Great read. I love this stuff. I wish to see the source code when it’s ready.
mperham
Amazing, the dongle simply returned a fixed number, 0x7606.
kwanbix
My father, an accountant, used to have a program like that, that used RPG and a dongle! Good times. Horrible donle.
dehrmann
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number?
Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.
cyanydeez
Yeah, my IT company bitshifts suspect files and provides the magic number.
The protection just needs suficirntly complex.
opinologo
Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000.
In most cases it was not much more difficult than what OP described.
15155
Audience matters. Something intended to stop legitimate business consumers in a non tech industry requires substantially less sophistication than something built to withstand professional reverse engineers.
bri3d
In fairness, the decompiler didn't work on the protection method :)
I think that both halves of the author's thesis are true: I bet that you could use this device in a more complicated way, but I also bet that the authors of the program deemed this sufficient. I've reversed a lot of software (both professionally and not) from that era and I'd say at least 90% of it really is "that easy," so there's nothing you're missing!
rustyhancock
The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access.
More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case.
I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty.
What if the hardware has a LFSR in it and returns changing responses, and the caller can check them with a verify function else where that maintains a state and knows to expect the next in the sequence?
We have far better tools today for sure, but we understood the system better back then. The right tool is sometimes better than a sharper tool as they say.
Edit : I should add I'm aware it's very likely the actual reversing involved more steps and checks than Dimitrys blog which is narrowed to what worked.
ruleryak
Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you were trying to skip, find that string, hop over into assembly to see what triggered loading that, and then just alter the logic to jump over it when the time comes.
antonvs
> Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races.
I did that with dBASE III, which used ProLok "laser protection" from Vault Corporation - a signature burned onto the diskette with a laser. Back then, I found it amazing that Ashton-Tate actually spent money to contract with a copy protection company for something that could be so easily defeated by a teenager reading assembler.
They could have easily just written the same kind of code themselves. An example of the power of marketing over substance.
I was able to replicate that protection mechanism just by scratching a diskette with a pin. The "laser" was a meaninglessly advanced-sounding solution that added no value compared to any other means of damaging a diskette.
hinkley
There's a lot of things going on that lead to this.
One, the developers spend more time running this code than we do, and they have to get the program working before we can even use it. So any parts of the program that are hostile to the developers risks killing the entire project. Obfuscating the copy protection can hit a point where it makes bug fixing difficult.
Two, lack of training. If you, me, and Steve each have a bag of tricks we all use to crack games, whichever one of us figures it out gets bragging rights but the game remains cracked. Meanwhile Developer Dan has to be aware of all the tricks in all of our bags together if he wants to keep the three of us out. Only there's not three of us, there's 300. Or today, probably more like 30,000.
Three, lack of motivation, which is itself several different situations. There's a certain amount of passive aggression you can put into a feature you don't even really want to work on. You can lean into any of the other explanations to defend why your code didn't protect from cracking all that much, but it's a checkbox that's trying to prove a negative, and nobody is going to give you any credit for getting it to work right in the same way they give you credit for fixing that corner glitch that the QA people keep bitching about. Or getting that particle animation to work that makes the AOE spells look badass.
m463
I remember I had some demo software that could be enabled with a code. I was just curious and at the code prompt, I entered the debugger. I dumped the process space and there was a nul-terminated string of letters and numbers. I restarted the process and entered them at the prompt and voila, it was enabled.
(I did go on to pay for the software)
alfiedotwtf
Cracking is so fun because we have Slides!
markh1967
Many years ago I was a technician supporting a few custom programs on thousands of PCs. The developer of one of these programs had added a date check to his code so the program would refuse to run after a set date and each new release would increase this date by a few months so it would stop working after a few weeks if he ever stopped creating new releases. His contract ended and a few weeks later his software, now relied upon by hundreds of sites, stopped working. The contract for the software development was thoroughly checked and legal action against the developer was started but I asked to see if I could resolve the problem in the meantime.
It only took ten minutes with a dissassembler to find the JGT (Jump if greater than) and convert it to a JLT so the software would stop running if the date was before a certain date rather than after. I created a patching tool that simply flipped one bit that was sent out to all the sites and everything was good again. I don't think I'll ever beat the elegance of a single bit flip hack.
ale42
I remember an icon editor (or something similar) for Windows 3.1, it was a shareware where you could enter a code to remove the nag screen. No crack was necessary, I basically managed to enter valid registration codes by just typing random numbers. In the end I had enough valid numbers that I could figure out the logic, it was something about the sums of digit groups.
anilakar
A certain automation system vendor uses proper USB license dongles in their PC software but they do not do challenge-response authentication. Instead they send a hardcoded string to the dongle and compare the response against a list that contains various software feature levels.
The whole automation system including machinery costs anywhere from 200k to 1M yet Vendor™ tries to milk the customers dry with a 1.5k software license that lets you manage up to 254 physically connected systems. I'm pretty sure the license dongle is in reality designed to prevent casual tinkering of parameters, which is something only service techs should do.
You can circumvent this with serial-over-Ethernet converters, which has resulted in an Industrial Internet of Shit-level security nightmare as companies happily expose their systems over the internet, thinking that license dongles are a substitute for authentication.
jeffwass
I was wondering this actually, why not just skip past the check entirely instead of going through the effort to pass the check without the dongle?
miki123211
Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line.
This works because some programs use a hashing algorithm to calculate the key based on the name, do a strcmp, and pop a messagebox if the keys don't match, without zeroizing the valid key buffer first. If the key buffers are on the stack (or if the two mallocs just happen to use the same region in memory), it is often easy to find a valid key if you know where the invalid one is.
I guess software that derives keys this way is far less common than it once was, but I know of somebody who cracked something using this method just a few years ago, so it still pops up from time to time.
catlikesshrimp
Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey.
I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars.
The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!
bri3d
Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly.
I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion, if you could reverse one you could reverse the other.
But this concept was insanely prevalent for ~20 years or so.
One of the biggest problems was not having enough ports. Some parallel port dongles tried to ignore communication with other dongles and actually had a port on the back; you'd make a "dongle snake" out of them. Once they moved to USB it was both easier and harder - you couldn't make the snake anymore, but you could ask people to use a hub when they ran out of ports.
ok123456
It was widely used in engineering software because the license cost was equivalent to a large fraction of an engineer's salary. Anyone who used AutoCAD back in the 90s can remember.
When parallel ports were discontinued, they migrated to USB and network license servers.
jandrese
One problem is that they often couldn't be daisy chained, the connector on the back was only useful for an actual printer. So if everybody started doing it you would have to swap them constantly which is a headache. So they're mostly used for software where it's going to be the only thing running on the box.
I find it interesting that they didn't make it into the USB era where you could easily have something that does some actual processing on the device that makes it a serious challenge to reverse engineer.
GuB-42
Having to put a physical device on your parallel port at the back of the computer is kind of annoying, especially if every software you use has one.
More common for games was to use the media itself for copy protection, using a variety of tricks to make copy more difficult. Other techniques involve printing some keys you have to enter using colors that don't render well in photocopies, or have you look at words a certain page of a thick user manual, the idea being that it is more expensive to go through the effort of copying this material than to buy the software legally.
One of my favorite is from Microprose games, for which the manual was a pretty good reference book on the subject of the game, that alone is worth buying. And the copy protection is about asking you about information contained in the book, for example, it may be some detail about a particular plane in a flight simulator, which means that a way to bypass copy protection is simply to be knowledgeable about planes!
Dongles were common, but mostly for expensive enterprise software. Also, dongles don't make cracking harder compared to all the other techniques, so for popular consumer software like games, it is likely to be a lot of inconvenience and a waste of money for limited results.
sowbug
Dongles still exist in the form of Nintendo Switch cartridges, though they're an extreme form that contains all the app logic, rather than just 7606h.
maxglute
I mean all cartridges and cd/dvds/ physical media with DRM were technically dongles.
I remember hearing a courier died overnighting a CAD dongle.
aizk
Very cool to read an article about windows 95 still being used in production - a nice contrast to the infinite AI hype cycle over everything.
Tech may move fast in flashy areas but not in the more "boring" parts of the industry.
1970-01-01
The screenshots show the program was made for DOS. Very likely Windows was used just for network file sharing.
accrual
I knew of a Windows 95 host running virtualized in a corp environment until at least 2014 or so. It was surprisingly sturdy, I only had to remote into it once or twice when the old software it was running hung up on something. It was old medical software and we apparently had a couple clients still interfaced to it.
jojobas
Win95 is only 30 years old and runs natively on some modern hardware.
Apparently there is important stuff still running in emulated PDP-11s, almost double the age.
userbinator
There are subtantial amounts of large industrial processes still in operation using equipment from the late 19th century.
dmitrygr
>Very importantly, there doesn’t seem to be any “input” into this routine. It doesn’t pop anything from the stack, nor does it care about any register values passed into it. Which can only mean that the result of this routine is completely constant!
This is not necessarily a fair assumption (though it worked this time). It could be some sort of a rolling code, where the reply is not constant but changes, and remains verifiable. Example: garge door openers have no input from the garage, but the sent signal differs every button click, and the garage can verify its correctness
sonixier
The company i work at has the same problem. We have some old mission-critical windows 2000 pc that runs the rpg compiler, with attached dongle. This gave me some clues on where to start - thanks author!
dunham
Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it.
The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.
accrual
Fun journey! It would be fascinating to see what's inside the dongle. I wonder if it's programmable or just a simple circuit.
byb
Yes, a neat follow-up would be to clone the copy protection device with a cheap microcontroller. A lot of these devices were filled with epoxy, but it would be funny to find out these were all just 1Kbit EEPROMs. Such an article could give some background on parallel port communication, EEPROMs, and how regular printer data was passed through.
izme
This takes me back. There exist emulators for these dongles as well, you run the a dumper with the dongle attached and load the program and it makes a dump file which you then use in the emulator.
I had to do this for a company so they could continue to use their old specialised Win98 software on modern computers using Dosbox and an emulator.
nsoonhui
I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates.
> which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade
This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users.
I don't condone piracy, but I also don't condone SaaS.
dataflow
> from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?
throw101010
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
In my experience this continues to this day due to people who require drawing on air-gapped computers, because the drawings/simulations they work on are highly sensitive (nuclear, military, and other sensitive infrastructure).
But I'm sure there are also old-fashioned people who like the portability/sovereignty of not having to rely on a third-party license server as you suggest.
jbm
My dad used to use this kind of dongle for a civil engineering program called 'Cosmos'. Just wild to see it, it was so annoying to because sometimes it would simply not be detected on our 80386.
b1temy
> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected.
I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liable for problems in said software.). In fact, having no copy protection would probably have saved you the problem you mentioned where a dongle breaks and replacement parts are no longer available; this is one of the talking points that anti-drm/copy protection people advocate for, software lost to time and unable to be archived when the entities who made such protections go out of business or no longer want to support older software.
> even on legitimate platforms like Shopee or Lazada.
On a slight tangent, but I personally don't find either platform legitimate (Better than say, wish[.]com or temu, but not as "legitimate" as other platforms, though I can't think of a single fully legitimate e-commerce platform). Shopee collects a ton of tracking information (Just turn on your adblocked, or inspect your network calls. It's even more than Amazon!), is full of intrusive ads, sketchy deals, and scammers. You yourself said you can easily find cracked versions of the dongle there, which doesn't speak well for the platform. And Lazada is owned by Alibaba Group, which speaks for itself. I'm not sure why consumers in South East Asian regions aren't more outspoken about this, since they seem to be the some of the more popular e-commerce platforms there.
truekonrads
The problem seems the sales model rather than the dongle:
1) a hardware and software solution implies that hardware will stop working at some point. Customers should understand it
2) you could sell them a new dongle every time support contract ends which is what I’ve experienced with Xways as an example. Even if you’re air gapped once a year usage data upload and new dongle seems fine.
