How to set a data track to audio track?

vbimport

#1

Hello everybody.

I saw a sample protected cd with few sessions that each one contained 2 tracks : an audio track and then, a data track.

The TOC is something like this:


Session 1:
Data

Session 2:
Audio
Data

Session 3:
Audio
Data
...
...
Session 6:
Audio
Data

But the audio tracks is really data track which is faked as audio. (2352 bytes is each sector, Sync pattern, some data, EDC/ECC).


Do you know how to read this fake audio track as raw mode data track (2352 bytes/sector)?

As I tested Nero, CloneCD and Alcohol 120%, they red fake audio in 2048-byte mode and destroyed the contents of sectors. As the cd-check routine reads the contents of some sectors, it easily detects copy from original.

So I wrote a simple cd imager using SPTI which could read all sectors in raw mode (because the fake audio sectors are 2352 bytes length, they imaged correctly). Then captured the TOC using cloneCD, and replaced ClondCD.img with my RAW image and corrected the subchannel file (creating it using UltraISO and my image.bin).

Now the Image is perfectly as original cd, but in virtual drive !

The real problem is: How to re-write the faked audio tracks in RAW mode (2352)?
I mean write the image and sign the data track as audio?!

CloneCD, Alcohol 120% and others, write audio sectors in 2048 and again, the contents of sectors will be destroyed.
I used CUE Sheets and wrote my image by Alcohol 120% in DAO/TAO mode, but CUE Sheet does not support multi sessions, so the TOC of copy will be different.

Can the Control parameter of an Entry in CloneCD solve this? (00 for audio and 04 for data?)


#2

[QUOTE=Newbie_Cracker;2133976]Hello everybody.
As I tested Nero, CloneCD and Alcohol 120%, they red fake audio in 2048-byte mode and destroyed the contents of sectors. As the cd-check routine reads the contents of some sectors, it easily detects copy from original.

CloneCD, Alcohol 120% and others, write audio sectors in 2048 and again, the contents of sectors will be destroyed.
I used CUE Sheets and wrote my image by Alcohol 120% in DAO/TAO mode, but CUE Sheet does not support multi sessions, so the TOC of copy will be different.[/QUOTE]CloneCD and Alcohol 120% does not read audio in 2048 bytes mode, because there is no such thing. Audio sectors are all 2352 bytes per sector. This is same for writing. There is no such thing as writing audio sectors in 2048 mode.

[QUOTE=Newbie_Cracker;2133976]Can the Control parameter of an Entry in CloneCD solve this? (00 for audio and 04 for data?)[/QUOTE]Yeah that would work, but make sure the data read is correct to start with.


#3

Oh, sorry. You’re right. The audio sector length is 2352. Because I didn’t see any EDC/ECC at the end of sector in isobuster, and also the image of clonecd had 600M, but mine (got by my imager) had 700M, I thought it’s 2048.

How could you describe this? Why my raw image is bigger than Alcohol/CloneCD raw image?

and… if I change Control value from 00 to 04, does the TOC remain unchanged?
I mean this track becomes DATA Track or just written with its EDC/ECC bytes like data track and remains as audio in TOC?


[TRACK 13]
MODE=0

This section in CCD defines in TOC that Track 13 is audio or Control value of its entry?


#4

[QUOTE=Newbie_Cracker;2134043]Oh, sorry. You’re right. The audio sector length is 2352. Because I didn’t see any EDC/ECC at the end of sector in isobuster, and also the image of clonecd had 600M, but mine (got by my imager) had 700M, I thought it’s 2048.

How could you describe this? Why my raw image is bigger than Alcohol/CloneCD raw image?[/QUOTE]I don’t have your imager so I can only speculate…

Since you said the disc have several sessions CloneCD will not include the extra parts in the .img file:
sessions LO, sessions LI, sessions 1st gap

And besides they are not readable. Your imager probably ignored errors reading those areas, and since there are no data returned, it wrote either 00s or garbage from the data buffer into the file.

[QUOTE=Newbie_Cracker;2134043]and… if I change Control value from 00 to 04, does the TOC remain unchanged? [/QUOTE]Nope, the TOC will be changed. Btw, I’ve tried this before.

[QUOTE=Newbie_Cracker;2134043]
I mean this track becomes DATA Track or just written with its EDC/ECC bytes like data track and remains as audio in TOC?[/QUOTE]The TOC will say track is a data track, instead of audio one as original.

