On 2004-10-30 10:14, piddi wrote:
... you are afraid of piracy (Quote: Also Im afraid it's possible to unprotect devices somehow with the right tool). Well, of course it is possible. AFAIK, TC stuff and RTAS gets cracked all the time because there is a market for it. SCOPE or .devs WOULD be cracked if there was a real demand for it,...
there may be an academic possibility but that's truely beyond realism.
first the protection check is done in DSP code - you'll need to be able to read that language at least. There's no symbolic dissassembler for that stuff which deciphers the opcodes and puts them in a listing with 'OS-calls'
It's the same situation as with the original Mac's ROM.
Someone wrote such a tool but that 'someone' was considered to be one of the world's leading compiler builders - a true one-in-a-million of talent.
He comletely reverse engineered the symbolic content of the ROM according to Apple's published docs - but there is no such public doc of SFP internals

and M68k assembly is a really simple kind of thing.
Needless to mention that with the tool above you could crack any Mac application in less than an afternoon - but only due to the fact that you knew exactly what was going on and where to look.
For example if an app expires on a certain date you look up all the calls to the machine's 'SysDateFunction', so one of those routines will be involved in the protection check.
A quote from the developer above: it's like a dog p*ssing on a pole, somewhere the program must sniff the mark and decide -
you just have to change the conditioned branch to an unconditioned one then...
All is done in the same memory space and in the same machine language and in the same application.
No chance on SFP - it's DSP assembler and Intel code, done on the card and in main memory and in different apps.
Nothing is documented, you have only a steam of opcodes.
But before you are able to even peek at this, the stuff is encrypted by 2 different programs with the unique number of the board - hidden in an eeprom that will die forever once you mess with it and screw things up...
you cannot 'watch' (or record) the process how a plugin reacts when 'activated', which is one common technique hackers apply. You just repeat a process with trial and error over and over to detect is operation strategy.
Do you understand now why CWA makes such a hazzle from moving devices from one board to another
my two cents (from the dark side...), Tom