Starforce 3 - The gravestone?

[dyn!o]

*Please view the attachement before reading*

Staforce - the most hated protection on the scene (besides XProtector), no doubt.

Many rumours and legends say it's uncrackable. Most of us wanted to hear it's NOT A TRUE! Why? Probably because of our nature... Crackers nature. We can't agree and admit that someone better could exist on the second side of the scene - software protection market. Maybe someone undefeated? Furthermore, we don't want even to hear that some well known and respectable russian cracker (I will help you: his nick is composed of three chars) could work for software security related company. How can he did it? Yes, many of us asked this questions. Starfoce effect was always similar: no crack or very complicated cracks including turning off IDE cables and physically unplugging CD/DVD drives.

The day came on 15.10.2004 (let's assume info file date). Then, some young team, called Ultima, ravaged the legend by completely cracking Starforce 3.3. The scene has won, again. Personally, I think they choosed this moment perfectly. Who of us didn't asked ourselves: "what if I face the day with Starforce protection inside?". Maybe some of us were just too young to ask this question.

Did you saw this relase? If not then I suggest to download it. It's not another 'copy crack' relase. They did fu***ng PERFECT job. I have found myself the following:

- java binaries modification
- MSI installer script modification
- MSI archives modification (including independent InstallShield component fragments - I wonder HOW?)
- dlls modificatiion
- own autorun application (far better than original) with 3D FXs
- own graphics
- own music (about 7 minutes track with "ultima" whispers)
- and... this something... an "intro" while running the game with an impressive message. Watch yourself, it can't be described.

I thought by so many modifications they cracked the protection, but I was wrong. It looks like they did install/art work for fun (?) because Xpand Rally was cracked only by a kind of emulation inside Starforce virtual machine (at least it looks so for a lamer like me). This is probably the first time when Starforce protection was totally fooled and works with the game, thinking it's the original one. So why they did so hard job taking care even of packaging 3 languages into single game and showing appropiate codes on the same screens dedicated to typing them? The game installs in the exactly same way like original does (even easier because of pretyped codes, also inside Starforce). One click relases - is it the future? Hope so...

Let's hope it's not the last word from such tallented team.


Best regards,
dyn!o

[Pyrae]

Nice work by Ultima, of course, but there have been working (though completely unpacked) deprotected executables of the latest Starforce 3.3 before, i.e. those done by "Starfuckers".
The inline approach by Ultima your post implied might be the way to go in the future, when 'real' unpacking simply becomes too much puzzle work. Nice to know that someone already went into that direction.

[peleon]

Hey!!! Amazing post, dyn!o!

I still cannot believe it myself. I tried a bit with SF3 but i got a bit tired and no much time to study it.

Lets see if we heard sometime about some tricks that team did to successfully crack the whole protection

Regards.

[dyn!o]

Pyrae: sorry, I didn't know about "Starfuckers" job. But what paid my attention was the way of this relase - the original game files stay untouched. I have loaded original Xpand Rally binaries and it still works with the relase because they cracked Starforce engine, not game. Anyway, they unpacked game files too... for what? I don't know. Maybe for fun, maybe they want to show something...

I also completely agree with your sentence: "he way to go in the future, when 'real' unpacking simply becomes too much puzzle work". It's wise indeed. Unpacking every SF protected software means a lot of work (unless someone develop a generic unpacker) so, it's wiser to find an generic idea like Starforce engine cracking. Then, one crack can work for many StarForce protected games. I even wonder if this one could work? Anyone can try?

Peleon: I coldn't believe too. I was testing the game on all the possible combinations. Only to find an hole in this relase. But the only things I found were more silly messages about Techland and Starforce inside the game.

[jonwil]

When will these highly paid copy-protection-coders realize that for all their expertise, they still cant beat the crackers?

Is there ANY copy protection that relies on you having an origonal disk that has yet to be broken? (i.e. such that you cant use the software with a copyied disk + a crack or whatever)

[dyn!o]

Jonwil: Well, probably never. Guess why? Because it's about money, my friend. Money change. Change many of us.