3) why should users receive free upgrades and bug fixes? No software is bug free.
Finally there are several brand protection shops that fight fakes and work well with Shopee, Lazada, Facebook etc. It’s not five dollars but they will take these down effectively
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation.
Sometimes, there are network interuptions. Then it is the right time to work because youtube isn't available.
jedberg
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch?
Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid.
This was basically the 80s version of that.
huflungdung
[dead]
insuranceguru
wow, the home accountant is basically the great-grandfather of everything we do in modern financial and actuarial modeling. dmitry's breakdown is like digital archeology.
it’s wild to think about the hardware risk people used to accept putting your entire household's financial history on a system that bricks itself the second a 40-year-old plastic dongle fails. really great read.
burnt-resistor
And they probably could've just used Neverlock Business which cracks zillions of programs.
DANmode
> Is this really worthy of a patent?
You have no idea how deep this rabbit hole goes.
Patents are barely better than copyright, as far as society net-positive.
kmad
Was anyone else's first thought to put this through Claude and see what it thought? Who knows if it's in the training data, etc. but I fed in the gist of the raw asm and didn't see any other network requests.
Opus 4.5 did pretty well considering it was raw assembly:
---
This is a classic hardware dongle detection routine for DOS/x86 systems from the 1980s-90s era. Here's what it does:
Purpose
Copy protection - it detects whether a specific hardware key (dongle) is connected to the parallel port.
Step-by-Step Breakdown
1. Find Parallel Port (lines 0000-0015)
- Searches the BIOS data area (0000:0408) for parallel port addresses
- Checks up to 4 possible LPT ports
- Returns if no port found
2. Save Port State (lines 0016-001D)
- Disables interrupts (CLI)
- Reads and saves current data and control register values
- Pushes them onto stack for later restoration
3. Initialization Sequence (lines 001F-003A)
- Sends specific control signals: 0x82, 0x80, 0x82
- Uses precise timing delays (0x9C40 and 0x3880 loops)
- Prepares the dongle for interrogation
4. Challenge-Response Loop (lines 003C-005F)
- Runs 120 iterations (0x78)
- Each iteration:
- Sends 0xA2 to control port
- Reads status register
- Checks bit 6 (0x40 mask)
- Records timing of specific responses in BL and BH registers
- Looks for a response at iteration 0x76
5. Cleanup (lines 0061-006F)
- Writes 0x00 to reset
- Restores original port state
- Re-enables interrupts (STI)
- Returns with BX containing the challenge result
The dongle hardware would respond to these electrical signals with specific timing patterns that only genuine dongles would produce, making it very difficult to crack without the physical hardware.
---
odomus
Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?
direwolf20
It's illegal.
TheDong
Once it hits 70 years from the lifetime of the author (so probably another 80 or 90 years from now) and is in public domain, that might change things since there will no longer be copyright being protected.
In terms of copyright terms, this software is still pretty young, not even halfway to public domain. It's disrespectful to call it "very old".
yesturi
BTW, in the European Union, reverse-engineering is perfectly legal, if it is done to ensure compatibility with the current tech.
I cannot cite the reliable sources for it, though.
Tempest1981
So what hardware would be inside the dongle? Would a small PAL be enough? Maybe with a few registers to delay the values written by a few cycles, mixing in some decode logic? (Something cheaper than a microcontroller, I'm guessing... due to cost)
asyncadventure
[dead]
zabzonk
I think I remember hacking some of the copy-protection out of a version of Tetris using the Borland debugger. I definitely patched mouse support into a Chris Crawford "Battle of the Bulge" game using it (for my rather tricky platform). That was a good debugger, and probably the last one I have used much - prefer logging/printing for stuff I write myself.
I remember my Dragon 32 (6809, Color Computer clone) had a dongle you plugged into the joystick port to protect a really crap game - Jumping Knights? I never tried to defeat it.
charcircuit
>The only evidence for the existence of this company is this record of them exhibiting their wares at SIGGRAPH conferences in the early 1990s, as well as several patents issued to them, relating to software protection.
There is also their webpage for ordering PC RPG II. The company address is a residential house.
Apparently there is a Noel Vasquez, now in his late 80s, living at that address. Might be the guy to contact for further information, if he's still around.
firecall
Cracking this dongle; wouldn't this be a federal offence in the US?
Not being snarky - genuine question!
I am not from the US :-)
userbinator
It probably is; and so is going 10 over the speed limit.
direwolf20
Yes and in every country that adopted a copyright treaty with the US, so all of them except China
seblon
Yeah, Software protection was very naive in the beginning. Fun fact: I owned a windows 3.11 for workgroup UPGRADE disc collection, it was clearly explained and also enforced from the setup installer. So, no previous installed win 3.0 == upgrade installer will fail. The fix: just create an empty Textfile named win.com at any place - the installer simple scans the WHOLE disk just for this existing filename. Next fun fact: in reality, the Upgrade contained the full installation, no only a delta. Men, software was so simple these days....
mikepurvis
I have a childhood memory of my dad buying a shrink-wrapped copy of the Windows 3.1 Upgrade that was supposed to allow any installation of "3.0 or earlier" to become Win 3.1. it turned out when we actually tried it it only accepted 3.x though. [1]
I think he ended up pirating a 3.x install from a friend and running the upgrade on to of that; felt pretty morally clear given what the box had advertised.
I designed a security dongle a long time ago ... Used properly, it did rotations and XORs like a CRC. You could definitely make it hard to defeat but it was still ultimately deterministic.
algeni
[flagged]
Sophira
The fact that the software and hardware is evidently still in use at some companies gives me pause about whether releasing it in a cracked form publicly after having published it on a personal website would be a good idea.
Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in!
All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue.
If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.
mrandish
Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one.
Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unknown software apps to preserve. Software sold for Windows 98 up to 2001 (so recent as to barely be considered 'vintage') with so little online footprint means it must have been incredibly obscure. No ads or reviews from magazines or even newsletters means there's a good chance it was a one or two person part-time, home-based business and the product had hundreds or maybe even just dozens of users.
1998-2001 was the hottest time ever for PC software. I worked in marketing Windows software during this period. To have any commercial Windows software product actively available for sale in the late 90s with no surviving footprint would almost require intentional effort to stay unknown. No press releases mailed. No review copies sent. No shows or conferences attended (exhibitor listings are searchable online now). There were much older niche vertical software programs for much more obscure platforms which we know sold less than a hundred copies ever, yet still have a larger online footprint than this program. The OP de-protecting and archiving this previously unknown commercial program represents quite a notable find in the preservation community.
51Cards
I was hired in the early 90's by a collection of franchises for a home care company. The privately owned head office self-developed and distributed required monthly updates to the only software franchises were permitted to run their business. The monthly updates (floppies) reset the license for another month at each location. After years of problems, poor support, and in a couple cases offices getting shut down because head office just "didn't like them anymore", they banded together to sue the owners (one of which developed the software). I did IT work for a couple of the offices and was already familiar with maintaining the software / systems. They hired me to bypass the licensing code which was a lot of fun to figure out. In the end I wrote a DOS based license generator each office had that could update their software by just getting a code over the phone for the upcoming month (or any date for 365 days). A few years later once the lawsuit settled and the company broke apart we issued a patch for the software to remove the license check completely. I should fire up DOSBox sometime so I can play with that old software again.
boarsofcanada
I wrote RPG II code in the 80s and helped the company I was working part-time for transition to another one of these S/36 emulation environments on the PC in the 90s. The software we used was made by the very generically named California Software Products.
It worked well enough and allowed the company to run until the founder retired and folded the business.
dhosek
I remember reading an ad in one of the 90s PC magazines that attributed the dongle to an inventor named “Don Gull.” I was fortunate enough to never have to use a hardware dongle, but I remember hearing about their persistence into the twenty-first century. I would imagine that most of them were as ridiculously simple as this one was.
weinzierl
These dongles used to be ubiquitous and they broke all the time.
As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared)
Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing.
So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing.
Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home.
Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.
userbinator
For some reason, Reko was not able to decompile this code into a C representation
That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler.
In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program.
This reminds me of the classic Ken Thompson attack.
sedatk
Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.
unnouinceput
Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk? The reason why this is not more common is because the more iterations you do, the harder is to create those iterations, which means you add a lot of time to create the protection which means that you need to have a finished code, and code is always modified by production team, so managers see this overtime unnecessary.
sintax
Out of curiosity googled for Sentinel (which was one of the other dongles back then), seems somebody is now providing a bypass/emulation service: https://sentineldongle.com/
(not affiliated with this, just googled Sentinel like 5 minutes ago and this showed up).
bitwize
This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.
urbandw311er
…and?
RagnarD
Fun hack, sure, but why on earth isn't the focus on porting the accounting data to a new, currently supported accounting system?
thenthenthen
As a hardware guy I would first start with opening up the dongle, but hey! Still very curious to see whats inside!
medwards666
I always thought the internals were encased in potting compound for these things to prevent exactly this scenario (certainly the ones I had for LightWave back in the day were)...
alibarber
Yes my first thought would be to probe the parallel lines and see what went in and came out, but this approach was just as interesting!
cricalix
Tangential to this was the existence of California Software Product's "Baby/36" software. My father was a 36/400 programmer and sysadmin, and in his spare time used Baby/36 to write software for local businesses. I have vague memories of parallel port dongles being involved back then too. Don't think he mandated their use, was more a "framework" requirement.
shevy-java
This is kind of like archaeology - just, software archaeology.
maximgeorge
[dead]
taylorportman
Often these dongles were just a single resistor 'circuit'
direwolf20
Like a warded lock. It only keeps honest people honest — and proves intent to not pay.
giamma
This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version.
So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation.
My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.
3uruiueijjj
USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so.
In our case, the copy protection would still be as easy to bypass as the one in the article.
u1hcw9nx
You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't.
Actual dongles with encryption and processor cost only $15 in batches of 100.
soanvig
I want to read the rest of the migration story
unwind
Just a few months back I worked in embedded development on a project and there was a physical dongle to unlock the compiler, which was surprising during on-boarding as I've spent years doing commercial embedded work relying on GCC. :)
jeffwass
Really interesting read, wonder how many other installs are using (and trapped into continuing to use) such obscure legacy software.
alkonaut
I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years.
The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded.
A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.
potatomaseat9
Its insane this things still works after 40 year old and someone now able to cracked it down
yesturi
It is interesting that the vendor adapts the hardware token and then makes it weak on the software side.
I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all.
> If we look at segment 0800, we see the smoking gun: in and out instructions, meaning that the copy-protection routine is definitely here, and best of all, the entire code segment is a mere 0x90 bytes, which suggests that the entire routine should be pretty easy to unravel and understand. For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Maybe this was a primitive form of obfuscation from those early days, which is now confusing Reko and preventing it from associating this chunk of code with the rest of the program… who knows.
in/out instructions wouldn't have a C equivalent. My assumption would be it only translates instructions that a C compiler would typically create.
kevincox
I would still hope for it to translate most of the code with a couple of asm blocks. But maybe the density of them was too high and some heuristic decided against it?
Piraty
well done.
this brought up fond memories of crackme communities in the early web... looking at asm callgraphs in ollydbg ...
