cleverly modified form of a nag screen.

dELTA
January 30th, 2004, 13:49
This same "degradation type protection" was mentioned in a "new revolutionary CD protection" a couple of years ago I remember. I think its name was Fo... something, and judging by history it did not succeed very well. But like naides say, sure, it might be good for kids, but for pros there's always just the question of pinpointing, analyzing and tracing the correct functions, and it's toast.

doug
January 30th, 2004, 17:23
Securom's "trigger functions" is another example of fade protection (without the (c) name)...

http://www.securom.com/solution_disc.asp#trigger
http://www.securom.com/news.asp?id=13

It did confuse people for a few months, when it was introduced. Right now though, it's completely reversed & generically cracked.

Basically it's just a fancy name for saying: checks that run after the application has started (so that a cracker has to do more than simply removing the protection shell & fixing apis) ...