A TAGES dialog

On a rainy night, Mr TechFreak and Mr BadGuy were discussing copy protections...

BG: ...and that's how weak sectors actually work.

TF: Yes, that's also what I found, but go explain that on a board.

BG: Usually messageboards are full of bogus information, like all that tages fuss.

TF: You know tages ? Can you explain in a nutshell how it works ?

BG: Sure. Actually tages is nothing more than Q subchannel modifications.
But first, do you know how a drive seeks for a given sector on the disc ?

TF: I think so. First the drive always knows where it is on the disc based
on min/sec/frm informations from the Q subchannel. Then, when you ask
for a particular sector number, it calculates the difference with the
current position and converts this delta into an approximate distance
that he uses to move the laser. But since this is not precise enough,
it actually always takes a safety margin and jumps a bit before the
target sector and keeps scanning the Q subcode until it reaches the
correct min/sec/frm value. Then it really starts decoding data.

BG: Exactly. Now you know RAW writing let you specify all data and subchannel
data, including Q subchannel. So it's possible to write two sectors with
the same min/sec/frm value, but with different data. You can even write
two identical ranges on a disk, for instance sectors 0..199,200,100,101..300...
where the complete range 100-200 is duplicated.

TF: Hmm, that explains why some people say they sometimes read different data
for the same sector... actually they read the same sector number, but two
different sectors, sometimes in the first range and sometimes in the second one.

BG: Yes, and of course to differentiate a copy from the original disc the program
must be able to check that the two ranges are really on the disc.

TF: And how do they do that ?

BG: Remember how seeks work ? Ok, let's call the two ranges 'a' and 'b', and let's
say your drive performs seeks with a 20 sectors margin. On the disc you have
sectors 0...99,100a,101a,...199a,200a,100b,101b,...199b,200b,201,...
Alright, so for instance let's say the protection checks sector 150. First
it reads sector 0 then seeks for sector 150 : the laser will move forward
about +130 sectors, reach sector 130a and keep seeking until it reads sector
150a. Now, if you first read sector 300 then seeks for sector 150, the laser
will move backwards about -170 sectors, reach the second range at sector
130b, then again keep seeking until it finds 150b.

TF: Hmm, that's smart.

BG: :)

TF: So actually any drive with RAW16 capabilities can write tages, provided it has
a correct image ?

BG: Yes, that makes tages very easy to write, but more difficult to read. Because
when you want to make an iso, your program reads sectors sequentially from start
to end and when you reach sector 200a, the drive expects the next sector to be 201,
not 100. So the drive thinks the laser got off track and it keeps seeking forward,
looking for the correct sector number (201). So you end up with an iso wich contains
only 0...100a...200a,201,...

TF: But one can make a correct image by hand, using the trick you explained ?

BG: Sure. First, you read the disc and make an image as usual. Then you read the
disc backwards, and make another image. Comparing the two images will show some
different sectors : just extract these sectors from the second image and insert
them in the first one, just after the range of sectors with the same numbers.
For extra safety you should add some dummy sectors before the range you insert,
to cope with your drive's lack of precision during seeks. That's it :)

TF: I see... so you will actually never be able to read the first sectors of the
b range due to the way seeks work. But it does not matter anyway since your
drive will not be able to reach these first sectors on the original disc either.
Well that's nice, because with these informations one can now quite easily make a
program to copy tages...

That sounds pretty logical. And it would explain some things that have already been said about Tages.
So it should be able to create a Tages image by just reading a CD twice. The first time you seek forward, the second time backwards. I guess that will keep reading very slow, but it could work.
Let's hope Olli will work on this.

hehe, rock on


what will happen if you 'leave out' a sector in the subchannel?

so the mojito guys modified the toc to confuse reversers =)

edit: this is complete nonsense , of course...

---

Last edited by blackcheck; 11-08-2002 at 17:47.

Hurray!

If you seek to a sector after it, I guess it just gets ignored.

If you seek to the sector, it is probably reported as an unrecoverable error.

i did some tests and it works like a charm ...

only modifying the subchannel did'nt work for me. the min/sec/frm
data in the sector header must be adjusted, too.

Have you already spoken with Olli form CCD team???
I thomk you should mail them of whatever...

Great work guys!

eh?