I just found my +20y old patch.exe that 'NOP's the correct address of a popular windows archive handling software just to get rid of its nag screen ;-)
doctor_blood
Today on "Hacker" News: a third of the commenters wring their hands and question the morality and legality of subverting copy protection on software almost half a century old.
deevus
Great read. I love this stuff. I wish to see the source code when it’s ready.
mperham
Amazing, the dongle simply returned a fixed number, 0x7606.
kwanbix
My father, an accountant, used to have a program like that, that used RPG and a dongle! Good times. Horrible donle.
dehrmann
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number?
Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.
cyanydeez
Yeah, my IT company bitshifts suspect files and provides the magic number.
The protection just needs suficirntly complex.
opinologo
Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000.
In most cases it was not much more difficult than what OP described.
15155
Audience matters. Something intended to stop legitimate business consumers in a non tech industry requires substantially less sophistication than something built to withstand professional reverse engineers.
bri3d
In fairness, the decompiler didn't work on the protection method :)
I think that both halves of the author's thesis are true: I bet that you could use this device in a more complicated way, but I also bet that the authors of the program deemed this sufficient. I've reversed a lot of software (both professionally and not) from that era and I'd say at least 90% of it really is "that easy," so there's nothing you're missing!
rustyhancock
The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access.
More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case.
I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty.
What if the hardware has a LFSR in it and returns changing responses, and the caller can check them with a verify function else where that maintains a state and knows to expect the next in the sequence?
We have far better tools today for sure, but we understood the system better back then. The right tool is sometimes better than a sharper tool as they say.
Edit : I should add I'm aware it's very likely the actual reversing involved more steps and checks than Dimitrys blog which is narrowed to what worked.
ruleryak
Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you were trying to skip, find that string, hop over into assembly to see what triggered loading that, and then just alter the logic to jump over it when the time comes.
antonvs
> Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races.
I did that with dBASE III, which used ProLok "laser protection" from Vault Corporation - a signature burned onto the diskette with a laser. Back then, I found it amazing that Ashton-Tate actually spent money to contract with a copy protection company for something that could be so easily defeated by a teenager reading assembler.
They could have easily just written the same kind of code themselves. An example of the power of marketing over substance.
I was able to replicate that protection mechanism just by scratching a diskette with a pin. The "laser" was a meaninglessly advanced-sounding solution that added no value compared to any other means of damaging a diskette.
hinkley
There's a lot of things going on that lead to this.
One, the developers spend more time running this code than we do, and they have to get the program working before we can even use it. So any parts of the program that are hostile to the developers risks killing the entire project. Obfuscating the copy protection can hit a point where it makes bug fixing difficult.
Two, lack of training. If you, me, and Steve each have a bag of tricks we all use to crack games, whichever one of us figures it out gets bragging rights but the game remains cracked. Meanwhile Developer Dan has to be aware of all the tricks in all of our bags together if he wants to keep the three of us out. Only there's not three of us, there's 300. Or today, probably more like 30,000.
Three, lack of motivation, which is itself several different situations. There's a certain amount of passive aggression you can put into a feature you don't even really want to work on. You can lean into any of the other explanations to defend why your code didn't protect from cracking all that much, but it's a checkbox that's trying to prove a negative, and nobody is going to give you any credit for getting it to work right in the same way they give you credit for fixing that corner glitch that the QA people keep bitching about. Or getting that particle animation to work that makes the AOE spells look badass.
m463
I remember I had some demo software that could be enabled with a code. I was just curious and at the code prompt, I entered the debugger. I dumped the process space and there was a nul-terminated string of letters and numbers. I restarted the process and entered them at the prompt and voila, it was enabled.
(I did go on to pay for the software)
alfiedotwtf
Cracking is so fun because we have Slides!
markh1967
Many years ago I was a technician supporting a few custom programs on thousands of PCs. The developer of one of these programs had added a date check to his code so the program would refuse to run after a set date and each new release would increase this date by a few months so it would stop working after a few weeks if he ever stopped creating new releases. His contract ended and a few weeks later his software, now relied upon by hundreds of sites, stopped working. The contract for the software development was thoroughly checked and legal action against the developer was started but I asked to see if I could resolve the problem in the meantime.
It only took ten minutes with a dissassembler to find the JGT (Jump if greater than) and convert it to a JLT so the software would stop running if the date was before a certain date rather than after. I created a patching tool that simply flipped one bit that was sent out to all the sites and everything was good again. I don't think I'll ever beat the elegance of a single bit flip hack.
ale42
I remember an icon editor (or something similar) for Windows 3.1, it was a shareware where you could enter a code to remove the nag screen. No crack was necessary, I basically managed to enter valid registration codes by just typing random numbers. In the end I had enough valid numbers that I could figure out the logic, it was something about the sums of digit groups.
anilakar
A certain automation system vendor uses proper USB license dongles in their PC software but they do not do challenge-response authentication. Instead they send a hardcoded string to the dongle and compare the response against a list that contains various software feature levels.
The whole automation system including machinery costs anywhere from 200k to 1M yet Vendor™ tries to milk the customers dry with a 1.5k software license that lets you manage up to 254 physically connected systems. I'm pretty sure the license dongle is in reality designed to prevent casual tinkering of parameters, which is something only service techs should do.
You can circumvent this with serial-over-Ethernet converters, which has resulted in an Industrial Internet of Shit-level security nightmare as companies happily expose their systems over the internet, thinking that license dongles are a substitute for authentication.
jeffwass
I was wondering this actually, why not just skip past the check entirely instead of going through the effort to pass the check without the dongle?
miki123211
Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line.
This works because some programs use a hashing algorithm to calculate the key based on the name, do a strcmp, and pop a messagebox if the keys don't match, without zeroizing the valid key buffer first. If the key buffers are on the stack (or if the two mallocs just happen to use the same region in memory), it is often easy to find a valid key if you know where the invalid one is.
I guess software that derives keys this way is far less common than it once was, but I know of somebody who cracked something using this method just a few years ago, so it still pops up from time to time.
catlikesshrimp
Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey.
I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars.
The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!
bri3d
Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly.
I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion, if you could reverse one you could reverse the other.
But this concept was insanely prevalent for ~20 years or so.
One of the biggest problems was not having enough ports. Some parallel port dongles tried to ignore communication with other dongles and actually had a port on the back; you'd make a "dongle snake" out of them. Once they moved to USB it was both easier and harder - you couldn't make the snake anymore, but you could ask people to use a hub when they ran out of ports.
ok123456
It was widely used in engineering software because the license cost was equivalent to a large fraction of an engineer's salary. Anyone who used AutoCAD back in the 90s can remember.
When parallel ports were discontinued, they migrated to USB and network license servers.
jandrese
One problem is that they often couldn't be daisy chained, the connector on the back was only useful for an actual printer. So if everybody started doing it you would have to swap them constantly which is a headache. So they're mostly used for software where it's going to be the only thing running on the box.
I find it interesting that they didn't make it into the USB era where you could easily have something that does some actual processing on the device that makes it a serious challenge to reverse engineer.
GuB-42
Having to put a physical device on your parallel port at the back of the computer is kind of annoying, especially if every software you use has one.
More common for games was to use the media itself for copy protection, using a variety of tricks to make copy more difficult. Other techniques involve printing some keys you have to enter using colors that don't render well in photocopies, or have you look at words a certain page of a thick user manual, the idea being that it is more expensive to go through the effort of copying this material than to buy the software legally.
One of my favorite is from Microprose games, for which the manual was a pretty good reference book on the subject of the game, that alone is worth buying. And the copy protection is about asking you about information contained in the book, for example, it may be some detail about a particular plane in a flight simulator, which means that a way to bypass copy protection is simply to be knowledgeable about planes!
Dongles were common, but mostly for expensive enterprise software. Also, dongles don't make cracking harder compared to all the other techniques, so for popular consumer software like games, it is likely to be a lot of inconvenience and a waste of money for limited results.
sowbug
Dongles still exist in the form of Nintendo Switch cartridges, though they're an extreme form that contains all the app logic, rather than just 7606h.
maxglute
I mean all cartridges and cd/dvds/ physical media with DRM were technically dongles.
I remember hearing a courier died overnighting a CAD dongle.
aizk
Very cool to read an article about windows 95 still being used in production - a nice contrast to the infinite AI hype cycle over everything.
Tech may move fast in flashy areas but not in the more "boring" parts of the industry.
1970-01-01
The screenshots show the program was made for DOS. Very likely Windows was used just for network file sharing.
accrual
I knew of a Windows 95 host running virtualized in a corp environment until at least 2014 or so. It was surprisingly sturdy, I only had to remote into it once or twice when the old software it was running hung up on something. It was old medical software and we apparently had a couple clients still interfaced to it.
jojobas
Win95 is only 30 years old and runs natively on some modern hardware.
Apparently there is important stuff still running in emulated PDP-11s, almost double the age.
userbinator
There are subtantial amounts of large industrial processes still in operation using equipment from the late 19th century.
dmitrygr
>Very importantly, there doesn’t seem to be any “input” into this routine. It doesn’t pop anything from the stack, nor does it care about any register values passed into it. Which can only mean that the result of this routine is completely constant!
This is not necessarily a fair assumption (though it worked this time). It could be some sort of a rolling code, where the reply is not constant but changes, and remains verifiable. Example: garge door openers have no input from the garage, but the sent signal differs every button click, and the garage can verify its correctness
sonixier
The company i work at has the same problem. We have some old mission-critical windows 2000 pc that runs the rpg compiler, with attached dongle. This gave me some clues on where to start - thanks author!
dunham
Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it.
The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.
accrual
Fun journey! It would be fascinating to see what's inside the dongle. I wonder if it's programmable or just a simple circuit.
byb
Yes, a neat follow-up would be to clone the copy protection device with a cheap microcontroller. A lot of these devices were filled with epoxy, but it would be funny to find out these were all just 1Kbit EEPROMs. Such an article could give some background on parallel port communication, EEPROMs, and how regular printer data was passed through.
izme
This takes me back. There exist emulators for these dongles as well, you run the a dumper with the dongle attached and load the program and it makes a dump file which you then use in the emulator.
I had to do this for a company so they could continue to use their old specialised Win98 software on modern computers using Dosbox and an emulator.
nsoonhui
I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates.
> which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade
This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users.
I don't condone piracy, but I also don't condone SaaS.
dataflow
> from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?
throw101010
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
In my experience this continues to this day due to people who require drawing on air-gapped computers, because the drawings/simulations they work on are highly sensitive (nuclear, military, and other sensitive infrastructure).
But I'm sure there are also old-fashioned people who like the portability/sovereignty of not having to rely on a third-party license server as you suggest.
jbm
My dad used to use this kind of dongle for a civil engineering program called 'Cosmos'. Just wild to see it, it was so annoying to because sometimes it would simply not be detected on our 80386.
b1temy
> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected.
I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liable for problems in said software.). In fact, having no copy protection would probably have saved you the problem you mentioned where a dongle breaks and replacement parts are no longer available; this is one of the talking points that anti-drm/copy protection people advocate for, software lost to time and unable to be archived when the entities who made such protections go out of business or no longer want to support older software.
> even on legitimate platforms like Shopee or Lazada.
