Software cracking is the modification of software to remove protection methods: copy prevention, trial/demo version, serial number, hardware key, CD check or software annoyances like nag screens and adware.

The distribution and use of cracked copies is illegal in almost every developed country. There have been many lawsuits over cracking software, but most have been to do with the distribution of the duplicated product rather than the process of defeating the protection, due to the difficulty of constructing legally sound proof of individual guilt in the latter instance. In the United States, the passing of the Digital Millennium Copyright Act (DMCA) legislation made software cracking, as well as the distribution of information which enables software cracking, illegal. However, the law has hardly been tested in the U.S. judiciary in cases of reverse engineering for personal use only. The European Union passed the European Union Copyright Directive in May 2001, making software copyright infringement illegal in member states once national legislation has been enacted pursuant to the directive.

History

The first software copy protection was on early Apple II, Atari 800 and Commodore 64 software. Game publishers, in particular, carried on an arms race with software crackers. Over time, publishers have resorted to increasingly complex countermeasures to try to stop unauthorized copying of their software.

Unlike modern computers that use standardized drivers to manage device communications, the Apple II DOS directly controlled the step motor that moves the floppy drive head, and also directly interpreted the raw data (known as nibbles) read from each track to find the data sectors. This allowed complex disk-based software copy protection, by storing data on half tracks (0 1 2.5 3.5 5 6...), quarter tracks (0 1 2.25 3.75 5 6...), and any combination thereof. In addition tracks did not need to be perfect rings, but could be sectioned so that sectors could be staggered across overlapping offset tracks, the most extreme version being known as spiral tracking. It was also discovered that many floppy drives do not have a fixed upper limit to head movement, and it was sometimes possible to write an additional 36th track above the normal 35 tracks. The standard Apple II DOS copy programs could not read such protected floppy disks, since the standard DOS assumed all disks had a uniform 35 track, 13 or 16 sector layout. Special nibble-copy programs such as Locksmith and Copy II Plus could sometimes duplicate these disks by using a reference library of known protection methods, but when protected programs were cracked they would be completely stripped of the copy protection system, and transferred onto a standard DOS disk that any normal Apple II DOS copy program could read.

One of the primary routes to hacking these early copy protections was to run a program that simulates the normal CPU operation. The CPU simulator provides a number of extra features to the hacker, such as the ability to single-step through each processor instruction and to examine the CPU registers and modified memory spaces as the simulation runs. The Apple II provided a built-in opcode disassembler, allowing raw memory to be decoded into CPU opcodes, and this would be utilized to examine what the copy-protection was about to do next. Generally there was little to no defense available to the copy protection system, since all its secrets are made visible through the simulation. But because the simulation itself must run on the original CPU, in addition to the software being hacked, the simulation would often run extremely slowly even at maximum speed.

The most common protection method on the Atari computers were "bad sectors". These were sectors on the disk that were intentionally unreadable by the disk drive. The software would look for these sectors when the program was loading and would stop loading if an error code was not returned when accessing these sectors. Special copy programs were available that would copy the disk and remember any bad sectors. The user could then use an application to spin the drive by constantly reading a single sector and display the drive RPM. With the disk drive top removed a small screwdriver could be used to slow the drive RPM below a certain point. Once the drive was slowed down the application could then go and write "bad sectors" where needed. When done the drive RPM was sped up back to normal and an uncracked copy was made. Of course cracking the software to expect good sectors made for readily copied disks without the need to meddle with the disk drive. As time went on more sophisticated methods were developed, but almost all involved some form of malformed disk data, such as a sector that might return different data on separate accesses due to bad data alignment. Products such as the "Happy Chip" become available that were hardware add-on similar to today's game console modchips. However, the Happy Chip would allow the user to make exact copies of the original program with copy protections in place on the new disk. "Happy Chip" owners quickly became popular in game trading circles.

On the Commodore 64, several methods were used to copy protect software. For software distributed on ROM cartridges, subroutines were created that attempted to write to the ROM. If nothing happened, the presence of a ROM cartridge was verified, but if the software had been moved to RAM, the write routine would disable the software. Because of the operation of Commodore floppy drives, some write protection schemes would cause the floppy drive head to bang against its stop and could cause the drive head to become misaligned. In some cases, cracked versions of software were desirable to avoid this result.

Most of the early software crackers were computer hobbyists who often formed groups that competed against each other in the cracking and spreading of software. Breaking a new copy protection scheme as quickly as possible was often regarded as an opportunity to demonstrate one's technical superiority rather than a possibility of money-making. The cracker groups of the 1980s started to advertise themselves and their skills by attaching animated screens known as crack intros in the software programs they cracked and released. Once the technical competition had expanded from the challenges of cracking to the challenges of creating visually stunning intros, the foundations for a new subculture known as demoscene were established. Demoscene started to separate itself from the illegal "warez scene" during the 1990s and is now regarded as a completely different subculture. Many software crackers have later grown into extremely capable software reverse engineers; the deep knowledge of assembly required in order to crack protections enables them to reverse engineer drivers in order to port them from binary-only drivers for Windows to drivers with source code for Linux and other free operating systems.

