Starforce 3 - The gravestone?

[dyn!o]

*Please view the attachement before reading*

Staforce - the most hated protection on the scene (besides XProtector), no doubt.

Many rumours and legends say it's uncrackable. Most of us wanted to hear it's NOT A TRUE! Why? Probably because of our nature... Crackers nature. We can't agree and admit that someone better could exist on the second side of the scene - software protection market. Maybe someone undefeated? Furthermore, we don't want even to hear that some well known and respectable russian cracker (I will help you: his nick is composed of three chars) could work for software security related company. How can he did it? Yes, many of us asked this questions. Starfoce effect was always similar: no crack or very complicated cracks including turning off IDE cables and physically unplugging CD/DVD drives.

The day came on 15.10.2004 (let's assume info file date). Then, some young team, called Ultima, ravaged the legend by completely cracking Starforce 3.3. The scene has won, again. Personally, I think they choosed this moment perfectly. Who of us didn't asked ourselves: "what if I face the day with Starforce protection inside?". Maybe some of us were just too young to ask this question.

Did you saw this relase? If not then I suggest to download it. It's not another 'copy crack' relase. They did fu***ng PERFECT job. I have found myself the following:

- java binaries modification
- MSI installer script modification
- MSI archives modification (including independent InstallShield component fragments - I wonder HOW?)
- dlls modificatiion
- own autorun application (far better than original) with 3D FXs
- own graphics
- own music (about 7 minutes track with "ultima" whispers)
- and... this something... an "intro" while running the game with an impressive message. Watch yourself, it can't be described.

I thought by so many modifications they cracked the protection, but I was wrong. It looks like they did install/art work for fun (?) because Xpand Rally was cracked only by a kind of emulation inside Starforce virtual machine (at least it looks so for a lamer like me). This is probably the first time when Starforce protection was totally fooled and works with the game, thinking it's the original one. So why they did so hard job taking care even of packaging 3 languages into single game and showing appropiate codes on the same screens dedicated to typing them? The game installs in the exactly same way like original does (even easier because of pretyped codes, also inside Starforce). One click relases - is it the future? Hope so...

Let's hope it's not the last word from such tallented team.


Best regards,
dyn!o

[Pyrae]

Nice work by Ultima, of course, but there have been working (though completely unpacked) deprotected executables of the latest Starforce 3.3 before, i.e. those done by "Starfuckers".
The inline approach by Ultima your post implied might be the way to go in the future, when 'real' unpacking simply becomes too much puzzle work. Nice to know that someone already went into that direction.

[peleon]

Hey!!! Amazing post, dyn!o!

I still cannot believe it myself. I tried a bit with SF3 but i got a bit tired and no much time to study it.

Lets see if we heard sometime about some tricks that team did to successfully crack the whole protection

Regards.

[dyn!o]

Pyrae: sorry, I didn't know about "Starfuckers" job. But what paid my attention was the way of this relase - the original game files stay untouched. I have loaded original Xpand Rally binaries and it still works with the relase because they cracked Starforce engine, not game. Anyway, they unpacked game files too... for what? I don't know. Maybe for fun, maybe they want to show something...

I also completely agree with your sentence: "he way to go in the future, when 'real' unpacking simply becomes too much puzzle work". It's wise indeed. Unpacking every SF protected software means a lot of work (unless someone develop a generic unpacker) so, it's wiser to find an generic idea like Starforce engine cracking. Then, one crack can work for many StarForce protected games. I even wonder if this one could work? Anyone can try?

Peleon: I coldn't believe too. I was testing the game on all the possible combinations. Only to find an hole in this relase. But the only things I found were more silly messages about Techland and Starforce inside the game.

[jonwil]

When will these highly paid copy-protection-coders realize that for all their expertise, they still cant beat the crackers?

Is there ANY copy protection that relies on you having an origonal disk that has yet to be broken? (i.e. such that you cant use the software with a copyied disk + a crack or whatever)

[dyn!o]

Jonwil: Well, probably never. Guess why? Because it's about money, my friend. Money change. Change many of us.

And if it comes to the second part of your question: no. Uncracked protection so far doesn't exist.

[niom]

Originally Posted by dyn!o

I have loaded original Xpand Rally binaries and it still works with the relase because they cracked Starforce engine, not game

the only way to make this possible is to crack the starforce device drivers.

if they did this, can you please send windows\system32\drivers\prodrv06.sys and windows\system32\drivers\prohlp02.sys as an attachment to this thread?

thxalot

[dyn!o]

Peleon: unfortunately we won't. Starforce protection, like all other CD protections, doesn't allow to use it on your own. You have to use server-like wizard and protect your files online. It's a good idea indeed.

Niom: I see you know the structure of Starforce . That's very good, but prodrv06.sys and prohlp02.sys don't count in this game because they stay untouched (in original form). If you know Starforce basis then you should know that it contains other very important file. Tell me which one? .

Regards.