Detecting Securom New

Now I know that Clony can detect Securom new, but is it possibly to idea this protection by examining files on the CD?

Sorry about my english error, making my statement incoherent. I meant to ask if Securom New can be detected by examining files on the CD. My apologies. (Late at night, very, very late)

Yes search on KitnaIsntHappy and examine his posts. You could refine it by adding “securom” to the Search By Keyword as well :wink:

Kitna and I did a lot of work on this at CloneClinic

SecuROM v1-5

Files: CMS16.DLL, CMS_95.DLL or CMS_NT.DLL in the installed directory or the CD root. DADC is also printed on the inside ring of the CD (not always as DDAC is a manufacturing plant, others are used). “CMS” can be found as ASCII text in the main executable (you need a hex editor…if you’re game!)
SecuROM new
Files: sintf16.dll sintf32.dll sintfnt.dll in the Windows system directory or the CD root. DADC is also printed on the inside ring of the CD (not always as DDAC is a manufacturing plant, others are used). ?“sintf” can be found as ASCII text in the main executable (you need a hex editor…if you’re game!)

Please note that not all files will be on every safedisc title, but that if any files are on a title it is Safedisc. If only the file 00000001.tmp is found it is most likely Safedisc 2.
The list is :
00000c0a.016, 00000c0a.256, 00000001.tmp, 0000040c.016, 0000040c.256, 0000041d.016, 0000041d.256, 0000041e.016, 0000041d.256, 00000404.016, 00000404.256, 00000407.016, 00000407.256, 00000409.016, 00000409.256, 00000410.016, 00000410.256, 00000411.016, 00000411.256, 00000412.016, 00000412.256, 00000413.016, 00000413.256, 00000415.016, 00000415.256, 00000416.016, 00000416.256, 00000804.016, 00000804.256, 00000809.016, 00000809.256, Clcd16.dll, Clcd32.dll, Clokspl.exe, Dplayerx.dll, *.icd, Secdrv.sys??
I am unsure if Secdrv.sys is related to Safedisc but it was found on 90% of titles I checked.

Re: Safedisc 1 (Post for Futureproof)

It turns out that Secdrv.sys is SD related.

Quote from ArthaXerXes:

  • driver extracted from the exe and put in \winnt\system32\drivers

  • performs debug checks

  • same routine for
    _ _ _ _ - IRP_MJ_CREATE
    _ _ _ _ - IRP_MJ_CLOSE
    _ _ _ _ - IRP_MJ_DEVICE_CONTROL

  • this routine does not always call debug check

  • home of the nasty drX checks

  • and most likely other checks as well ?