And if it comes to the second part of your question: no. Uncracked protection so far doesn't exist.

[jonwil]

The real question is whether a game with copy protection makes more total $ than the same game would without protection. (and therefore validating the argument about copy protection actually resulting in more sales)
Bearing in mind that all this fancy protection and anti-debugging stuff probobly costs the publishers a lot of money.

well even if a copy protection is expensive it will pay out...
most games which are protected by SF3 will be cracked in 2-6 months
and some of them will never be cracked.
the first 6-8 weeks after a game launch are important because in this
time the big money is done...

[Kameo]

Hat off to Ultima, respect, nothing more to say.

[dyn!o]

"most games which are protected by SF3 will be cracked in 2-6 months"
With all respect my friend: discussed relase date is 3 weeks after the game appeared in shops. Why are you saying "will be"?

"and some of them will never be cracked. "
I have never heard about uncracked software (including game), did you? Sometimes we can find a rare software which stay uncracked - not because of protection strength but specific type (engineering, architect, astro, etc.). Even if for some games cracks don't exist, you can mount MDF images and play this game without crack (like Toca2).

"the first 6-8 weeks after a game launch are important because in this time the big money is done..."
I thought the same... but in the past
Why that's wrong? Because the money from first 6-8 weeks are usually about 30% of whole incomings. Do you know what's the title in the first best 15 selling games in my country? Ravenshield 3 - 2 years old game. Look at Amazon or your local stores. How many one year old games did you found? I bet many. Do you think the store keeps them just to make the hall looks better? Nope, they keep them because they sells.

Let's take another example: Xpand Rally. Techland didn't relase it yet in the USA, Spain, Holland, Italy, Sweden, Denmark, Greece, etc., etc.... Then how first 6-8 weeks can be critical for them? Just imagine losses in the USA only - the biggest game market on the world.

So, when really big money come?
They are rendered during whole a so called "game-life time" (my personall opinion).

Think about it.

>With all respect my friend: discussed relase date is 3 weeks after the >game appeared in shops. Why are you saying "will be"?

Ok ok...calm down There are some games which were cracked
"very" fast, but there are games protected with SF3 which aren't
cracked for months, like e.g. D-Day and some other low budget
games ( ok for those no one really wants them


>Even if for some games cracks don't exist, you can mount MMD >images and play this game without crack (like Toca2).

Well i think that's not the point, for most safedisc/securom protected
games you will find a clone but you will find a seperate crack too. Ok
the need for a crack isn't that big if you can clone a game...


>Let's take another example: Xpand Rally. Techland didn't relase it yet >in the USA, Spain, Holland, Italy, Sweden, Denmark, Greece, etc., >etc.... Then how first 6-8 weeks can be critical for them? Just >imagine losses in the USA only - the biggest game market on the >world.

>So, when really big money come?
>They are rendered during whole a so called "game-life time" (my >personall opinion).

good point...make sense...well one other thing why they protecting
their games is to prevent videostore-lamers to make simple copies of
their products...

[dyn!o]

Look here:

hxxp://www.xpandrally.com/en/forumShTh.php?ThID=1999&SeID=1&ref=

Really hot discussion about Starforce legality.

Serious arguments, hot atmosphere... check it out.

hehe nice thread...very funny...
but the thread is more about using drivers without the permission
of the enduser not why the company really use this kind of protection
instead of safedisc & co...

i would be more interested in how ultima has done the crack

Why can't I find the Ultima release? At nforce.nl there isn't any nfo like your Ultima nfo. At GCW there isn't any crack for Xpand Rally.

Where did you get your informations? Have you got any link?


Best Regards, DeeYeah

[dyn!o]

DeeYeah: Who said every relase must be placed on nforce.nl? Scene has its own, unique rules, which allow anyone to do what he/she want.

Where I found the information?
On the moon.

Do I have any link?
Sure but it is Emule and I don't think ExeTools is a good place to share Emule links. It is rather a kind of university. If you want then type "Xpand Rally Ultima" in Emule. That's all.

Regards.