Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Process Explorer
  New Posts New Posts RSS Feed: Fix for SecuROM bug
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Fix for SecuROM bug
 Post Reply Post Reply Page  <123
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Online Status: Offline
Posts: 4753 		Post Options Post Options   Quote EP_X0FF Quote  Post ReplyReply Direct Link To This Post Topic: Fix for SecuROM bug
    Posted: 18 June 2007 at 8:09pm
Process Explorer doesn't installs any kernel mode interceptors and it is absolutely unknown why its not unloading its driver at exit.

However everything is not safe, including driver loading in the first. So I can't agree with such statements. The same Blue Screen can happened when you installing hooks by the same criteria.


Edited by EP_X0FF - 18 June 2007 at 8:10pm
Ring0 - the source of inspiration
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 18 June 2007 at 1:39pm
I have no Idea what the difference is between them.
Hence the clown, thought you'd get a smile out of it. Smile 
 
Drivers can be unloaded.  However...
Originally posted by Mark

It is never safe to unload a driver that patches the system call table since some thread might be just about to execute the first instruction of a hooked function when the driver unloads; if that happens the thread will jump into invalid memory. There’s no way for a driver to protect against this occurrence, but the Aries driver supports unloading and tries to keep track of whether any threads are executing its code. The programmer failed to consider the race condition I’ve described.
 
 
Daily affirmation:
net helpmsg 4006
Back to Top
Matts_User_Name View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 August 2006
Location: USA
Online Status: Offline
Posts: 675 		Post Options Post Options   Quote Matts_User_Name Quote  Post ReplyReply Direct Link To This Post Posted: 18 June 2007 at 1:30pm
@ molotov
 
Hmm well I guess you can tell im a noobie to anything with C since I have no Idea what the difference is between them. haha.
 
All I know is that I wana learn C since it seems way more flexible than VB from all the varied source codes around the net.
 
@ EP_X0FF
Hmm yes that would be nice, but didn't we have like a big topic before about how it is very unsafe to unload drivers, and in truth, is there really a way to do it? I have never seen an API function for that really.


My PE Fix - Run On Startup
Back to Top
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Online Status: Offline
Posts: 4753 		Post Options Post Options   Quote EP_X0FF Quote  Post ReplyReply Direct Link To This Post Posted: 18 June 2007 at 9:15am
Originally posted by Matts_User_Name

Question, isn't this a method that is used in rootkits?


No, actually, real rootkits don't need symbolic links and they do not create them.

@throx

Really nice.

But I hope that Mark will add in PE ability to unload driver at exit, and  SecuROM will understand that their "ban list" can't prevent crackers and hax0rs from subverting their so-called defense.
Ring0 - the source of inspiration
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 18 June 2007 at 8:36am
It will come in handy for learning some C++ in the near future
Actually, the source for HidePE is in C... Clown


Edited by molotov - 18 June 2007 at 8:36am
Daily affirmation:
net helpmsg 4006
Back to Top
Matts_User_Name View Drop Down
Senior Member
Senior Member
Avatar

Joined: 10 August 2006
Location: USA
Online Status: Offline
Posts: 675 		Post Options Post Options   Quote Matts_User_Name Quote  Post ReplyReply Direct Link To This Post Posted: 18 June 2007 at 8:32am

Ah, Very nice work. I see it basically "Hides" the driver from displaying causing SecuROM to go blow =].

 
Thanks for this.
 
Question, isn't this a method that is used in rootkits? I think I recall something similar in the fu Rootkit. which I was gonna use to bypass the C&C Loader. Although I never got a chance to test it since I found a No DVD Patch for the game which bypasses the loader.
 
But this is still very valuable. Ill prolly test it out when I encounter another game with SecuROM loaded as a protection.
 
BTW thanks for including the source. It will come in handy for learning some C++ in the near future.


My PE Fix - Run On Startup
Back to Top
throx View Drop Down
Newbie
Newbie


Joined: 11 December 2006
Location: United States
Online Status: Offline
Posts: 23 		Post Options Post Options   Quote throx Quote  Post ReplyReply Direct Link To This Post Posted: 15 June 2007 at 1:00pm
I consider the fact that SecuROM doesn't allow you to run an app even after PE has closed a simple bug in their detection algorithm.  Here's a workaround (binary and source included):

http://www.chase.net.au/HidePE100.zip

Note - there's code there to specifically prevent you from running PE at the same time so this *isn't* a circumvention of their protection.  If they don't want PE running, fine, just don't make us reboot to run apps when we may well have long running background tasks on our workstations.

If you think this is a bad idea to post, please remove it.  Just wanted to share something that will relieve a bunch of my frustration with not wanting to reboot for a quick 15 minute game between working.

The simple rundown on how it works is pretty obvious - it just creates an empty DACL and applies it to the PROCEXP100 symlink in the object manager.  When the app is done, it just resets the DACL to the original value.  I included a "reset" switch as well just in case something happens and you need to reset it manually.

Hope that helps some folks out there.


Edited by throx - 15 June 2007 at 1:01pm
Back to Top
 Post Reply Post Reply Page  <123

Forum Jump Forum Permissions View Drop Down