STARFORCED - Copy protection...or malware?

[cebu_tux]

---

Taken from April 2006 issue of Computer Gaming World Magazine:

GAME DEVELOPERS TEND TO GUARD
their products like jealous gods. You
can’t exactly blame them, since rampant
software piracy—made all the easier thanks to
file-sharing programs like BitTorrent—demands
desperate countermeasures. These days, most
copy protection methods rely on complex disc
checks, installation keys, or a combination of
the two. One particularly controversial piece of
antipiracy software, StarForce (www.star-force.
com), has many PC gamers up in arms thanks
to a growing number of suspect system problems
allegedly connected to the program.
What is StarForce? The software, owned by
Russian developer StarForce Technologies, utilizes
a blacklist of emulation software (such as
Alcohol 120% and Daemon Tools) in order to prevent
software thieves from running pirated games
off of virtual CD-ROM drives. Although unconfirmed,
many crackers believe that StarForce
ensures an original game CD’s presence by
calculating the physical angle between the first
and last sectors of the disc (hence, StarForce
would—and does—reject a scratched or otherwise
damaged game disc). It all runs via a device
driver that installs itself into the Windows registry
(without explicit notification) when you attempt to
load a StarForce-protected game. Taken together,
these factors make StarForce an especially
tough nut for pirates to crack.
As more and more publishers turn to
StarForce (notably Ubisoft, which now employs
this software to protect many of its major releases—
and declined to provide any on-record comments
for this story), these factors also make it
a frequent target of criticism. Many dissenters
blame the StarForce device driver for causing
system errors, ranging from sporadic CD-ROM
drive instability to irreparable hardware damage.
TECHNOBABBLE
In an effort to bring clarity to these accusations,
we turned to CGW’s own desktop administrator,
Nick Kalister, for a full technical report of
what StarForce can (and can’t) do to your PC.
“StarForce doesn’t directly trash your drives or
your IDE controller channels,” he explains. “It
can, however, cause Windows to step down to
programmed input/output [PIO] mode, which
could possibly damage some optical drives if
they are run in that mode for an extended period
of time.” Kalister also points out: “[Although]
StarForce is not a virus, it can act as a possible
Trojan gateway, as malicious third-party applications
could conceivably exploit its security
holes to gain [system administrator] access.”
Translation: StarForce doesn’t harm your PC,
but it certainly opens all the wrong doors.
Information gleaned from the Boycott StarForce
website (www.glop.org/starforce) corroborates
our independent analysis and reveals another
telling piece of information: “A sure sign of this
step down [to PIO mode] occurring is that the
burn speeds [of the optical drive] will get slower
and slower.” Sure enough, an extended test using
a 4X Memorex DVD-RW drive and a retail copy
of Ubisoft’s Splinter Cell Chaos Theory proved it,
as the drive’s burn speed eventually dropped to
a paltry 1X—only to return to its original speed
once we removed the StarForce program.
LEGAL EAGLES
StarForce Technologies, for its part, often takes
extreme offense to negative comments regarding
StarForce. In late January, the company
threatened legal action against popular weblog
Boing Boing (www.boingboing.net) in the wake
of a critical article describing StarForce’s problems.
StarForce Technologies’ PR manager,
Dennis Zhidkov, sent a similar threat to CNET
last November in response to a News.com editorial
that branded StarForce as a “nefarious
rootkit/virus.”
When questioned about these reactions,
Zhidkov told us, “The issue on StarForce is
obviously sponsored by our competitors or
organized crime groups that run CD/DVD piracy
[operations]. We are now in close cooperation
with law enforcement [officials] in the United
States and Russia investigating the matter
and trying to find [out] who stands behind
the boycott campaign.” Zhidkov goes on to
defend StarForce’s integrity, claiming, “Neither
StarForce’s support service or our clients’ support
services have documented problems with
CD burning capability, system stability, or physical
hardware problems in relation to StarForce.”
The company’s confidence in its product also
led to a short-lived contest in December 2005,
when Zhidkov invited anti-StarForce advocates
to the StarForce Technologies headquarters
in Moscow—at their own expense—and challenged
them to provide evidence of the software’s
alleged faults in exchange for a $10,000
prize. With no takers as of the contest’s January
31 deadline, Zhidkov claims, “We now have
proof that such issues with StarForce-protected
applications are pure fiction and all of these
rumors are false and probably initiated by frustrated
pirates.”
Our advice: Keep the accompanying sidebar
handy.