If the fake data sectors are scrambled, you’re forgetting about data sector scrambling, which is performed on data tracks before it is written. Also, the data sectors must be aligned, i.e. sync should start at 2352 byte boundaries.

[QUOTE=Newbie_Cracker;2134043]


[TRACK 13]
MODE=0

This section in CCD defines in TOC that Track 13 is audio or Control value of its entry?[/QUOTE]
That doesn’t look like the TOC entry and changing that will have no effect. It appears to be the cue section in the .CCD file. TOC entries are further up under [Entry x] sections.


#5

hmmm…

So changing 00 to 04 changes the track type. I don’t know how to fix this…

ah… I think I found it !

Right now (I was middle of typing this post) I remembered something about PostGap in Kris Kaspersky’s book, CD Cracking Uncovered. He said CloneCD skip PostGap and filled it by zero (CloneCD 3.x filled it by zero, but v5.x by garbage). So marking PostGap by some key (named it X-Sector) beats CloneCD. Then he said Alcohol 120% and CDRWin can easily copy X-Sectror.
But his Alcohol 120% version was 1.4.3 and mine is 1.9.7. So I should test old version of Alcohol 120% to make exact image of CD. But I’m not sure about its burning quality.
Unfortunately CDRWin does not support multisession disks. So I should search for others !

Oh, I forgot to say that Virtual-CD 9.1 succeeded in getting an exact image, just like mine. But It can not burn the image.

Did you read his book?

Although I find the solution, but I remains the info about that sector !

Here is some details:

The key sector (which is read by cd-check routine) is exactly placed after some weak sectors. My Asus 5224 writer reads them easily. So the key sectors will not messed up and skipped by intelligent sector scanner of CloneCD (maybe it’s messed up by its weak sector read engine !). All of them are placed in the middle of an audio track.

The 1st sector of audio track 4 in session3 is like this in IsoBuster:


LBA :26987

0000 : 34 34 34 34 34 34 34 34  34 34 34 34 34 34 34 34   4444444444444444
0010 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0020 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0030 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
...
...
...
0900 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0910 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0920 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

The next sectors contains 2352 zeros until…
Sectors 30364 and 30365 are weak sectors that IsoBuster can not read them and reports an error.

Then sector 30366 which is the keysector looks like this:


LBA :30366

0000 : 00 FF FF FF FF FF FF FF  FF FF FF 00 06 46 66 02   .............Ff.
0010 : 00 00 20 00 00 00 20 00  [b]54 44 49 01 50 01 05 05[/b]   .. ... .TDI.P...
0020 : [b]05 80 FF FF FF [/b]00 00 00  00 00 00 00 00 00 00 00   ................
0030 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0040 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
...
...
...
0900 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0910 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0920 : 00 00 00 00 00 00 00 00  00 00 00 00 EF 34 CE 9C   .............4..

The bold part is checked by routine.
You see the sync pattern? Its data sector. Isn’t it?
Please look at bytes 0x900-0x929. The EDC/ECC are washed somehow (Am I right?)
The next sectors are data sectors and filled the entire remaining part of audio track until sector 30513. And at sector 30514, next data track begins.

Here I remembred postgap

Here is the keysector 30366 read by Alcohol 120% or CloneCD.


LBA :30366

0000 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0010 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0020 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0030 : 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

But… Kris said PostGap length is 150 sectors…

30514 (start of next tract) - 30364 (1st weak sector) = 150 !!!

Yeeeeaaah… thst’s it. The routine checks content of 2 seconds PostGap !
That’s the reason that CloneCD filled it by zero, even in burning an 1:1 image !

So the developer of Alcohol 120% and CloneCD should think about it.

I attached my Imager. It’s not perfect, but may become handy.

Best regards.

CD_Copier.zip (15.7 KB)


#6

[QUOTE=Newbie_Cracker;2134117]Did you read his book?[/QUOTE]Nope, I havn’t.

[QUOTE=Newbie_Cracker;2134117]I attached my Imager. It’s not perfect, but may become handy.[/QUOTE]Thanks for sharing. :slight_smile:

Hmm, weak sectors + postgap makes the subject more complicated.


#7

Weak sector or bad sector are not important, just reading and writing postgap is critical in this case.