DVD - Sub-Channel Read/Write

Burning Software Copy Protection
#1

Dear Club MyCE,

First off, i am looking to create quality backup copies of PC games.

Now, i understand that there is an ID in the sub-channel data of a disc which needs to match the game executable which gets installed on a PC.

I have two questions open for discussion:

  1. Is it possible to rip (read) the sub-channel data from a DVD into an image file? (therefore including all the copy-protection etc)

  2. Is it possible to burn (write) the DVD image (with all sub-channel data) onto a blank DVD?

I assume question 2 is impossible at the moment otherwise everyone would be making perfect backups. So, do DVD writers have read/write capabilities of sub-channel data (RAW)?

Please discuss. Thanks.

#2

  1. No, there are no subchannels on DVDs, only this

  2. Even though there are ways to read all Bytes of a DVD sector it’s not needed for working PC game images

Anyway, as you’ve already assumed RAW writing isn’t possible.

#3

[QUOTE=Terramex;2559399]1) No, there are no subchannels on DVDs, only this

  1. Even though there are ways to read all Bytes of a DVD sector it’s not needed for working PC game images

Anyway, as you’ve already assumed RAW writing isn’t possible.[/QUOTE]

Thanks Terramex.

So, lets get a few things straight. You say you can read all Bytes of a DVD - what are these “ways” as i’ve never heard of being able to do this. Would these “ways” allow the cloning on the protection on the discs?

Just say if you did make an exact bit by bit copy of a disc (therefore including all DRM), what would happen if you tried to then burn that data to a DVD?

I hope you can ellaborate on your expertise. Thank you very much.

#4

[QUOTE=Zonchord;2559406]Thanks Terramex.

So, lets get a few things straight. You say you can read all Bytes of a DVD - what are these “ways” as i’ve never heard of being able to do this. Would these “ways” allow the cloning on the protection on the discs?

Just say if you did make an exact bit by bit copy of a disc (therefore including all DRM), what would happen if you tried to then burn that data to a DVD?

I hope you can ellaborate on your expertise. Thank you very much.[/QUOTE]Some drives supports reading the drive buffer of sectors, i.e. the drive cache, which contains the raw 2064 DVD sector. These drives support it:

  • Plextor 755
  • Plextor 760
  • LiteOn163 (sold by TDK)
  • Hitachi LG GDR-8161b
  • Hitachi LG GDR-8162b
  • Hitachi LG GDR-8163b
  • Hitachi LG GDR-8164b

There is no raw 2064 write command in consumer commercial drives so you cannot write such data. Anyway DVD protections such as SafeDisc and Securom make use of non standard ways, i.e. even if you made bit for bit - that won’t defeat it.

#5

I think its important to know that you cannot make an exact clone copy of such a pressed disc. You can surely copy all the “user” [B]data[/B] from it, but not clone anything else that is on such a pressed disc…

#6

[QUOTE=Zonchord;2559406]I hope you can ellaborate on your expertise. Thank you very much.[/QUOTE]With Truman you got answer from a qualified person.

I’m not known for profound expertise anyway :wink:

#7

[QUOTE=Truman;2559414]Some drives supports reading the drive buffer of sectors, i.e. the drive cache, which contains the raw 2064 DVD sector. These drives support it:

  • Plextor 755
  • Plextor 760
  • LiteOn163 (sold by TDK)
  • Hitachi LG GDR-8161b
  • Hitachi LG GDR-8162b
  • Hitachi LG GDR-8163b
  • Hitachi LG GDR-8164b

There is no raw 2064 write command in consumer commercial drives so you cannot write such data. Anyway DVD protections such as SafeDisc and Securom make use of non standard ways, i.e. even if you made bit for bit - that won’t defeat it.[/QUOTE]

Very interesting, thank you. I assume “non-standard” ways involve some kind of physical pressing onto the disc? If you were to make a “bit for bit” copy, then which protections would this defeat?

I understand newer CD-ROM drives allow RAW capabilities, does this mean i would be able to create exact backups of PlayStation 1 discs?