The pit or land is as long as governed by the number of zero's sent to the laser.

Yes... what I meant is:

If you have a land that is say 3 "1s" long, will it be the same length as a pit which is 3 "0s" long?

A land isn't always 1 and a pit isn't always 0.

You will never have a sequence of 111. Maybe 1001.

A 1 is a change between a pit and a land, and a 0 is a lack of such change.

The size of the burn mark for each must be relatively consistent, or else the reading drive cannot always read reliably.

OK thanks SDG... sorry about that

Sure.

HI,
@ AtomicX:
Im sorry but Plextors VariREc doesnt help anything on Tages.
Gräfdig Gloner

He means on StarForce, modulating how powerful the brightness is as the burning goes along.

But as StarForce is simply "CD-Cops Advanced", it won't do any good, barring some obscure caveat of CD-Rom design.

I think it will not be too difficult. You just have to read sector by sector beginning with the last one. But as drives are optimised to read continuous sectors forward, this will be quite slow I think.
One would need the possibility to read data and subchannel continuously without even asking for a specific sector. But I guess that's impossible with the current MMC-Commands.

"I think it will not be too difficult. You just have to read sector by sector beginning with the last one. But as drives are optimised to read continuous sectors forward, this will be quite slow I think."

Maybe it would be possible to put a option to read only part of the sectors backwards instead of whole disc. For example read the whole disc once normally and after that those sectors where the protection is backwards.

(You would hear location of protection sectors from forums)

All right, I'll formulate my question otherwise:

Is it possible with current CD/DVD-readers/writers and the current burning programs (Nero, CloneCD, Feurio, BlindWrite, CDRWin, etc) to read a CD backwards, or do you need some special tool???

And for everybody's information: I didn't mean to offend blackcheck, I only hope(d) he would share his knowlegde with me (us).

No, you did not offend blackcheck, otherwise you would have already received a PM from me...

If you first want to read the last sector, then the second last sector etc, then it is no problem (although I don't see why you might want to do this). But one sectors can only be read forward.

A special tool won't help either.

Maybe you find this interesting:
ftp://ftp.ecma.ch/ecma-st/Ecma-130.pdf
http://custom.lab.unb.br/pub/info/t1...c4/mmc4r01.pdf

---

Last edited by alexnoe; 13-08-2002 at 15:44.

@Namoh

Currently there are no programs available that can read a cd backwards. So the programs you mention won't help you. A cd-reader is built to read a cd forwards, that is why there are no programs outthere which read a cd backwards... In order to defeat Tages somebody has to write a program which does read a cd backwards. (Backwards like alexnoe explained.) Maybe Olli will implement such a feature into CloneCD...

Clony has a feauture to do this.

You first read the last sector, and then whatever sector you think might be doubled, then the first sector, and then the same sector you think is doubled.

They should be different.

Alright people, no fight here please.

As Liggy explained, reading backwards means reading the sectors
starting from the last one back to the first one, but of course always
reading forward from the first byte of the sector to the last one.
Any drive can do it with the correct program, but I don't know of
such program (but with a good aspi knowledge it's a matter of
1 hour to write one).

About Liggy's concern :

> You just have to read sector by sector beginning with the last one.
> But as drives are optimised to read continuous sectors forward,
> this will be quite slow I think.

As SDG explained, you actually don't have to read the complete
disc backwards sector by sector, just the duplicate range.
To locate this range, you can seek backwards the complete
disc and read a burst of sectors smaller than the range size.
Then you compare these bursts with the forward image, a
difference gives you the range location. Start with a medium
range size and decrease it if you find nothing.

But one should always keep in mind, that it is possible to repeat this trick several times on one CD.

What about patching aspi drivers to not make Sector seeks when reading sequentially ?
I'm not really sure if this is possible because of the gap between some sectors (or all?) but if you could identify the read data as sector and carry on reading and reading?
Is there anyone who has the source of aspi drivers?
AFAIK the ATAPI drives also use the aspi layer to access the drives.
Or is the problem deeper in the driver or even in the firmware?

A way to detect where the twin sectors lie:

Read this disc normally, forwards, at a fixed rate.

Where the twin sectors are, there will be a drop in the speed, while the drive seeks from the last sector before the twins in the forward read, and the one after.