With the rise of the Internet, software crackers developed secretive online organizations.

Methods

The most common software crack is the modification of an application's binary to cause or prevent a specific key branch in the program's execution. This is accomplished by reverse engineering the compiled program code using a debugger such as SoftICE, OllyDbg, GDB, or MacsBug until the software cracker reaches the subroutine that contains the primary method of protecting the software (or by disassembling an executable file with a program such as IDA). The binary is then modified using the debugger or a hex editor in a manner that replaces a prior branching opcode with its complement or a NOP opcode so the key branch will either always execute a specific subroutine or skip over it. Almost all common software cracks are a variation of this type. Proprietary software developers are constantly developing techniques such as code obfuscation, encryption, and self-modifying code to make this modification increasingly difficult.

A specific example of this technique is a crack that removes the expiration period from a time-limited trial of an application. These cracks are usually programs that patch the program executable and sometimes the .dll or .so linked to the application. Similar cracks are available for software that requires a hardware dongle. A company can also break the copy preventions of programs that they have legally purchased but that are licensed to particular hardware, so that there is no risk of downtime due to hardware failure (and, of course, no need to restrict oneself to running the software on bought hardware only).

Another method is the use of special software such as CloneCD to scan for the use of a commercial copy protection application. After discovering the software used to protect the application, another tool may be used to remove the copy protection from the CD or DVD. This may enable another program such as Alcohol 120%, CloneDVD, Game Jackal, or Daemon Tools to copy the protected software to a user's hard disk. Popular commercial copy protection applications which may be scanned for include SafeDisc and StarForce.

In other cases, it might be possible to decompile a program in order to get access to the original source code or code on a level higher than machine code. This is often possible with scripting languages and languages utilizing JIT compilation. An example is cracking (or debugging) on the .NET platform where one might consider manipulating CIL to achieve one's needs. Java's bytecode also works in a similar fashion in which there is an intermediate language before the program is compiled to run on the platform dependent machine code.

There are a number of sites on the Internet that let users download cracks for popular games and applications (although at the danger of acquiring malicious software that is sometimes distributed via such sites). Although these cracks are used by legal buyers of software they can also be used by people who have downloaded or otherwise obtained pirated software (often through P2P networks).

Effects

The most visible and controversial effect of software cracking is the releasing of fully operable proprietary software without any copy protection. Software companies represented by the Business Software Alliance estimate and claim losses due to piracy.

Cracking has also been a significant factor in the domination of companies such as Adobe Systems and Microsoft, all of whom have benefited from piracy since the 1980s. Vast numbers of college and high school students adopted readily available applications from these companies. Many of these students would then go on to use them in their professional lives, purchasing legitimate licenses for business use and introducing the software to others until the programs became ubiquitous.

Hazards

Due to the potential legal repercussions, many individuals who release cracks to the public for commercially available software choose to remain anonymous. This can often create confusion as the available documentation is often sparse. It is beyond the ability of most to determine the exact operations the crack will execute.

As an example, several spyware removal utilities have rules in place that regard certain cracks as having a malicious payload such as a hidden DDOS daemon. However, anti-virus utilities have also been known to frequently report crack application programs as false positives, since the programs alter the program code of other executables similarly to how viruses often spread.

Some forms of software protection can include subtle countermeasures against cracking that do not prevent the cracked program from running, but can eventually lead to long-term damage of data created and used with the cracked program.

An example of this could be an expensive engineering software that requires a dongle to operate. The program may be specifically designed to incorporate certain minor math errors and design flaws into all documents, but the dongle stores the particular dimensional metrics needed to cancel out these cumulative intentional data errors. Once cracked, the corrective metrics from the dongle are no longer available, and over time as documents are edited with the cracked software, object dimensions move and distort until the document is so corrupted that it is unusable. The company may provide a method to undo the damage, provided the customer pays a fee for the correction and obtains a properly licensed uncracked program.

Industry Response

Apple Computer has begun incorporating a Trusted Platform Module into their Apple Macintosh line of computers, and making use of it in such applications as Rosetta. Parts of the operating system not fully x86-native run through the Rosetta PowerPC binary translator, which in turn requires the Trusted Platform Module for proper operation. (This description applies to the developer preview version, but the mechanism differs in the release version.) Recently, the OSx86 project has been releasing patches to circumvent this mechanism. There are also industrial solutions available like Matrix Software License Protection System.

Microsoft is planning to reduce common Windows based software cracking with the release of the NGSCB initiative in future versions of their operating system.

References