About Old SecuRom

[axisleon]

Cool, the game was very old ASUS motherboard free bonus.

Maybe they mastering it as DRM-free for avoid system unstable.

Thanks for the test report.

[xTMODx]

Have also here a game with that protection from the Gold Games 4 collection called Conflict: FreeSpace - The Great War also known as Descent: FreeSpace - The Great War is listed here http://www.cdmediaworld.com/hardware/cd … urom.shtml under SecuROM R2 i have also the two files on the disc cms32_95.dll and cms32_nt.dll but i miss the DADC logo on the disc so maybe they removed the protection for the Gold Games 4 collection.

[Jackal]

@sarami,

here is the data track .sub for Turok 2 - Seeds of Evil (Europe) (En,Fr,Es,It) - https://redump.info/disc/5331/ - http://www90.zippyshare.com/v/RHIsgwRc/file.html
I dumped it from 2 discs using CDTool (001b and 100b modes) with 2 drives, Sony Optiarc & Plextor Premium. Then I cleaned random errors with CDGTool and by comparing the dumps.
The end result is a .sub with 24 sectors containing modified Q-channel bytes. I'm pretty sure that this dump is fully correct now.

The thing that bothers me is that subdump -i ?: -f test.sub -mode 6 -rereadnum 25 -speed 4 -flushspeed 4 -fix 2 and even without -fix 2 gives a totally different output on these sectors with no modified bytes, but instead repeated sectors! Here is the plextor subdump dump with above parameters and -fix 2 (also verified from 2 discs): http://www24.zippyshare.com/v/obES60fB/file.html

Another thing that I noticed is that SecuROM games dumped with DIC using the D8 output often result in a bad dump of the data track (with multiple errors, instead of just the 1 error at the end where mode1=mode2 and vice versa), with shifted sectors. So it seems that D8 reading mode has problems with these discs, and it also results in bad subchannels.

I also tried subdump after swapping with an audio disc, but the issues remain. The only conclusion I can reach so far is that subdump and the recommended parameters used by rawdump are not safe for archiving these discs and the resulting output is incorrect. Also, Rawdump claims that "SecuROM Has 10 errors in Q-channel + 1 Q-channel error in the last sector of pregap", but the old version (also on FIFA 99) apparently has 24 errors.

Questions:
- Do the t2final.sub errors occur in the same range as documented in DIC? So should the latest DIC and /se parameter dump these errors correctly always?

/se     Not fix SubQ (RMSF, AMSF, CRC) (RMSFs 01:06:50 - 04:02:74)
                                            or (RMSFs 08:55:50 - 09:38:74)
                        For intentional subchannel error of a SecuRom

- Can you check the 24 sectors in the t2final.sub to confirm that they are all intentional errors (with XOR 0x0080 or 0x8001)?
- Did you also check the Track01 pregap of your discs for intentional errors?

Since this protection is so similar to LibCrypt, I think it might be a good idea to preserve these modified bytes on the dump page. But first we need to do more tests and come up with a foolproof method for dumping these sectors.
If it turns out that there is no reliable dumping method, or if sectors from the pregap are also needed, then I guess Daemon Tools' SecuROM emulation remains the only solution for us.

Tomorrow I will post the results of another disc ( https://redump.info/disc/41170/ )

[Jackal]

NFS3 sub (again, 24 intentional error sectors): http://www75.zippyshare.com/v/LYV46pWC/file.html
subdump (-mode 6 -rereadnum 25 -speed 4 -flushspeed 4 -fix 2): http://www87.zippyshare.com/v/hI5Ag4zn/file.html

I also checked both games for intentional errors in the Track01 pregap, but did not find any.. I hope sarami can check the pregap of newer SecuROM discs, but it seems unlikely that intentional errors are placed there, because many drives can't even read the pregap?

[sarami]

Another thing that I noticed is that SecuROM games dumped with DIC using the D8 output often result in a bad dump of the data track (with multiple errors, instead of just the 1 error at the end where mode1=mode2 and vice versa), with shifted sectors.

All disc? or specified disc?

- Do the t2final.sub errors occur in the same range as documented in DIC? So should the latest DIC and /se parameter dump these errors correctly always?

This range is temporary. Fixed. (LBA  5000 - 18199) or (LBA 40100 - 43799) The more disc test, the more precise.
http://www.mediafire.com/file/eq80y20l9 … or_test.7z

- Can you check the 24 sectors in the t2final.sub to confirm that they are all intentional errors (with XOR 0x0080 or 0x8001)?

I confirmed apparent 16 error, couldn't find the rest.

- Did you also check the Track01 pregap of your discs for intentional errors?

I checked this. https://redump.info/disc/8632/ But I couldn't find apparent error.

I think it might be a good idea to preserve these modified bytes on the dump page. But first we need to do more tests and come up with a foolproof method for dumping these sectors.

I think so too.

[Jackal]

Another thing that I noticed is that SecuROM games dumped with DIC using the D8 output often result in a bad dump of the data track (with multiple errors, instead of just the 1 error at the end where mode1=mode2 and vice versa), with shifted sectors.