#8

[QUOTE=Zonchord;2559524]If you were to make a “bit for bit” copy, then which protections would this defeat?
[/QUOTE]Not relevant for PC protections - only for Nintendo Wii backups.

[QUOTE=Zonchord;2559524]I understand newer CD-ROM drives allow RAW capabilities, does this mean i would be able to create exact backups of PlayStation 1 discs?[/QUOTE]No, not possible:


#9

[QUOTE=Terramex;2559528]Not relevant for PC protections - only for Nintendo Wii backups.

No, not possible:


Thanks again Terramex.

I think i need to read up on DRM techniques and the structure of optical discs so that i can thoroughly understand the issue here. Do you have any useful websites/resources on DRM/disc structure etc?

#10

SecuROM and Angle-Based Protections in general:


http://www.reverse-engineering.info/CD/Angle_Based_Copy_Protections.html (unfortunately Sir David Guy’s original page doesn’t exist anymore)

Safedisc (based on Bit Patterns which are so-called “weak sectors”):

Tages (protection based on Twin sectors):

Of course there are much more interesting/explaining threads on MyCE.
Just use the power of the Forum Search funtion :wink:

Main CD & DVD ECMAs:
http://www.ecma-international.org/publications/standards/Ecma-130.htm
http://www.ecma-international.org/publications/standards/Ecma-267.htm

And finally some interesting reading about similarities between (very) old and new protection schemes:
http://root.org/talks/RSA_20070206.pdf

#11

[QUOTE=Terramex;2559583]SecuROM and Angle-Based Protections in general:


http://www.reverse-engineering.info/CD/Angle_Based_Copy_Protections.html (unfortunately Sir David Guy’s original page doesn’t exist anymore)

Safedisc (based on Bit Patterns which are so-called “weak sectors”):

Tages (protection based on Twin sectors):

Of course there are much more interesting/explaining threads on MyCE.
Just use the power of the Forum Search funtion :wink:

Main CD & DVD ECMAs:
http://www.ecma-international.org/publications/standards/Ecma-130.htm
http://www.ecma-international.org/publications/standards/Ecma-267.htm

And finally some interesting reading about similarities between (very) old and new protection schemes:
http://root.org/talks/RSA_20070206.pdf[/QUOTE]

Brilliant job, thanks a lot.

#12

One addendum regarding the protections:
Of course not all CD information can be applied 1:1 to DVDs, but the functional principle is the same,
namely non-standard (relative or absolute) sector density, weak sectors & twin sectors.

#13

Wow, nice replies!

Just another addendum:

Sector density is based on the reading times of sectors, when you run the game.exe it will run a series of elapsed time measurements of read sectors, and on the original disc some sectors will read slower causing a spike. You can see this chart with a securom v4.x+ CD or DVD game using bwa builder tool by installing blindwrite trial:
http://www.blindwrite.com/

Weak sectors is based on the poor design choice of the relative pit lengths, and the CD-R vs Pressed CD quality. Due to the poor relative pit lengths, there are certain sequences of bytes that causes reading to be quite difficult (hence the name weak sector). Because pressed CD masters are created by a high quality and calibrated LBR (laser beam reacorder) that cuts, rather than burned, weak sectors are written very accurate (in other words they’re not weak at all on the pressed CD). The protection company will ensure that the LBR is of high enough quality by using specific CD plants and LBR for their mastering. So reading them from the pressed CD is no problem.

A CD-R on the other hand is burned with a low quality and isn’t highly calibrated for every disc you insert, further more the pits are not cut, they are burned which gives a blurred edge (less accurate to when reading back) so those burned sectors become quite difficult to read, and usually results in unreadable errors. The game.exe will know it is a copy simply by seeing an unreadable sector where there shouldn’t be any. You can run this very same test using the famous sheep test by alexnoe, using this nice guide:

#14

Great thread, great replies!

[U]Here’s an simple overview for those learning[/U]:

SubChannel data was actually only used on Audio formats from what I can see, don’t think any other CD formats (data)used it…so it was completely dropped from future optical discs.