On a slight tangent, but I personally don't find either platform legitimate (Better than say, wish[.]com or temu, but not as "legitimate" as other platforms, though I can't think of a single fully legitimate e-commerce platform). Shopee collects a ton of tracking information (Just turn on your adblocked, or inspect your network calls. It's even more than Amazon!), is full of intrusive ads, sketchy deals, and scammers. You yourself said you can easily find cracked versions of the dongle there, which doesn't speak well for the platform. And Lazada is owned by Alibaba Group, which speaks for itself. I'm not sure why consumers in South East Asian regions aren't more outspoken about this, since they seem to be the some of the more popular e-commerce platforms there.
truekonrads
The problem seems the sales model rather than the dongle:
1) a hardware and software solution implies that hardware will stop working at some point. Customers should understand it
2) you could sell them a new dongle every time support contract ends which is what I’ve experienced with Xways as an example. Even if you’re air gapped once a year usage data upload and new dongle seems fine.
3) why should users receive free upgrades and bug fixes? No software is bug free.
Finally there are several brand protection shops that fight fakes and work well with Shopee, Lazada, Facebook etc. It’s not five dollars but they will take these down effectively
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation.
Sometimes, there are network interuptions. Then it is the right time to work because youtube isn't available.
jedberg
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch?
Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid.
This was basically the 80s version of that.
huflungdung
[dead]
insuranceguru
wow, the home accountant is basically the great-grandfather of everything we do in modern financial and actuarial modeling. dmitry's breakdown is like digital archeology.
it’s wild to think about the hardware risk people used to accept putting your entire household's financial history on a system that bricks itself the second a 40-year-old plastic dongle fails. really great read.
burnt-resistor
And they probably could've just used Neverlock Business which cracks zillions of programs.
DANmode
> Is this really worthy of a patent?
You have no idea how deep this rabbit hole goes.
Patents are barely better than copyright, as far as society net-positive.
kmad
Was anyone else's first thought to put this through Claude and see what it thought? Who knows if it's in the training data, etc. but I fed in the gist of the raw asm and didn't see any other network requests.
Opus 4.5 did pretty well considering it was raw assembly:
---
This is a classic hardware dongle detection routine for DOS/x86 systems from the 1980s-90s era. Here's what it does:
Purpose
Copy protection - it detects whether a specific hardware key (dongle) is connected to the parallel port.
Step-by-Step Breakdown
1. Find Parallel Port (lines 0000-0015)
- Searches the BIOS data area (0000:0408) for parallel port addresses
- Checks up to 4 possible LPT ports
- Returns if no port found
2. Save Port State (lines 0016-001D)
- Disables interrupts (CLI)
- Reads and saves current data and control register values
- Pushes them onto stack for later restoration
3. Initialization Sequence (lines 001F-003A)
- Sends specific control signals: 0x82, 0x80, 0x82
- Uses precise timing delays (0x9C40 and 0x3880 loops)
- Prepares the dongle for interrogation
4. Challenge-Response Loop (lines 003C-005F)
- Runs 120 iterations (0x78)
- Each iteration:
- Sends 0xA2 to control port
- Reads status register
- Checks bit 6 (0x40 mask)
- Records timing of specific responses in BL and BH registers
- Looks for a response at iteration 0x76
5. Cleanup (lines 0061-006F)
- Writes 0x00 to reset
- Restores original port state
- Re-enables interrupts (STI)
- Returns with BX containing the challenge result
The dongle hardware would respond to these electrical signals with specific timing patterns that only genuine dongles would produce, making it very difficult to crack without the physical hardware.
---
odomus
Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?
direwolf20
It's illegal.
TheDong
Once it hits 70 years from the lifetime of the author (so probably another 80 or 90 years from now) and is in public domain, that might change things since there will no longer be copyright being protected.
In terms of copyright terms, this software is still pretty young, not even halfway to public domain. It's disrespectful to call it "very old".
yesturi
BTW, in the European Union, reverse-engineering is perfectly legal, if it is done to ensure compatibility with the current tech.
I cannot cite the reliable sources for it, though.
Tempest1981
So what hardware would be inside the dongle? Would a small PAL be enough? Maybe with a few registers to delay the values written by a few cycles, mixing in some decode logic? (Something cheaper than a microcontroller, I'm guessing... due to cost)
asyncadventure
[dead]
zabzonk
I think I remember hacking some of the copy-protection out of a version of Tetris using the Borland debugger. I definitely patched mouse support into a Chris Crawford "Battle of the Bulge" game using it (for my rather tricky platform). That was a good debugger, and probably the last one I have used much - prefer logging/printing for stuff I write myself.
I remember my Dragon 32 (6809, Color Computer clone) had a dongle you plugged into the joystick port to protect a really crap game - Jumping Knights? I never tried to defeat it.
charcircuit
>The only evidence for the existence of this company is this record of them exhibiting their wares at SIGGRAPH conferences in the early 1990s, as well as several patents issued to them, relating to software protection.
There is also their webpage for ordering PC RPG II. The company address is a residential house.
Apparently there is a Noel Vasquez, now in his late 80s, living at that address. Might be the guy to contact for further information, if he's still around.
firecall
Cracking this dongle; wouldn't this be a federal offence in the US?
Not being snarky - genuine question!
I am not from the US :-)
userbinator
It probably is; and so is going 10 over the speed limit.
direwolf20
Yes and in every country that adopted a copyright treaty with the US, so all of them except China
seblon
Yeah, Software protection was very naive in the beginning. Fun fact: I owned a windows 3.11 for workgroup UPGRADE disc collection, it was clearly explained and also enforced from the setup installer. So, no previous installed win 3.0 == upgrade installer will fail. The fix: just create an empty Textfile named win.com at any place - the installer simple scans the WHOLE disk just for this existing filename. Next fun fact: in reality, the Upgrade contained the full installation, no only a delta. Men, software was so simple these days....
mikepurvis
I have a childhood memory of my dad buying a shrink-wrapped copy of the Windows 3.1 Upgrade that was supposed to allow any installation of "3.0 or earlier" to become Win 3.1. it turned out when we actually tried it it only accepted 3.x though. [1]
I think he ended up pirating a 3.x install from a friend and running the upgrade on to of that; felt pretty morally clear given what the box had advertised.
I designed a security dongle a long time ago ... Used properly, it did rotations and XORs like a CRC. You could definitely make it hard to defeat but it was still ultimately deterministic.
algeni
[flagged]
Sophira
The fact that the software and hardware is evidently still in use at some companies gives me pause about whether releasing it in a cracked form publicly after having published it on a personal website would be a good idea.
Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in!
All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue.
If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.
mrandish
Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one.
Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unknown software apps to preserve. Software sold for Windows 98 up to 2001 (so recent as to barely be considered 'vintage') with so little online footprint means it must have been incredibly obscure. No ads or reviews from magazines or even newsletters means there's a good chance it was a one or two person part-time, home-based business and the product had hundreds or maybe even just dozens of users.
1998-2001 was the hottest time ever for PC software. I worked in marketing Windows software during this period. To have any commercial Windows software product actively available for sale in the late 90s with no surviving footprint would almost require intentional effort to stay unknown. No press releases mailed. No review copies sent. No shows or conferences attended (exhibitor listings are searchable online now). There were much older niche vertical software programs for much more obscure platforms which we know sold less than a hundred copies ever, yet still have a larger online footprint than this program. The OP de-protecting and archiving this previously unknown commercial program represents quite a notable find in the preservation community.
51Cards
I was hired in the early 90's by a collection of franchises for a home care company. The privately owned head office self-developed and distributed required monthly updates to the only software franchises were permitted to run their business. The monthly updates (floppies) reset the license for another month at each location. After years of problems, poor support, and in a couple cases offices getting shut down because head office just "didn't like them anymore", they banded together to sue the owners (one of which developed the software). I did IT work for a couple of the offices and was already familiar with maintaining the software / systems. They hired me to bypass the licensing code which was a lot of fun to figure out. In the end I wrote a DOS based license generator each office had that could update their software by just getting a code over the phone for the upcoming month (or any date for 365 days). A few years later once the lawsuit settled and the company broke apart we issued a patch for the software to remove the license check completely. I should fire up DOSBox sometime so I can play with that old software again.
boarsofcanada
I wrote RPG II code in the 80s and helped the company I was working part-time for transition to another one of these S/36 emulation environments on the PC in the 90s. The software we used was made by the very generically named California Software Products.
It worked well enough and allowed the company to run until the founder retired and folded the business.
dhosek
I remember reading an ad in one of the 90s PC magazines that attributed the dongle to an inventor named “Don Gull.” I was fortunate enough to never have to use a hardware dongle, but I remember hearing about their persistence into the twenty-first century. I would imagine that most of them were as ridiculously simple as this one was.
weinzierl
These dongles used to be ubiquitous and they broke all the time.
As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared)
Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing.
So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing.
Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home.
Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.
userbinator
For some reason, Reko was not able to decompile this code into a C representation
That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler.
In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program.
This reminds me of the classic Ken Thompson attack.
sedatk
Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.
unnouinceput
Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk? The reason why this is not more common is because the more iterations you do, the harder is to create those iterations, which means you add a lot of time to create the protection which means that you need to have a finished code, and code is always modified by production team, so managers see this overtime unnecessary.
sintax
Out of curiosity googled for Sentinel (which was one of the other dongles back then), seems somebody is now providing a bypass/emulation service: https://sentineldongle.com/
(not affiliated with this, just googled Sentinel like 5 minutes ago and this showed up).
bitwize
This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.
urbandw311er
…and?
RagnarD
Fun hack, sure, but why on earth isn't the focus on porting the accounting data to a new, currently supported accounting system?
thenthenthen
As a hardware guy I would first start with opening up the dongle, but hey! Still very curious to see whats inside!
medwards666
I always thought the internals were encased in potting compound for these things to prevent exactly this scenario (certainly the ones I had for LightWave back in the day were)...
alibarber
Yes my first thought would be to probe the parallel lines and see what went in and came out, but this approach was just as interesting!
cricalix
Tangential to this was the existence of California Software Product's "Baby/36" software. My father was a 36/400 programmer and sysadmin, and in his spare time used Baby/36 to write software for local businesses. I have vague memories of parallel port dongles being involved back then too. Don't think he mandated their use, was more a "framework" requirement.
shevy-java
This is kind of like archaeology - just, software archaeology.
maximgeorge
[dead]
taylorportman
Often these dongles were just a single resistor 'circuit'
direwolf20
Like a warded lock. It only keeps honest people honest — and proves intent to not pay.
giamma
This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version.
So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation.
My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.
3uruiueijjj
USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so.
In our case, the copy protection would still be as easy to bypass as the one in the article.
u1hcw9nx
You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't.
Actual dongles with encryption and processor cost only $15 in batches of 100.
soanvig
I want to read the rest of the migration story
unwind
Just a few months back I worked in embedded development on a project and there was a physical dongle to unlock the compiler, which was surprising during on-boarding as I've spent years doing commercial embedded work relying on GCC. :)
jeffwass
Really interesting read, wonder how many other installs are using (and trapped into continuing to use) such obscure legacy software.
alkonaut
I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years.
The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded.
A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.
potatomaseat9
Its insane this things still works after 40 year old and someone now able to cracked it down
yesturi
It is interesting that the vendor adapts the hardware token and then makes it weak on the software side.
I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all.
> If we look at segment 0800, we see the smoking gun: in and out instructions, meaning that the copy-protection routine is definitely here, and best of all, the entire code segment is a mere 0x90 bytes, which suggests that the entire routine should be pretty easy to unravel and understand. For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Maybe this was a primitive form of obfuscation from those early days, which is now confusing Reko and preventing it from associating this chunk of code with the rest of the program… who knows.
in/out instructions wouldn't have a C equivalent. My assumption would be it only translates instructions that a C compiler would typically create.
kevincox
I would still hope for it to translate most of the code with a couple of asm blocks. But maybe the density of them was too high and some heuristic decided against it?
