Now I know that Clony can detect Securom new, but is it possibly to idea this protection by examining files on the CD?
Sorry about my english error, making my statement incoherent. I meant to ask if Securom New can be detected by examining files on the CD. My apologies. (Late at night, very, very late)
Yes search on KitnaIsntHappy and examine his posts. You could refine it by adding “securom” to the Search By Keyword as well
Kitna and I did a lot of work on this at CloneClinic
Files: CMS16.DLL, CMS_95.DLL or CMS_NT.DLL in the installed directory or the CD root. DADC is also printed on the inside ring of the CD (not always as DDAC is a manufacturing plant, others are used). “CMS” can be found as ASCII text in the main executable (you need a hex editorâ€¦if you’re game!)
Files: sintf16.dll sintf32.dll sintfnt.dll in the Windows system directory or the CD root. DADC is also printed on the inside ring of the CD (not always as DDAC is a manufacturing plant, others are used). ?“sintf” can be found as ASCII text in the main executable (you need a hex editorâ€¦if you’re game!)
Please note that not all files will be on every safedisc title, but that if any files are on a title it is Safedisc. If only the file 00000001.tmp is found it is most likely Safedisc 2.
The list is :
00000c0a.016, 00000c0a.256, 00000001.tmp, 0000040c.016, 0000040c.256, 0000041d.016, 0000041d.256, 0000041e.016, 0000041d.256, 00000404.016, 00000404.256, 00000407.016, 00000407.256, 00000409.016, 00000409.256, 00000410.016, 00000410.256, 00000411.016, 00000411.256, 00000412.016, 00000412.256, 00000413.016, 00000413.256, 00000415.016, 00000415.256, 00000416.016, 00000416.256, 00000804.016, 00000804.256, 00000809.016, 00000809.256, Clcd16.dll, Clcd32.dll, Clokspl.exe, Dplayerx.dll, *.icd, Secdrv.sys??
I am unsure if Secdrv.sys is related to Safedisc but it was found on 90% of titles I checked.
Re: Safedisc 1 (Post for Futureproof)
It turns out that Secdrv.sys is SD related.
Quote from ArthaXerXes:
driver extracted from the exe and put in \winnt\system32\drivers
performs debug checks
same routine for
_ _ _ _ - IRP_MJ_CREATE
_ _ _ _ - IRP_MJ_CLOSE
_ _ _ _ - IRP_MJ_DEVICE_CONTROL
this routine does not always call debug check
home of the nasty drX checks
and most likely other checks as well ?