All disc? or specified disc?

People reported these issues before. Maybe only old SecuROM discs are affected and maybe it explains why subdump is giving me bad dumps on these discs. Did you try to dump FIFA 99 with DIC and subdump to see if you get repeated/shifted sectors?

- Do the t2final.sub errors occur in the same range as documented in DIC? So should the latest DIC and /se parameter dump these errors correctly always?

This range is temporary. Fixed. (LBA  5000 - 18199) or (LBA 40100 - 43799) The more disc test, the more precise.
http://www.mediafire.com/file/eq80y20l9 … or_test.7z

- Can you check the 24 sectors in the t2final.sub to confirm that they are all intentional errors (with XOR 0x0080 or 0x8001)?

I confirmed apparent 16 error, couldn't find the rest.

Did you also include the NFS3 results in the new error range?
There are really 24 errors in the Turok 2 and NFS3 subs.
Turok 2:
41 01 01 18 55 10 00 00 57 10  58 D0
41 01 01 18 58 36 00 01 00 36  37 1E
41 01 01 08 79 65 00 09 05 65  B7 EF
41 01 01 09 09 66 00 09 13 66  3D 76
41 01 01 08 02 43 00 89 04 43  B8 2F
41 01 01 09 24 66 00 09 02 66  76 7F
41 01 01 19 10 20 00 01 12 20  36 14
41 01 01 09 11 59 00 09 13 41  17 22
41 01 01 09 1B 50 00 09 05 50  92 99
41 01 01 09 54 27 00 09 14 27  79 EA
41 01 01 09 36 50 00 09 1C 50  50 39
41 01 01 09 59 31 00 09 23 31  10 83
41 01 01 49 21 49 00 0B 23 49  0B E5
41 01 01 09 23 70 00 09 25 54  FE 81
41 01 01 09 24 25 00 09 26 67  53 C6
41 01 01 09 26 51 00 09 28 D0  B8 35
41 01 01 09 29 33 00 09 31 71  3C 49
41 01 01 09 38 33 00 09 22 33  5D CB
41 01 01 09 32 48 00 09 34 6C  28 7F
41 01 01 09 33 47 00 09 35 05  C6 98
41 01 01 09 35 69 00 09 37 E8  C6 84
41 01 01 09 38 4B 00 09 40 09  B8 31
41 01 01 09 31 51 00 09 51 51  59 98
41 01 01 09 43 26 00 09 C4 26  04 78

- Did you also check the Track01 pregap of your discs for intentional errors?

I checked this. https://redump.info/disc/8632/ But I couldn't find apparent error.

gorelord4e says that sector -1 should have an error, for SecuROM v3 discs at least, but we need to check other versions too. These 2 old version discs don't seem to have any errors in pregap.

[Jackal]

Turns out I did have a SecuROM NEW (5.00.03.0005) game lying around: Sonic Adventure DX: Director's Cut (Disc 1): http://www97.zippyshare.com/v/Yf3QRgpx/file.html

10 errors + 1 in pregap (sector -1), as previously confirmed by gorelord4e..

[sarami]

FIFA99

Code: Select all

LBA[040169, 0x09ce9],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:44], AMSF[08:57:44], RtoW[0, 0, 0, 0]
LBA[040170, 0x09cea],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:45], AMSF[08:57:45], RtoW[0, 0, 0, 0]
LBA[040171, 0x09ceb],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:47], AMSF[08:57:47], RtoW[0, 0, 0, 0]
LBA[040172, 0x09cec],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:48], AMSF[08:57:48], RtoW[0, 0, 0, 0]
LBA[040173, 0x09ced],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:49], AMSF[08:57:49], RtoW[0, 0, 0, 0]
LBA[040174, 0x09cee],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:50], AMSF[08:57:50], RtoW[0, 0, 0, 0]
LBA[040175, 0x09cef],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:51], AMSF[08:57:51], RtoW[0, 0, 0, 0]
LBA[040176, 0x09cf0],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:52], AMSF[08:57:52], RtoW[0, 0, 0, 0]
LBA[040177, 0x09cf1],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:53], AMSF[08:57:53], RtoW[0, 0, 0, 0]
LBA[040178, 0x09cf2],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:54], AMSF[08:57:54], RtoW[0, 0, 0, 0]
LBA[040179, 0x09cf3],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[00:55:54], AMSF[18:57:54], RtoW[0, 0, 0, 0]
LBA[040180, 0x09cf4],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:55], AMSF[08:57:55], RtoW[0, 0, 0, 0]
LBA[040181, 0x09cf5],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:56], AMSF[08:57:56], RtoW[0, 0, 0, 0]

LBA[040170] is normal subchannel
LBA[040171] to LBA[040178] (8 sector): RMSF/AMSF is shifted
LBA[040179] is intentional error subchannel
LBA[040180] is normal subchannel
I confirmed this type is repeated 24 times.
coded this. http://www.mediafire.com/file/eq80y20l9 … or_test.7z

Turns out I did have a SecuROM NEW (5.00.03.0005) game lying around: Sonic Adventure DX: Director's Cut (Disc 1): http://www97.zippyshare.com/v/Yf3QRgpx/file.html

10 errors + 1 in pregap (sector -1), as previously confirmed by gorelord4e..

