How to remove Truscont Content protection in Pendrive

vbimport

#1

I have a pendrive which contains some materials (PDF) that has content protection from Truscont. I cant open files just by exploring the file. I have to run a exe name Runme.exe that gives me access to files. Even then i can only view them but copying, printing etc is all denied. I tried different softwares but none work.

Also tried opening the PDF from browser but it does not open.

Any way to remove this content protection from Truscont???


#2

I was also able to take the image of the drive using Linux but when i mount the image and try again it asks for the flash drive :frowning:


#3

Although I haven’t actually seen this copy protection in effect, going by their description where protected files open with standard software, what I suspect is that it launches the application in a sandboxed environment to prevent that application being able to save a copy anywhere. Some Antivirus products use this method to test a suspicious file, so that if let’s say the malware starts writing files in suspicious places, nothing actually gets written to those locations and anything that does get written is deleted once the sandboxed environment is terminated.

Here are a few things you can try. As I haven’t seen the copy protection in action, it’s quite possible they already know and block the following.

  1. With one of the PDFs open, try searching the PC for the PDF. For a regular application to view a protected file, it will most likely need to temporarily save an unprotected version on the PC for it to open. You may need to do this from an administrator command prompt.

  2. Make your web browser the default application for opening PDFs, then try opening one of the protected PDFs. If you can get your web browser to display one of the PDFs, what you could try is opening a second tab and attach that PDF to an e-mail and save it as a draft or e-mail it to yourself. The address bar of the tab with the open PDF should give an idea of where it’s temporarily located. If this works, you can close the web browser (so it’s no longer possibly sandboxed), then check your e-mail to retrieve that attachment.

  3. If you are familiar with using a virtual PC and know how to mount a virtual hard disk locally, another thing to try is mount the USB flash drive directly with the virtual PC and open up the protected file in virtual PC. Then forcefully switch off the virtual PC without doing a shutdown. Now mount its virtual hard disk and try searching it for PDF files. Alternatively if you have a spare PC running Windows and it backed up (or nothing important on it), you could potentially try this method with that also, e.g. open the protected PDF, disconnect the power cord, then boot a live Linux CD, etc. to see if you can find a PDF stored hidden somewhere.


#4

Did you contact Truscont for more help on this? That would be my advice as we can’t help you break/hack protected content especially commercial product. So contact Truscont and ask for more help on this.


#5

well Seán i tried method 1 of your suggestion
I found a .TMP file with the exact size of that of the PDF and created a few seconds before…i copied it to a different location and converted it to PDF format and tried opening it but the problem persists still.

It gives the same error as when trying to open the PDF without running the RunMe.EXE to enable the content protection

And since this did not work most likely the third suggestion wont work either.

The second suggestion wont work as ive tried it already in Chrome…it will just say Unable to open PDF

Any other suggestions?
as mentioned earlier i was able to take image using Backtrack5 (Linux) but am not able to open it in Linux


#6

I came across this thread, which is worth checking. I wonder if its USB protection is similar to what it uses on DVD.

It does seem to check the name of what opens the PDF, which likely explains why Chrome couldn’t open it. However, you could try Internet Explorer or making a copy of iexplore.exe and renaming it to a few suggestions in this post as the default viewer.

From what I’ve read, if any application that successfully opens the PDF tries writing anything to the hard disk, the resulting file is zero-wiped by the protection, so what ever successfully opens it would need to be able to upload it, unless you can find a way of doing a memory dump and extracting the PDF from that.

I don’t think creating an image of the USB stick will work. The RunMe probably checks the USB stick for a serial number or some other hardware detail that is not in the file system before it allows the contents to be accessed. The actual files are likely encrypted, but transparently decrypted in the background as Acrobat opens them, muck like using a disk encryption utility.


#7

If you can’t remove the protection,maybe you can try Mouser’s Screenshot Captor to grab the images when the pdf’s are opened…


#8

[QUOTE=;2729935]If you can’t remove the protection,maybe you can try Mouser’s Screenshot Captor to grab the images when the pdf’s are opened…[/QUOTE]

Thanks roadworker…Screenshot Captor was gr8
I ran it in a 2K res display and tuk snaps of all PDFs in jus 10 mins
And cuz of the higher res display the resultant PDF that i got was of even grater quality!!!


#9

[QUOTE=Seán;2729878]I came across this thread, which is worth checking. I wonder if its USB protection is similar to what it uses on DVD.

It does seem to check the name of what opens the PDF, which likely explains why Chrome couldn’t open it. However, you could try Internet Explorer or making a copy of iexplore.exe and renaming it to a few suggestions in this post as the default viewer.

From what I’ve read, if any application that successfully opens the PDF tries writing anything to the hard disk, the resulting file is zero-wiped by the protection, so what ever successfully opens it would need to be able to upload it, unless you can find a way of doing a memory dump and extracting the PDF from that.

I don’t think creating an image of the USB stick will work. The RunMe probably checks the USB stick for a serial number or some other hardware detail that is not in the file system before it allows the contents to be accessed. The actual files are likely encrypted, but transparently decrypted in the background as Acrobat opens them, muck like using a disk encryption utility.[/QUOTE]

The renaming method also did not work unfortunately…Screenshot Captor was nice though allowing to take the snapshot of a specific portion of the window over and over again with completely customisable shortcuts…i made F4 as shortcut and in 10 mins had the entire PDF snaped…converted to PDFs and OCR came in handy


#10

Thanks for the help guys


#11

I haven’t heard of Screenshot Captor before, but have now installed it :wink: It’ll come in handy for odd web pages I want to print that otherwise turn into a mess or don’t copy & paste right.

So far the only DRM crippled reading material I’ve dealt with was Amazon’s Kindle books, but I’ve a Calibre plug-in that removes the DRM, so I can convert books for my mother’s Nook.


#12

@sgniranjan,glad that Screenshot Captor was a satisfying solution for your case…:slight_smile:
@Seán,Screenshot Captor is not as shiny as Camtasia or Snagit,but IMHO,it’s 1 of the best free capture programs found on the .net…
I’m a happy user since 2005…:iagree:
PS : check also Mouser’s other programs,especially UrlSnooper…:wink:


#14

I too have the same problem


#15

will it work with pdf