Piraty
well done.
this brought up fond memories of crackme communities in the early web... looking at asm callgraphs in ollydbg ...
I just found my +20y old patch.exe that 'NOP's the correct address of a popular windows archive handling software just to get rid of its nag screen ;-)
doctor_blood
Today on "Hacker" News: a third of the commenters wring their hands and question the morality and legality of subverting copy protection on software almost half a century old.
Great read. I love this stuff. I wish to see the source code when it’s ready.
Amazing, the dongle simply returned a fixed number, 0x7606.
My father, an accountant, used to have a program like that, that used RPG and a dongle! Good times. Horrible donle.
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number?
Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.
Yeah, my IT company bitshifts suspect files and provides the magic number.
The protection just needs suficirntly complex.
Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000.
In most cases it was not much more difficult than what OP described.
Audience matters. Something intended to stop legitimate business consumers in a non tech industry requires substantially less sophistication than something built to withstand professional reverse engineers.
In fairness, the decompiler didn't work on the protection method :)
I think that both halves of the author's thesis are true: I bet that you could use this device in a more complicated way, but I also bet that the authors of the program deemed this sufficient. I've reversed a lot of software (both professionally and not) from that era and I'd say at least 90% of it really is "that easy," so there's nothing you're missing!
The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access.
More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case.
I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty.
What if the hardware has a LFSR in it and returns changing responses, and the caller can check them with a verify function else where that maintains a state and knows to expect the next in the sequence?
We have far better tools today for sure, but we understood the system better back then. The right tool is sometimes better than a sharper tool as they say.
Edit : I should add I'm aware it's very likely the actual reversing involved more steps and checks than Dimitrys blog which is narrowed to what worked.
Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you were trying to skip, find that string, hop over into assembly to see what triggered loading that, and then just alter the logic to jump over it when the time comes.
> Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races.
I did that with dBASE III, which used ProLok "laser protection" from Vault Corporation - a signature burned onto the diskette with a laser. Back then, I found it amazing that Ashton-Tate actually spent money to contract with a copy protection company for something that could be so easily defeated by a teenager reading assembler.
They could have easily just written the same kind of code themselves. An example of the power of marketing over substance.
I was able to replicate that protection mechanism just by scratching a diskette with a pin. The "laser" was a meaninglessly advanced-sounding solution that added no value compared to any other means of damaging a diskette.
There's a lot of things going on that lead to this.
One, the developers spend more time running this code than we do, and they have to get the program working before we can even use it. So any parts of the program that are hostile to the developers risks killing the entire project. Obfuscating the copy protection can hit a point where it makes bug fixing difficult.
Two, lack of training. If you, me, and Steve each have a bag of tricks we all use to crack games, whichever one of us figures it out gets bragging rights but the game remains cracked. Meanwhile Developer Dan has to be aware of all the tricks in all of our bags together if he wants to keep the three of us out. Only there's not three of us, there's 300. Or today, probably more like 30,000.
Three, lack of motivation, which is itself several different situations. There's a certain amount of passive aggression you can put into a feature you don't even really want to work on. You can lean into any of the other explanations to defend why your code didn't protect from cracking all that much, but it's a checkbox that's trying to prove a negative, and nobody is going to give you any credit for getting it to work right in the same way they give you credit for fixing that corner glitch that the QA people keep bitching about. Or getting that particle animation to work that makes the AOE spells look badass.
I remember I had some demo software that could be enabled with a code. I was just curious and at the code prompt, I entered the debugger. I dumped the process space and there was a nul-terminated string of letters and numbers. I restarted the process and entered them at the prompt and voila, it was enabled.
(I did go on to pay for the software)
Cracking is so fun because we have Slides!
Many years ago I was a technician supporting a few custom programs on thousands of PCs. The developer of one of these programs had added a date check to his code so the program would refuse to run after a set date and each new release would increase this date by a few months so it would stop working after a few weeks if he ever stopped creating new releases. His contract ended and a few weeks later his software, now relied upon by hundreds of sites, stopped working. The contract for the software development was thoroughly checked and legal action against the developer was started but I asked to see if I could resolve the problem in the meantime.
It only took ten minutes with a dissassembler to find the JGT (Jump if greater than) and convert it to a JLT so the software would stop running if the date was before a certain date rather than after. I created a patching tool that simply flipped one bit that was sent out to all the sites and everything was good again. I don't think I'll ever beat the elegance of a single bit flip hack.
I remember an icon editor (or something similar) for Windows 3.1, it was a shareware where you could enter a code to remove the nag screen. No crack was necessary, I basically managed to enter valid registration codes by just typing random numbers. In the end I had enough valid numbers that I could figure out the logic, it was something about the sums of digit groups.
A certain automation system vendor uses proper USB license dongles in their PC software but they do not do challenge-response authentication. Instead they send a hardcoded string to the dongle and compare the response against a list that contains various software feature levels.
The whole automation system including machinery costs anywhere from 200k to 1M yet Vendor™ tries to milk the customers dry with a 1.5k software license that lets you manage up to 254 physically connected systems. I'm pretty sure the license dongle is in reality designed to prevent casual tinkering of parameters, which is something only service techs should do.
You can circumvent this with serial-over-Ethernet converters, which has resulted in an Industrial Internet of Shit-level security nightmare as companies happily expose their systems over the internet, thinking that license dongles are a substitute for authentication.
I was wondering this actually, why not just skip past the check entirely instead of going through the effort to pass the check without the dongle?
Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line.
This works because some programs use a hashing algorithm to calculate the key based on the name, do a strcmp, and pop a messagebox if the keys don't match, without zeroizing the valid key buffer first. If the key buffers are on the stack (or if the two mallocs just happen to use the same region in memory), it is often easy to find a valid key if you know where the invalid one is.
I guess software that derives keys this way is far less common than it once was, but I know of somebody who cracked something using this method just a few years ago, so it still pops up from time to time.
Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey.
I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars.
The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!
Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly.
I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion, if you could reverse one you could reverse the other.
But this concept was insanely prevalent for ~20 years or so.
One of the biggest problems was not having enough ports. Some parallel port dongles tried to ignore communication with other dongles and actually had a port on the back; you'd make a "dongle snake" out of them. Once they moved to USB it was both easier and harder - you couldn't make the snake anymore, but you could ask people to use a hub when they ran out of ports.
It was widely used in engineering software because the license cost was equivalent to a large fraction of an engineer's salary. Anyone who used AutoCAD back in the 90s can remember.
When parallel ports were discontinued, they migrated to USB and network license servers.
One problem is that they often couldn't be daisy chained, the connector on the back was only useful for an actual printer. So if everybody started doing it you would have to swap them constantly which is a headache. So they're mostly used for software where it's going to be the only thing running on the box.
I find it interesting that they didn't make it into the USB era where you could easily have something that does some actual processing on the device that makes it a serious challenge to reverse engineer.
Having to put a physical device on your parallel port at the back of the computer is kind of annoying, especially if every software you use has one.
More common for games was to use the media itself for copy protection, using a variety of tricks to make copy more difficult. Other techniques involve printing some keys you have to enter using colors that don't render well in photocopies, or have you look at words a certain page of a thick user manual, the idea being that it is more expensive to go through the effort of copying this material than to buy the software legally.
One of my favorite is from Microprose games, for which the manual was a pretty good reference book on the subject of the game, that alone is worth buying. And the copy protection is about asking you about information contained in the book, for example, it may be some detail about a particular plane in a flight simulator, which means that a way to bypass copy protection is simply to be knowledgeable about planes!
Dongles were common, but mostly for expensive enterprise software. Also, dongles don't make cracking harder compared to all the other techniques, so for popular consumer software like games, it is likely to be a lot of inconvenience and a waste of money for limited results.
Dongles still exist in the form of Nintendo Switch cartridges, though they're an extreme form that contains all the app logic, rather than just 7606h.
I mean all cartridges and cd/dvds/ physical media with DRM were technically dongles.
I remember hearing a courier died overnighting a CAD dongle.
Very cool to read an article about windows 95 still being used in production - a nice contrast to the infinite AI hype cycle over everything. Tech may move fast in flashy areas but not in the more "boring" parts of the industry.
The screenshots show the program was made for DOS. Very likely Windows was used just for network file sharing.
I knew of a Windows 95 host running virtualized in a corp environment until at least 2014 or so. It was surprisingly sturdy, I only had to remote into it once or twice when the old software it was running hung up on something. It was old medical software and we apparently had a couple clients still interfaced to it.
Win95 is only 30 years old and runs natively on some modern hardware.
Apparently there is important stuff still running in emulated PDP-11s, almost double the age.
There are subtantial amounts of large industrial processes still in operation using equipment from the late 19th century.
The company i work at has the same problem. We have some old mission-critical windows 2000 pc that runs the rpg compiler, with attached dongle. This gave me some clues on where to start - thanks author!
Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it.
The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.
Fun journey! It would be fascinating to see what's inside the dongle. I wonder if it's programmable or just a simple circuit.
Yes, a neat follow-up would be to clone the copy protection device with a cheap microcontroller. A lot of these devices were filled with epoxy, but it would be funny to find out these were all just 1Kbit EEPROMs. Such an article could give some background on parallel port communication, EEPROMs, and how regular printer data was passed through.
This takes me back. There exist emulators for these dongles as well, you run the a dumper with the dongle attached and load the program and it makes a dump file which you then use in the emulator.
I had to do this for a company so they could continue to use their old specialised Win98 software on modern computers using Dosbox and an emulator.
I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates.
[0]: https://mes100.com
[dead]
> which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade
This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users.
I don't condone piracy, but I also don't condone SaaS.
> from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
In my experience this continues to this day due to people who require drawing on air-gapped computers, because the drawings/simulations they work on are highly sensitive (nuclear, military, and other sensitive infrastructure).
But I'm sure there are also old-fashioned people who like the portability/sovereignty of not having to rely on a third-party license server as you suggest.
My dad used to use this kind of dongle for a civil engineering program called 'Cosmos'. Just wild to see it, it was so annoying to because sometimes it would simply not be detected on our 80386.
> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected.
I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liable for problems in said software.). In fact, having no copy protection would probably have saved you the problem you mentioned where a dongle breaks and replacement parts are no longer available; this is one of the talking points that anti-drm/copy protection people advocate for, software lost to time and unable to be archived when the entities who made such protections go out of business or no longer want to support older software.
> even on legitimate platforms like Shopee or Lazada.
On a slight tangent, but I personally don't find either platform legitimate (Better than say, wish[.]com or temu, but not as "legitimate" as other platforms, though I can't think of a single fully legitimate e-commerce platform). Shopee collects a ton of tracking information (Just turn on your adblocked, or inspect your network calls. It's even more than Amazon!), is full of intrusive ads, sketchy deals, and scammers. You yourself said you can easily find cracked versions of the dongle there, which doesn't speak well for the platform. And Lazada is owned by Alibaba Group, which speaks for itself. I'm not sure why consumers in South East Asian regions aren't more outspoken about this, since they seem to be the some of the more popular e-commerce platforms there.
The problem seems the sales model rather than the dongle:
1) a hardware and software solution implies that hardware will stop working at some point. Customers should understand it 2) you could sell them a new dongle every time support contract ends which is what I’ve experienced with Xways as an example. Even if you’re air gapped once a year usage data upload and new dongle seems fine. 3) why should users receive free upgrades and bug fixes? No software is bug free.
Finally there are several brand protection shops that fight fakes and work well with Shopee, Lazada, Facebook etc. It’s not five dollars but they will take these down effectively
Hey, fellow civil-engineering-software designer here! [https://www.anadelta.com/en/anadelta-tessera/] Same story, same problems with dongles, perpetual & subscription licenses.