I confirmed this too in Unreal Tournament 2004 (Disc 6) (Play Disc)

[Jackal]

FIFA99

Code: Select all

LBA[040169, 0x09ce9],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:44], AMSF[08:57:44], RtoW[0, 0, 0, 0]
LBA[040170, 0x09cea],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:45], AMSF[08:57:45], RtoW[0, 0, 0, 0]
LBA[040171, 0x09ceb],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:47], AMSF[08:57:47], RtoW[0, 0, 0, 0]
LBA[040172, 0x09cec],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:48], AMSF[08:57:48], RtoW[0, 0, 0, 0]
LBA[040173, 0x09ced],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:49], AMSF[08:57:49], RtoW[0, 0, 0, 0]
LBA[040174, 0x09cee],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:50], AMSF[08:57:50], RtoW[0, 0, 0, 0]
LBA[040175, 0x09cef],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:51], AMSF[08:57:51], RtoW[0, 0, 0, 0]
LBA[040176, 0x09cf0],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:52], AMSF[08:57:52], RtoW[0, 0, 0, 0]
LBA[040177, 0x09cf1],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:53], AMSF[08:57:53], RtoW[0, 0, 0, 0]
LBA[040178, 0x09cf2],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:54], AMSF[08:57:54], RtoW[0, 0, 0, 0]
LBA[040179, 0x09cf3],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[00:55:54], AMSF[18:57:54], RtoW[0, 0, 0, 0]
LBA[040180, 0x09cf4],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:55], AMSF[08:57:55], RtoW[0, 0, 0, 0]
LBA[040181, 0x09cf5],  Data,      Copy NG,                  Track[01], Idx[01], RMSF[08:55:56], AMSF[08:57:56], RtoW[0, 0, 0, 0]

LBA[040170] is normal subchannel
LBA[040171] to LBA[040178] (8 sector): RMSF/AMSF is shifted
LBA[040179] is intentional error subchannel
LBA[040180] is normal subchannel
I confirmed this type is repeated 24 times.
coded this. http://www.mediafire.com/file/eq80y20l9 … or_test.7z

I guess that's what is causing the errors in the main dump image? But the protection only scans for the intentional errors I suppose?

Could you maybe add a function to DiscImageCreator to extract the SecuROM data from the disc, or maybe parse it from the .sub?
I don't know if you already added this function for LibCrypt. We will use the same format for SecuROM:

MSF: 03:09:56 Q-Data: 410101 07:07:56 00 23:09:56 dfde

edit: psxt001z --libcrypt *.sub

seems to work fine for this purspose but it only works if the .sub starts at 02:00.

psxt001z by Dremora, v0.20 beta 13 derus fix

MSF: 01:08:50 Q-Data: 410101 21:06:50 00 05:08:50 0a8f  xor 8001 3237 P1 xor 20 04
MSF: 01:38:50 Q-Data: 410101 11:36:50 00 09:38:50 2096  xor 8001 1edb P1 xor 10 08
MSF: 01:51:22 Q-Data: 410101 01:41:22 00 01:41:22 166b  xor 8001 8e30 P2 xor 08 10
MSF: 01:56:64 Q-Data: 410101 01:54:74 00 01:56:6c 2fd4  xor 8001 0553 P3 xor 10 08
MSF: 02:02:33 Q-Data: 410101 02:10:33 00 02:0a:33 42bc  xor 8001 132c P2 xor 10 08
MSF: 02:50:26 Q-Data: 410101 02:58:26 00 02:58:26 28aa  xor 8001 132c P2 xor 10 08
MSF: 02:55:35 Q-Data: 410101 06:53:35 00 22:55:35 c6a3  xor 8001 c701 P1 xor 04 20
MSF: 03:03:31 Q-Data: 410101 03:41:31 00 03:01:31 dfbd  xor 8001 8c73 P2 xor 40 02
MSF: 03:10:62 Q-Data: 410101 0b:08:62 00 13:10:62 5009  xor 8001 50cf P1 xor 08 10
MSF: 03:24:70 Q-Data: 410101 03:22:71 00 03:24:f0 58f8  xor 8001 bbd8 P3 xor 01 80
Number of modified sectors: 10

And for the SecuROM OLD it outputs 24 * 9 = 216 modified sectors. Added them here as an example: https://redump.info/disc/5331/

And here I only added the 24 intentional errors:  https://redump.info/disc/41170/

Here is SecuROM NEW: https://redump.info/disc/31548/

[sarami]

Could you maybe add a function to DiscImageCreator to extract the SecuROM data from the disc, or maybe parse it from the .sub?

MSF: 03:09:56 Q-Data: 410101 07:07:56 00 23:09:56 dfde

Should I output the text data like this to file?