Sidebar contents:

DO-IT-YOURSELF
STARFORCE REMOVAL

Even if you uninstall a StarForce-dependent
game, the StarForce device driver
itself stays on your system. Here’s a handy
three-step guide to removing all traces of
the StarForce software (special thanks to
the astute folks at the glop.org forums for
documenting this procedure).

REMOVE THE DEVICE DRIVERS. Select
the System icon in your Windows Control
Panel. Click the Device Manager button
in the Hardware tab and then select
“Show hidden devices” from the View
menu. Now check the Non–Plug and Play
Drivers device tree, and you should find a
few StarForce entries. Uninstall these and
reboot your PC.

DELETE THE SYSTEM FILES. Browse to
your C:\Windows\system32\drivers folder
and look for a trio of files called sfdrv01.
sys, sfhlp02.sys, and sfsync02.sys (the
actual numbers on the files may be different
for you). Delete ’em.

CLEAN YOUR REGISTRY. While this isn’t
a very difficult step, it does involve tinkering
with your Windows registry—so be
careful here, as damaging your registry
could cause serious system problems.
Now that you’ve been properly warned,
type “regedit” into the Run dialog box from
your Start menu. Once the Registry Editor
opens, select the Find option from the
Edit menu. Now search your registry for all
instances of “sfdrv,” “sfhlp,” and “sfsync,”
deleting the offending registry keys as
they turn up. Once that’s done, close the
Registry Editor and reboot your PC—which
should now be StarForce free.

[cebu_tux]

[EarlZ]

This is from what i know,

Starforce can damage your drive ( assuming you bought the original disk ) bec it scans the disk for verification and valitidy more than 100x per min, also it forces to read area's of the disk that are overbunred and some drives really cant read overburned disks so well.. and some other instability and corruption issue regarding sata raid drives.. never really researched much about this malware protection system.

[Visual C#]

I'm feeling safe with Macrovision SafeDisc.. good thing I haven't bought any games w/ StarForce in them.

[firebasefury]

Tried the side bar notes on POP T2T it doesn't work

[cebu_tux]

From Boycott Starforce

NEWS: Ubisoft won't use Starforce anymore !

The rumor has been confirmed: Ubisoft decided that the anti-copy software used with any future Ubisoft games won't be Starforce, starting with Heroes of Might and Magic V.

Ubisoft was the largest producer of Starforce restricted games, and it's a huge step toward the end user. A big thanks to all the people who spread the word on Internet for some years ! But don't stop the fight yet, Starforce is alive and a lot of great games are still protected with Starforce. Nadeo, Egosoft, do you read us ?

[Visual C#]

Hehe, funny, walay ni reply kaayo ani na thread. Most of us anyway are buying warezed games, thereby sparing us from the evils of DRM. In the US and other countries, it's much different.

When I first heard of StarForce, the more hesistant I became with buying originals.

[king_coy]

i downloaded LA Rush from the net which happened to have starforce in it. then, i needed to unplug my ide just to play and find out that the game sucks anyway.

my friend borrowed it, he's using asrock dual sata2. he did not need to unplug his ide, we use starforce nightmare to disable the drive. then after a week, we had the game uninstalled, then problem begun to arise. the dvd drive is always reading something even if it has no disc in it. then, the system wud restart from time to time, then we get system error message about scsi or something like that.

we fixed the problem by downloading the starforce driver removal tool. i forgot the link, just ggogle for it na lang. anyways, i pray that u may never use it cuz it'll give u headaches.

now, sop na nako na mag-google and research the game i wanna download or buy, if it has starforce, i rather not try play it. also, to further ensure what game protection ur games have, google for game protection scanner, forgot ko na rin kasi what that software is.

[EarlZ]

ai namo ka balaka ana. wala nay starforce sa next ubisoft games.. and other companies.. even Heroes 5 wont have starforce anymore

bro ignon nasad ka usa ka member diri sa istorya nga pataka kag storya about anang ULI systems mas dali maka lusot sa SF protection kay dli siya mo believe.. hahaha

nyway the removal tool is on the offical starforce website

http://onlinesecurity-on.com/downloads/sfdrvrem.zip

They are even blaming the pirates ngano daw gi kasohan sila and they have proof na daw nga dli maka damage ilang software sa drive, pero its to late the case has been closed sa court and SF is no more unless tingali mo re-appeal sila.. so pirates rejoice that SF is gone for the mean time