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation.
Sometimes, there are network interuptions. Then it is the right time to work because youtube isn't available.
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch?
Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid.
This was basically the 80s version of that.
[dead]
wow, the home accountant is basically the great-grandfather of everything we do in modern financial and actuarial modeling. dmitry's breakdown is like digital archeology.
it’s wild to think about the hardware risk people used to accept putting your entire household's financial history on a system that bricks itself the second a 40-year-old plastic dongle fails. really great read.
And they probably could've just used Neverlock Business which cracks zillions of programs.
> Is this really worthy of a patent?
You have no idea how deep this rabbit hole goes.
Patents are barely better than copyright, as far as society net-positive.
Was anyone else's first thought to put this through Claude and see what it thought? Who knows if it's in the training data, etc. but I fed in the gist of the raw asm and didn't see any other network requests.
Opus 4.5 did pretty well considering it was raw assembly:
--- This is a classic hardware dongle detection routine for DOS/x86 systems from the 1980s-90s era. Here's what it does:
---Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?
It's illegal.
Once it hits 70 years from the lifetime of the author (so probably another 80 or 90 years from now) and is in public domain, that might change things since there will no longer be copyright being protected.
In terms of copyright terms, this software is still pretty young, not even halfway to public domain. It's disrespectful to call it "very old".
BTW, in the European Union, reverse-engineering is perfectly legal, if it is done to ensure compatibility with the current tech.
I cannot cite the reliable sources for it, though.
So what hardware would be inside the dongle? Would a small PAL be enough? Maybe with a few registers to delay the values written by a few cycles, mixing in some decode logic? (Something cheaper than a microcontroller, I'm guessing... due to cost)
[dead]
I think I remember hacking some of the copy-protection out of a version of Tetris using the Borland debugger. I definitely patched mouse support into a Chris Crawford "Battle of the Bulge" game using it (for my rather tricky platform). That was a good debugger, and probably the last one I have used much - prefer logging/printing for stuff I write myself.
I remember my Dragon 32 (6809, Color Computer clone) had a dongle you plugged into the joystick port to protect a really crap game - Jumping Knights? I never tried to defeat it.
>The only evidence for the existence of this company is this record of them exhibiting their wares at SIGGRAPH conferences in the early 1990s, as well as several patents issued to them, relating to software protection.
There is also their webpage for ordering PC RPG II. The company address is a residential house.
https://web.archive.org/web/20010802153755/http://home.netco...
Apparently there is a Noel Vasquez, now in his late 80s, living at that address. Might be the guy to contact for further information, if he's still around.
Cracking this dongle; wouldn't this be a federal offence in the US?
Not being snarky - genuine question! I am not from the US :-)
It probably is; and so is going 10 over the speed limit.
Yes and in every country that adopted a copyright treaty with the US, so all of them except China
Yeah, Software protection was very naive in the beginning. Fun fact: I owned a windows 3.11 for workgroup UPGRADE disc collection, it was clearly explained and also enforced from the setup installer. So, no previous installed win 3.0 == upgrade installer will fail. The fix: just create an empty Textfile named win.com at any place - the installer simple scans the WHOLE disk just for this existing filename. Next fun fact: in reality, the Upgrade contained the full installation, no only a delta. Men, software was so simple these days....
I have a childhood memory of my dad buying a shrink-wrapped copy of the Windows 3.1 Upgrade that was supposed to allow any installation of "3.0 or earlier" to become Win 3.1. it turned out when we actually tried it it only accepted 3.x though. [1]
I think he ended up pirating a 3.x install from a friend and running the upgrade on to of that; felt pretty morally clear given what the box had advertised.
[1]: eg https://www.ebay.com/itm/376080245422
I designed a security dongle a long time ago ... Used properly, it did rotations and XORs like a CRC. You could definitely make it hard to defeat but it was still ultimately deterministic.
[flagged]
The fact that the software and hardware is evidently still in use at some companies gives me pause about whether releasing it in a cracked form publicly after having published it on a personal website would be a good idea.
Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in!
All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue.
If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.
Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one.
Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unknown software apps to preserve. Software sold for Windows 98 up to 2001 (so recent as to barely be considered 'vintage') with so little online footprint means it must have been incredibly obscure. No ads or reviews from magazines or even newsletters means there's a good chance it was a one or two person part-time, home-based business and the product had hundreds or maybe even just dozens of users.
1998-2001 was the hottest time ever for PC software. I worked in marketing Windows software during this period. To have any commercial Windows software product actively available for sale in the late 90s with no surviving footprint would almost require intentional effort to stay unknown. No press releases mailed. No review copies sent. No shows or conferences attended (exhibitor listings are searchable online now). There were much older niche vertical software programs for much more obscure platforms which we know sold less than a hundred copies ever, yet still have a larger online footprint than this program. The OP de-protecting and archiving this previously unknown commercial program represents quite a notable find in the preservation community.
I was hired in the early 90's by a collection of franchises for a home care company. The privately owned head office self-developed and distributed required monthly updates to the only software franchises were permitted to run their business. The monthly updates (floppies) reset the license for another month at each location. After years of problems, poor support, and in a couple cases offices getting shut down because head office just "didn't like them anymore", they banded together to sue the owners (one of which developed the software). I did IT work for a couple of the offices and was already familiar with maintaining the software / systems. They hired me to bypass the licensing code which was a lot of fun to figure out. In the end I wrote a DOS based license generator each office had that could update their software by just getting a code over the phone for the upcoming month (or any date for 365 days). A few years later once the lawsuit settled and the company broke apart we issued a patch for the software to remove the license check completely. I should fire up DOSBox sometime so I can play with that old software again.
I wrote RPG II code in the 80s and helped the company I was working part-time for transition to another one of these S/36 emulation environments on the PC in the 90s. The software we used was made by the very generically named California Software Products.
It worked well enough and allowed the company to run until the founder retired and folded the business.
I remember reading an ad in one of the 90s PC magazines that attributed the dongle to an inventor named “Don Gull.” I was fortunate enough to never have to use a hardware dongle, but I remember hearing about their persistence into the twenty-first century. I would imagine that most of them were as ridiculously simple as this one was.
These dongles used to be ubiquitous and they broke all the time.
As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared)
Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing.
So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing.
Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home.
Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.
For some reason, Reko was not able to decompile this code into a C representation
That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler.
In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program.
This reminds me of the classic Ken Thompson attack.
Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.
Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk? The reason why this is not more common is because the more iterations you do, the harder is to create those iterations, which means you add a lot of time to create the protection which means that you need to have a finished code, and code is always modified by production team, so managers see this overtime unnecessary.
Out of curiosity googled for Sentinel (which was one of the other dongles back then), seems somebody is now providing a bypass/emulation service: https://sentineldongle.com/ (not affiliated with this, just googled Sentinel like 5 minutes ago and this showed up).
This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.
…and?
Fun hack, sure, but why on earth isn't the focus on porting the accounting data to a new, currently supported accounting system?
As a hardware guy I would first start with opening up the dongle, but hey! Still very curious to see whats inside!
I always thought the internals were encased in potting compound for these things to prevent exactly this scenario (certainly the ones I had for LightWave back in the day were)...
Yes my first thought would be to probe the parallel lines and see what went in and came out, but this approach was just as interesting!
Tangential to this was the existence of California Software Product's "Baby/36" software. My father was a 36/400 programmer and sysadmin, and in his spare time used Baby/36 to write software for local businesses. I have vague memories of parallel port dongles being involved back then too. Don't think he mandated their use, was more a "framework" requirement.
This is kind of like archaeology - just, software archaeology.
[dead]
Often these dongles were just a single resistor 'circuit'
Like a warded lock. It only keeps honest people honest — and proves intent to not pay.
This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version.
So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation.
[0] https://en.wikipedia.org/wiki/Executable_compression
My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.
USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so.
In our case, the copy protection would still be as easy to bypass as the one in the article.
You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't.
Actual dongles with encryption and processor cost only $15 in batches of 100.
I want to read the rest of the migration story
Just a few months back I worked in embedded development on a project and there was a physical dongle to unlock the compiler, which was surprising during on-boarding as I've spent years doing commercial embedded work relying on GCC. :)
Really interesting read, wonder how many other installs are using (and trapped into continuing to use) such obscure legacy software.
I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years.
The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded.
A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.
Its insane this things still works after 40 year old and someone now able to cracked it down
It is interesting that the vendor adapts the hardware token and then makes it weak on the software side.
I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all.
[0] https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/
> If we look at segment 0800, we see the smoking gun: in and out instructions, meaning that the copy-protection routine is definitely here, and best of all, the entire code segment is a mere 0x90 bytes, which suggests that the entire routine should be pretty easy to unravel and understand. For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Maybe this was a primitive form of obfuscation from those early days, which is now confusing Reko and preventing it from associating this chunk of code with the rest of the program… who knows.
in/out instructions wouldn't have a C equivalent. My assumption would be it only translates instructions that a C compiler would typically create.
I would still hope for it to translate most of the code with a couple of asm blocks. But maybe the density of them was too high and some heuristic decided against it?
well done. this brought up fond memories of crackme communities in the early web... looking at asm callgraphs in ollydbg ... I just found my +20y old patch.exe that 'NOP's the correct address of a popular windows archive handling software just to get rid of its nag screen ;-)
Today on "Hacker" News: a third of the commenters wring their hands and question the morality and legality of subverting copy protection on software almost half a century old.
Great read. I love this stuff. I wish to see the source code when it’s ready.
Amazing, the dongle simply returned a fixed number, 0x7606.
My father, an accountant, used to have a program like that, that used RPG and a dongle! Good times. Horrible donle.
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number?
Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.
Yeah, my IT company bitshifts suspect files and provides the magic number.
The protection just needs suficirntly complex.
Iremember doing exactly this kind of hack for a small telco in Bueno Aires. Extel. Around the year 2000.
In most cases it was not much more difficult than what OP described.
Audience matters. Something intended to stop legitimate business consumers in a non tech industry requires substantially less sophistication than something built to withstand professional reverse engineers.
In fairness, the decompiler didn't work on the protection method :)
I think that both halves of the author's thesis are true: I bet that you could use this device in a more complicated way, but I also bet that the authors of the program deemed this sufficient. I've reversed a lot of software (both professionally and not) from that era and I'd say at least 90% of it really is "that easy," so there's nothing you're missing!
The tool of choice back then was SoftICE and it would have been trivial to trap even bios level LPT access.
More to the point the guy didn't even open the dongle, which in all likelihood was a simple set of logic gates in this case.
I'm assuming he did have a careful look at the caller to the function because his reasoning that the communicating function took no inputs is faulty.
What if the hardware has a LFSR in it and returns changing responses, and the caller can check them with a verify function else where that maintains a state and knows to expect the next in the sequence?
We have far better tools today for sure, but we understood the system better back then. The right tool is sometimes better than a sharper tool as they say.
Edit : I should add I'm aware it's very likely the actual reversing involved more steps and checks than Dimitrys blog which is narrowed to what worked.
Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races. As the author found, the tough part is just finding and interpreting where and how the protection was implemented. If throwing the exe in a hex editor gave you access to String Data References (not always the case, but more common than not) then you'd just fail the check you were trying to skip, find that string, hop over into assembly to see what triggered loading that, and then just alter the logic to jump over it when the time comes.
> Many a crack back in the day was even more simple still, we'd just find and alter the right JE or JNE into a JMP and we're off to the races.