RAW CD copy is possible (2352). RAW means as in user data, toc & Subchannel. Data Mode 1/2 formats will have some extra EDC/ECC. There is no such thing as a true 1:1 copy (i.e. Lead-In, CIRC, EDC, ECC, Sync etc.) all get omitted - so their is places to hide protections (e.g consoles) :frowning:

RAW DVD was curbed due to CSS so can’t fully be done, but as was said some drives (ones that copy Wii games) can do 2064. (thanks to truman for that info :bigsmile:)

1:1 RAW+96 is a refernce to CDs only, RAW (2352) per sector and 96 bytes subchannel. This does not mean it is truly a 1:1 (as it’s not as explained above) it means that it’s as close to it as consumer level drive will do. 1:1 Backup usually just means a “working copy” :iagree:

#15

[QUOTE=tubebar;2559658]Great thread, great replies!

[B]RAW DVD was curbed due to CSS so can’t fully be done[/B], but as was said some drives (ones that copy Wii games) can do 2064. (thanks to truman for that info :bigsmile:)
[/QUOTE]

Are you sure about that? I mean in case you would use an Authoring burner (Pioneer S201)?! :flower:

#16

[QUOTE=chef;2559691]Are you sure about that? I mean in case you would use an Authoring burner (Pioneer S201)?! :flower:[/QUOTE]It does not support 2064 raw write either. It does have special commands to write some DDP info to the lead-in onto “DVD-R for authoring media” to support CMF (Cutting Mastering Format), but that is a controlled way, and it writes in 2048 mode. CSS is never written to DVD recordables, they are added (inserted) at the DVD pressing plant with CSS license and special CSS software.

#17

Before anyone asks, even the authored DVD CSS DDP image on a DLT (common mastering digital tape) does not contain the encrypted CSS sectors. The mastering software (like Gear Pro, EclipseSuite, etc) does not actually encypt with CSS at all, all they do is ensure that each sector is flagged to be CSS encrypted - hence why you need more than 2048. The original 2048 sector data is unmodified in the image.dat (DDP) file.

#18

Now that we’re on the subject, what about the DVD-R CSS discs? Not talking about Authoring ones, but the ones made by Qflix (http://www.qflix.com/enu/default.html) that do require different writers such as: http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Daps&field-keywords=Qfli+Writer

#19

Not much difference to normal DVD recordable writing…

DVD-R CSS Managed Recording media contains already recorded player keys and Qflix disc key in the lead-in:
http://www.pioneerelectronics.com/ephox/StaticFiles/PUSA/Files/FAQ_Drives-Qflix.pdf

All that’s needed is for the writer to support writing of DVD-R CSS Managed Recording media. The process is as follows:

  1. Consumer downloads Qflix dvd file using Qflix software
  2. Consumer Qflix software sends Qflix title key + region zone to burner drive
  3. Set write page
  4. Sends write10 command with 2048 byte sector data (starts from sector 0 (after lead-in) - same as normal burners)
  5. Drive internally combines CPR_MAI (with Qflix title key + region zone) to each sector then burns it
  6. Repeat from 4. until last sector
  7. Drive automatically writes lead-out.

So as you see it is still write10 command of 2048 sectors. The Qflix DVD file 2048 sectors are prescrambled already with the Qflix title key, so the drive doesn’t do any CSS scrambling.

Some drives may support the 2054 write mode, in which case this is the process:

  1. Consumer downloads Qflix dvd file using Qflix software
  2. Set write page for Recordable CSS 2054 Writing Mode
  3. Sends write10 command with 2054 byte sector data (starts from sector 0 (after lead-in) - same as normal burners)
  4. Repeat from 4. until last sector
  5. Drive automatically writes lead-out.

As you have noticed you can’t create your own CSS, because the lead-in is prerecorded with Qflix’s own disc key.

#20

Ah so it’s still 2048 and nothing special going on really. :bigsmile:

Is it me or are they way over protective of CSS? Look at all they went thru to stop drives from writing the keys and it’s useless for the most part.