I did that with dBASE III, which used ProLok "laser protection" from Vault Corporation - a signature burned onto the diskette with a laser. Back then, I found it amazing that Ashton-Tate actually spent money to contract with a copy protection company for something that could be so easily defeated by a teenager reading assembler.
They could have easily just written the same kind of code themselves. An example of the power of marketing over substance.
I was able to replicate that protection mechanism just by scratching a diskette with a pin. The "laser" was a meaninglessly advanced-sounding solution that added no value compared to any other means of damaging a diskette.
There's a lot of things going on that lead to this.
One, the developers spend more time running this code than we do, and they have to get the program working before we can even use it. So any parts of the program that are hostile to the developers risks killing the entire project. Obfuscating the copy protection can hit a point where it makes bug fixing difficult.
Two, lack of training. If you, me, and Steve each have a bag of tricks we all use to crack games, whichever one of us figures it out gets bragging rights but the game remains cracked. Meanwhile Developer Dan has to be aware of all the tricks in all of our bags together if he wants to keep the three of us out. Only there's not three of us, there's 300. Or today, probably more like 30,000.
Three, lack of motivation, which is itself several different situations. There's a certain amount of passive aggression you can put into a feature you don't even really want to work on. You can lean into any of the other explanations to defend why your code didn't protect from cracking all that much, but it's a checkbox that's trying to prove a negative, and nobody is going to give you any credit for getting it to work right in the same way they give you credit for fixing that corner glitch that the QA people keep bitching about. Or getting that particle animation to work that makes the AOE spells look badass.
I remember I had some demo software that could be enabled with a code. I was just curious and at the code prompt, I entered the debugger. I dumped the process space and there was a nul-terminated string of letters and numbers. I restarted the process and entered them at the prompt and voila, it was enabled.
(I did go on to pay for the software)
Cracking is so fun because we have Slides!
Many years ago I was a technician supporting a few custom programs on thousands of PCs. The developer of one of these programs had added a date check to his code so the program would refuse to run after a set date and each new release would increase this date by a few months so it would stop working after a few weeks if he ever stopped creating new releases. His contract ended and a few weeks later his software, now relied upon by hundreds of sites, stopped working. The contract for the software development was thoroughly checked and legal action against the developer was started but I asked to see if I could resolve the problem in the meantime.
It only took ten minutes with a dissassembler to find the JGT (Jump if greater than) and convert it to a JLT so the software would stop running if the date was before a certain date rather than after. I created a patching tool that simply flipped one bit that was sent out to all the sites and everything was good again. I don't think I'll ever beat the elegance of a single bit flip hack.
I remember an icon editor (or something similar) for Windows 3.1, it was a shareware where you could enter a code to remove the nag screen. No crack was necessary, I basically managed to enter valid registration codes by just typing random numbers. In the end I had enough valid numbers that I could figure out the logic, it was something about the sums of digit groups.
A certain automation system vendor uses proper USB license dongles in their PC software but they do not do challenge-response authentication. Instead they send a hardcoded string to the dongle and compare the response against a list that contains various software feature levels.
The whole automation system including machinery costs anywhere from 200k to 1M yet Vendor™ tries to milk the customers dry with a 1.5k software license that lets you manage up to 254 physically connected systems. I'm pretty sure the license dongle is in reality designed to prevent casual tinkering of parameters, which is something only service techs should do.
You can circumvent this with serial-over-Ethernet converters, which has resulted in an Industrial Internet of Shit-level security nightmare as companies happily expose their systems over the internet, thinking that license dongles are a substitute for authentication.
I was wondering this actually, why not just skip past the check entirely instead of going through the effort to pass the check without the dongle?
Another method (much more common for software that asks for two pieces of information, like a name and a key) is to take a memdump of the process at the "your key is invalid" dialog, find the invalid key you just typed, and hope that a valid key is somewhere nearby in memory. Unlike the assembly trick, this requires 0 programming expertise beyond the ability to type `strings` on the command line.
This works because some programs use a hashing algorithm to calculate the key based on the name, do a strcmp, and pop a messagebox if the keys don't match, without zeroizing the valid key buffer first. If the key buffers are on the stack (or if the two mallocs just happen to use the same region in memory), it is often easy to find a valid key if you know where the invalid one is.
I guess software that derives keys this way is far less common than it once was, but I know of somebody who cracked something using this method just a few years ago, so it still pops up from time to time.
Why wasn't (isn't) this more widely used? It was clearly more effective than a cdkey.
I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars.
The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!
Dongles were extremely widely used in the 1990s and early 2000s; for anything more advanced than consumer software you'd almost expect them? Almost every DAW, video editor, high-end compiler, engineering/CAD package, or 3D suite used them, certainly.
I think sometime in the late 1990s FlexLM switched from dongles to "hardware identifiers" that were easily spoofed; honestly I don't think this was a terrible idea since to this article's conclusion, if you could reverse one you could reverse the other.
But this concept was insanely prevalent for ~20 years or so.
One of the biggest problems was not having enough ports. Some parallel port dongles tried to ignore communication with other dongles and actually had a port on the back; you'd make a "dongle snake" out of them. Once they moved to USB it was both easier and harder - you couldn't make the snake anymore, but you could ask people to use a hub when they ran out of ports.
It was widely used in engineering software because the license cost was equivalent to a large fraction of an engineer's salary. Anyone who used AutoCAD back in the 90s can remember.
When parallel ports were discontinued, they migrated to USB and network license servers.
One problem is that they often couldn't be daisy chained, the connector on the back was only useful for an actual printer. So if everybody started doing it you would have to swap them constantly which is a headache. So they're mostly used for software where it's going to be the only thing running on the box.
I find it interesting that they didn't make it into the USB era where you could easily have something that does some actual processing on the device that makes it a serious challenge to reverse engineer.
Having to put a physical device on your parallel port at the back of the computer is kind of annoying, especially if every software you use has one.
More common for games was to use the media itself for copy protection, using a variety of tricks to make copy more difficult. Other techniques involve printing some keys you have to enter using colors that don't render well in photocopies, or have you look at words a certain page of a thick user manual, the idea being that it is more expensive to go through the effort of copying this material than to buy the software legally.
One of my favorite is from Microprose games, for which the manual was a pretty good reference book on the subject of the game, that alone is worth buying. And the copy protection is about asking you about information contained in the book, for example, it may be some detail about a particular plane in a flight simulator, which means that a way to bypass copy protection is simply to be knowledgeable about planes!
Dongles were common, but mostly for expensive enterprise software. Also, dongles don't make cracking harder compared to all the other techniques, so for popular consumer software like games, it is likely to be a lot of inconvenience and a waste of money for limited results.
Dongles still exist in the form of Nintendo Switch cartridges, though they're an extreme form that contains all the app logic, rather than just 7606h.
I mean all cartridges and cd/dvds/ physical media with DRM were technically dongles.
I remember hearing a courier died overnighting a CAD dongle.
Very cool to read an article about windows 95 still being used in production - a nice contrast to the infinite AI hype cycle over everything. Tech may move fast in flashy areas but not in the more "boring" parts of the industry.
The screenshots show the program was made for DOS. Very likely Windows was used just for network file sharing.
I knew of a Windows 95 host running virtualized in a corp environment until at least 2014 or so. It was surprisingly sturdy, I only had to remote into it once or twice when the old software it was running hung up on something. It was old medical software and we apparently had a couple clients still interfaced to it.
Win95 is only 30 years old and runs natively on some modern hardware.
Apparently there is important stuff still running in emulated PDP-11s, almost double the age.
There are subtantial amounts of large industrial processes still in operation using equipment from the late 19th century.
The company i work at has the same problem. We have some old mission-critical windows 2000 pc that runs the rpg compiler, with attached dongle. This gave me some clues on where to start - thanks author!
Back when I was a kid in the 80's. I cracked one of the Ultima games. I had it on my hard drive and didn't want to stick a floppy in every time I ran it.
The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.
Fun journey! It would be fascinating to see what's inside the dongle. I wonder if it's programmable or just a simple circuit.
Yes, a neat follow-up would be to clone the copy protection device with a cheap microcontroller. A lot of these devices were filled with epoxy, but it would be funny to find out these were all just 1Kbit EEPROMs. Such an article could give some background on parallel port communication, EEPROMs, and how regular printer data was passed through.
This takes me back. There exist emulators for these dongles as well, you run the a dumper with the dongle attached and load the program and it makes a dump file which you then use in the emulator.
I had to do this for a company so they could continue to use their old specialised Win98 software on modern computers using Dosbox and an emulator.
I write civil engineering software [0] and am familiar with this kind of dongle. Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates.
[0]: https://mes100.com
[dead]
> which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade
This take is diametrically opposite to what end users need. In a world where "if it ain't broke, don't fix it" is perfectly fine for the end user, buying a one off license for a software seems much more sane then SaaS. SaaS is like a plague for end users.
I don't condone piracy, but I also don't condone SaaS.
> from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.
Why should users upgrade or keep paying you when they already bought what they need and don't need anything else?
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation. They feel secure only if they have something tangible in hand.
In my experience this continues to this day due to people who require drawing on air-gapped computers, because the drawings/simulations they work on are highly sensitive (nuclear, military, and other sensitive infrastructure).
But I'm sure there are also old-fashioned people who like the portability/sovereignty of not having to rely on a third-party license server as you suggest.
My dad used to use this kind of dongle for a civil engineering program called 'Cosmos'. Just wild to see it, it was so annoying to because sometimes it would simply not be detected on our 80386.
> You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected.
I understand you might feel this way, but it seems to me customers are mostly business clients, who would are more inclined to spare the expense of purchasing said licenses, since they're not personally buying it themselves, and would want to have support and liability (i.e: Someone to hold liable for problems in said software.). In fact, having no copy protection would probably have saved you the problem you mentioned where a dongle breaks and replacement parts are no longer available; this is one of the talking points that anti-drm/copy protection people advocate for, software lost to time and unable to be archived when the entities who made such protections go out of business or no longer want to support older software.
> even on legitimate platforms like Shopee or Lazada.
On a slight tangent, but I personally don't find either platform legitimate (Better than say, wish[.]com or temu, but not as "legitimate" as other platforms, though I can't think of a single fully legitimate e-commerce platform). Shopee collects a ton of tracking information (Just turn on your adblocked, or inspect your network calls. It's even more than Amazon!), is full of intrusive ads, sketchy deals, and scammers. You yourself said you can easily find cracked versions of the dongle there, which doesn't speak well for the platform. And Lazada is owned by Alibaba Group, which speaks for itself. I'm not sure why consumers in South East Asian regions aren't more outspoken about this, since they seem to be the some of the more popular e-commerce platforms there.
The problem seems the sales model rather than the dongle:
1) a hardware and software solution implies that hardware will stop working at some point. Customers should understand it 2) you could sell them a new dongle every time support contract ends which is what I’ve experienced with Xways as an example. Even if you’re air gapped once a year usage data upload and new dongle seems fine. 3) why should users receive free upgrades and bug fixes? No software is bug free.
Finally there are several brand protection shops that fight fakes and work well with Shopee, Lazada, Facebook etc. It’s not five dollars but they will take these down effectively
Hey, fellow civil-engineering-software designer here! [https://www.anadelta.com/en/anadelta-tessera/] Same story, same problems with dongles, perpetual & subscription licenses.
> Yes, even today there are users who want this kind of dongle instead of, say, cloud-based validation.
Sometimes, there are network interuptions. Then it is the right time to work because youtube isn't available.
> I must say, this copy protection mechanism seems a bit… simplistic? A hardware dongle that just passes back a constant number? Defeatable with a four-byte patch?
Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid.
This was basically the 80s version of that.
[dead]
wow, the home accountant is basically the great-grandfather of everything we do in modern financial and actuarial modeling. dmitry's breakdown is like digital archeology.
it’s wild to think about the hardware risk people used to accept putting your entire household's financial history on a system that bricks itself the second a 40-year-old plastic dongle fails. really great read.
And they probably could've just used Neverlock Business which cracks zillions of programs.
> Is this really worthy of a patent?
You have no idea how deep this rabbit hole goes.
Patents are barely better than copyright, as far as society net-positive.
Was anyone else's first thought to put this through Claude and see what it thought? Who knows if it's in the training data, etc. but I fed in the gist of the raw asm and didn't see any other network requests.
Opus 4.5 did pretty well considering it was raw assembly:
--- This is a classic hardware dongle detection routine for DOS/x86 systems from the 1980s-90s era. Here's what it does:
---Is defeating a 40-year-old copy protection mechanism still illegal under Section 1201 of the DMCA, or have they changed the law to make an exception for "very old" software?
It's illegal.
Once it hits 70 years from the lifetime of the author (so probably another 80 or 90 years from now) and is in public domain, that might change things since there will no longer be copyright being protected.
In terms of copyright terms, this software is still pretty young, not even halfway to public domain. It's disrespectful to call it "very old".
BTW, in the European Union, reverse-engineering is perfectly legal, if it is done to ensure compatibility with the current tech.
I cannot cite the reliable sources for it, though.
So what hardware would be inside the dongle? Would a small PAL be enough? Maybe with a few registers to delay the values written by a few cycles, mixing in some decode logic? (Something cheaper than a microcontroller, I'm guessing... due to cost)
[dead]
I think I remember hacking some of the copy-protection out of a version of Tetris using the Borland debugger. I definitely patched mouse support into a Chris Crawford "Battle of the Bulge" game using it (for my rather tricky platform). That was a good debugger, and probably the last one I have used much - prefer logging/printing for stuff I write myself.
I remember my Dragon 32 (6809, Color Computer clone) had a dongle you plugged into the joystick port to protect a really crap game - Jumping Knights? I never tried to defeat it.
>The only evidence for the existence of this company is this record of them exhibiting their wares at SIGGRAPH conferences in the early 1990s, as well as several patents issued to them, relating to software protection.
There is also their webpage for ordering PC RPG II. The company address is a residential house.
https://web.archive.org/web/20010802153755/http://home.netco...
Apparently there is a Noel Vasquez, now in his late 80s, living at that address. Might be the guy to contact for further information, if he's still around.
Cracking this dongle; wouldn't this be a federal offence in the US?
Not being snarky - genuine question! I am not from the US :-)
It probably is; and so is going 10 over the speed limit.
Yes and in every country that adopted a copyright treaty with the US, so all of them except China
Yeah, Software protection was very naive in the beginning. Fun fact: I owned a windows 3.11 for workgroup UPGRADE disc collection, it was clearly explained and also enforced from the setup installer. So, no previous installed win 3.0 == upgrade installer will fail. The fix: just create an empty Textfile named win.com at any place - the installer simple scans the WHOLE disk just for this existing filename. Next fun fact: in reality, the Upgrade contained the full installation, no only a delta. Men, software was so simple these days....
I have a childhood memory of my dad buying a shrink-wrapped copy of the Windows 3.1 Upgrade that was supposed to allow any installation of "3.0 or earlier" to become Win 3.1. it turned out when we actually tried it it only accepted 3.x though. [1]
I think he ended up pirating a 3.x install from a friend and running the upgrade on to of that; felt pretty morally clear given what the box had advertised.
[1]: eg https://www.ebay.com/itm/376080245422
I designed a security dongle a long time ago ... Used properly, it did rotations and XORs like a CRC. You could definitely make it hard to defeat but it was still ultimately deterministic.
[flagged]
The fact that the software and hardware is evidently still in use at some companies gives me pause about whether releasing it in a cracked form publicly after having published it on a personal website would be a good idea.
Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in!
All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue.
If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.
Another poster found grabs of the company's website on archive.org. The last date it existed to be grabbed was in 2001. I think the OP is fine on this one.
Other than that, there's virtually no mention of the company or software anywhere online. Just to put that in context, I'm in the vintage computer / software community where thousands of amateur historians and archivists scour obscure corners looking for old, unknown software apps to preserve. Software sold for Windows 98 up to 2001 (so recent as to barely be considered 'vintage') with so little online footprint means it must have been incredibly obscure. No ads or reviews from magazines or even newsletters means there's a good chance it was a one or two person part-time, home-based business and the product had hundreds or maybe even just dozens of users.
1998-2001 was the hottest time ever for PC software. I worked in marketing Windows software during this period. To have any commercial Windows software product actively available for sale in the late 90s with no surviving footprint would almost require intentional effort to stay unknown. No press releases mailed. No review copies sent. No shows or conferences attended (exhibitor listings are searchable online now). There were much older niche vertical software programs for much more obscure platforms which we know sold less than a hundred copies ever, yet still have a larger online footprint than this program. The OP de-protecting and archiving this previously unknown commercial program represents quite a notable find in the preservation community.
I was hired in the early 90's by a collection of franchises for a home care company. The privately owned head office self-developed and distributed required monthly updates to the only software franchises were permitted to run their business. The monthly updates (floppies) reset the license for another month at each location. After years of problems, poor support, and in a couple cases offices getting shut down because head office just "didn't like them anymore", they banded together to sue the owners (one of which developed the software). I did IT work for a couple of the offices and was already familiar with maintaining the software / systems. They hired me to bypass the licensing code which was a lot of fun to figure out. In the end I wrote a DOS based license generator each office had that could update their software by just getting a code over the phone for the upcoming month (or any date for 365 days). A few years later once the lawsuit settled and the company broke apart we issued a patch for the software to remove the license check completely. I should fire up DOSBox sometime so I can play with that old software again.
I wrote RPG II code in the 80s and helped the company I was working part-time for transition to another one of these S/36 emulation environments on the PC in the 90s. The software we used was made by the very generically named California Software Products.
It worked well enough and allowed the company to run until the founder retired and folded the business.
I remember reading an ad in one of the 90s PC magazines that attributed the dongle to an inventor named “Don Gull.” I was fortunate enough to never have to use a hardware dongle, but I remember hearing about their persistence into the twenty-first century. I would imagine that most of them were as ridiculously simple as this one was.
These dongles used to be ubiquitous and they broke all the time.
As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared)
Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing.
So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing.
Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home.
Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.
For some reason, Reko was not able to decompile this code into a C representation
That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler.
In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program.
This reminds me of the classic Ken Thompson attack.
Of course it used to be simple in the earlier days. It got way better and fast with HASP and alike in the mid 90’s. I specifically remember software that kept a portion of its data in the dongle memory with good anti-debugging techniques too. But even the hardest protection would take a week to break at most.
Tell that to the crackers who worked for over a year to simulate a social network in order to finally crack the game Red Dead Redemption 2, which had a very custom game protection implemented by Rockstar. Also to this day there is no crack to Diablo 3, famous for being single player but with online verification. You can create very hard to crack protections quite easy if you employ self-modifying code techniques. Do you have any idea how hard is to debug code that overwrites itself in memory and that cannot be patched by modifying the existing code from disk? The reason why this is not more common is because the more iterations you do, the harder is to create those iterations, which means you add a lot of time to create the protection which means that you need to have a finished code, and code is always modified by production team, so managers see this overtime unnecessary.
Out of curiosity googled for Sentinel (which was one of the other dongles back then), seems somebody is now providing a bypass/emulation service: https://sentineldongle.com/ (not affiliated with this, just googled Sentinel like 5 minutes ago and this showed up).
This is circumventing an effective copy protection measure, a federal crime under 17 U.S.C. section 1201. I see the developer is from Boston, so falls under U.S. jurisdiction and thus has committed a felony under U.S. federal law.
…and?
Fun hack, sure, but why on earth isn't the focus on porting the accounting data to a new, currently supported accounting system?
As a hardware guy I would first start with opening up the dongle, but hey! Still very curious to see whats inside!
I always thought the internals were encased in potting compound for these things to prevent exactly this scenario (certainly the ones I had for LightWave back in the day were)...
Yes my first thought would be to probe the parallel lines and see what went in and came out, but this approach was just as interesting!
Tangential to this was the existence of California Software Product's "Baby/36" software. My father was a 36/400 programmer and sysadmin, and in his spare time used Baby/36 to write software for local businesses. I have vague memories of parallel port dongles being involved back then too. Don't think he mandated their use, was more a "framework" requirement.
This is kind of like archaeology - just, software archaeology.
[dead]
Often these dongles were just a single resistor 'circuit'
Like a warded lock. It only keeps honest people honest — and proves intent to not pay.
This reminds me the old days of Windows 95 when I found a software to burn CDs that had a trial version which was limited to 150MB of data or so. If you tried to create a CD bigger than that it would refuse to burn and it would instead open a popup and tell you that the image exceeded the limit of XYZ blocks allowed by the trial version.
So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation.
[0] https://en.wikipedia.org/wiki/Executable_compression
My grandma used to be playing casual games from a certain publisher on her PC. They were all trial versions, though, limited to 30 minutes or so. Turns out, the time left was stored in the registry, and didn’t have any validation – so when a 10 y.o. me made a quick edit, she was left with 4294967295 minutes of trial left.
USB license dongles are still very common in industrial automation, I work for a company that uses it. You don't want an internet outage (or an AWS outage) to take down a production line for a day. You also expect to set up a system once and then have it just work for a decade or so.
In our case, the copy protection would still be as easy to bypass as the one in the article.
You can turn normal USB flash drive into simple dongle if it has readable serial numbers with device id. Easy to bypass but most people don't.
Actual dongles with encryption and processor cost only $15 in batches of 100.
I want to read the rest of the migration story
Just a few months back I worked in embedded development on a project and there was a physical dongle to unlock the compiler, which was surprising during on-boarding as I've spent years doing commercial embedded work relying on GCC. :)
Really interesting read, wonder how many other installs are using (and trapped into continuing to use) such obscure legacy software.
I still develop software requiring hardware dongles. We moved from parallel to USB-A about 15 years ago and we're still on USB-A, much to the annoyance of anyone who has bought a new laptop in recent years.
The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded.
A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.
Its insane this things still works after 40 year old and someone now able to cracked it down
It is interesting that the vendor adapts the hardware token and then makes it weak on the software side.
I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all.
[0] https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/
> If we look at segment 0800, we see the smoking gun: in and out instructions, meaning that the copy-protection routine is definitely here, and best of all, the entire code segment is a mere 0x90 bytes, which suggests that the entire routine should be pretty easy to unravel and understand. For some reason, Reko was not able to decompile this code into a C representation, but it still produced a disassembly, which will work just fine for our purposes. Maybe this was a primitive form of obfuscation from those early days, which is now confusing Reko and preventing it from associating this chunk of code with the rest of the program… who knows.
in/out instructions wouldn't have a C equivalent. My assumption would be it only translates instructions that a C compiler would typically create.
I would still hope for it to translate most of the code with a couple of asm blocks. But maybe the density of them was too high and some heuristic decided against it?
well done. this brought up fond memories of crackme communities in the early web... looking at asm callgraphs in ollydbg ... I just found my +20y old patch.exe that 'NOP's the correct address of a popular windows archive handling software just to get rid of its nag screen ;-)
Today on "Hacker" News: a third of the commenters wring their hands and question the morality and legality of subverting copy protection on software almost half a century old.