/// SafeDisc is an incredibly commonly used copy protection created by Macrovision and C-Dilla in 1998 (https://www.thefreelibrary.com/MACROVISION+ACQUIRES+C-DILLA+CD-ROM+TECHNOLOGIES+DEVELOPER-a055217923).
/// It uses several different copy protection mechanisms, such as reading a disc signature dependent on the presence of bad sectors and the attempted prevention of burning copies to CD-R.
/// SafeDisc has been most commonly found on PC games and applications, though there a number of Mac discs that contain the protection as well.
/// At least one system other than PC/Mac is known to use SafeDisc as well, this being the "ZAPiT Games Game Wave Family Entertainment System" which seems to use a form of SafeDisc 4 (Redump entry 46269).
/// SafeDisc Lite/LT is an alternate version of SafeDisc available that was based on SafeDisc 1 (https://web.archive.org/web/20030421023647/http://www.macrovision.com:80/solutions/software/cdrom/SafeDisc_WhitePaper_4-17-02-web.pdf).
/// Although seemingly only officially referred to as "SafeDisc LT", a multitude of sources, including one that seemingly worked directly with Macrovision, call it "SafeDisc Lite" (http://www.eclipsedata.com/insidepages.asp?pageID=149).
// The .016 and .256 files are banners stored in the BMP image format. The 016 and 256 refers to the color depth of the BMP.
// There are common file names used, such as 00000407.XXX and 00000409.XXX. Further investigation is needed to determine the consistency of these names.
newPathMatch(".016",useEndsWith:true),
newPathMatch(".256",useEndsWith:true),
},"SafeDisc 1.06.000-3.20.024"),
newPathMatchSet(newList<PathMatch>
{
newPathMatch("00000001.TMP",useEndsWith:true),
// The .016 files stop being used as of 4.00.000, while the .256 remain in fairly consistent use.
newPathMatch(".256",useEndsWith:true),
},"SafeDisc 1.06.000+"),
// The file "mcp.dll" is known to only be used in a specific version range for SafeDisc, but is currently only used in a grouped file name check with other SafeDisc files to prevent false positives.
// Found in Redump entries 28810, 30555, 55078, and 62935.
newPathMatchSet(newList<PathMatch>
{
newPathMatch("00000001.TMP",useEndsWith:true),
newPathMatch("drvmgt.dll",useEndsWith:true),
newPathMatch("mcp.dll",useEndsWith:true),
newPathMatch("secdrv.sys",useEndsWith:true),
},"SafeDisc 1.45.011-1.50.020"),
// TODO: Research "splash16.bmp" and "splash256.bmp".
// Found to be present in every version of SafeDisc, possibly every single release.
// Found in many versions of SafeDisc, beginning in 2.05.030 and being used all the way until the final version 4.90.010. It is not always present, even in versions it has been used in. Found in Redump entries 56319 and 72195.
// The SD0XXX.dll files appear to solely contain custom strings that allowed the publisher to customize the SafeDisc error messages. They are currently only known to be used by EA.
// Each file appears to contain strings for a specific language each.
// There is one non EA game that makes reference to "SD0809.dll", but doesn't include it (IA item "rayman.-raving.-rabbids.-hebrew.-dvd").
// TODO: Add a generic check to detect this type of string that appears to be present in all of these DLLs:
// Used to distribute SafeDisc driver updates over the internet. Two distinct versions known to exist, with Microsoft also having distributed the later update as well.
// Version 1: https://web.archive.org/web/20040614184055/http://www.macrovision.com:80/products/safedisc/safedisc.exe
// Version 2: https://web.archive.org/web/20051104123646/http://www.macrovision.com/products/safedisc/safedisc.exe
// Microsoft download page: https://web.archive.org/web/20080204081329/http://www.microsoft.com/downloads/details.aspx?FamilyID=eae20f0f-c41c-44fe-84ce-1df707d7a2e9&DisplayLang=en
// The SD0XXX.dll files appear to solely contain custom strings that allowed the publisher to customize the SafeDisc error messages. They are currently only known to be used by EA.
// Each file appears to contain strings for a specific language each.
// There is one non EA game that makes reference to "SD0809.dll", but doesn't include it (IA item "rayman.-raving.-rabbids.-hebrew.-dvd").
// TODO: Add a generic check to detect this type of string that appears to be present in all of these DLLs:
// Used to distribute SafeDisc driver updates over the internet. Two distinct versions known to exist, with Microsoft also having distributed the later update as well.
// Version 1: https://web.archive.org/web/20040614184055/http://www.macrovision.com:80/products/safedisc/safedisc.exe
// Version 2: https://web.archive.org/web/20051104123646/http://www.macrovision.com/products/safedisc/safedisc.exe
// Microsoft download page: https://web.archive.org/web/20080204081329/http://www.microsoft.com/downloads/details.aspx?FamilyID=eae20f0f-c41c-44fe-84ce-1df707d7a2e9&DisplayLang=en
// The hash of the file CLCD16.dll is able to provide a broad version range that appears to be consistent, but it seems it was rarely updated so these checks are quite broad.
// It is currently unknown why the previous hash covers both the version before this one, and several afterwards, with this one being a consistent outlier between these versions.
// The hash of the file CLCD32.dll so far appears to be a solid indicator of version for versions it was used with. It appears to have been updated with every release, unlike its counterpart, CLCD16.dll.
// Versions of "CLOKSPL.EXE" before SafeDisc 1.06.000 (can be identified by the presence of "SafeDisc CDROM Protection System" as the Product Name) have a human readable Product Version.
// This included version doesn't seem to be as accurate as hash checks are, but will be documented here and considered for future use if needed.
// File size of "dplayerx.dll" and others is a commonly used indicator of SafeDisc version, though it has been found to not be completely consistent.
// Checks for versions 1.2X have been commented out, due to these versions already being detected via more accurate checks.
// Examples of "dplayerx.dll" that are detected using these more accurate checks can be found in Redump entries 28810, 30121, and 37982.
// Found in Redump entry 34828.
case81_408:
return"1.00.026 (pre-10/1998)";
// Found in Redump entries 21154, 41923, 42114, and 66005.
case78_848:
return"1.00.025-1.00.032";
// Found in Redump entries 36223 and 40771.
case77_824:
return"1.00.035";
// Found in Redump entries 42155 and 47574.
case115_712:
return"1.01.034";
// Found in Redump entry 42155.
case116_736:
return"1.01.038";
// Found in Redump entries 34562 and 63304.
case124_416:
return"1.01.043";
// Found in Redump entries 61731 and 81619.
case125_952:
return"1.01.044";
// Found in Redump entries 29073 and 31149.
case155_648:
return"1.06.000";
// Found in Redump entries 9718, 12885, and 37523.
case156_160:
return"1.07.000-1.11.000";
// File size checks for versions 1.2X+ are superceded by executable string checks, which are more accurate. For reference, the previously used file sizes are kept as comments.
// 157,184 bytes corresponds to SafeDisc 1.20.000-1.20.001 (Redump entries 21154 and 37920).
// 163,382 bytes corresponds to SafeDisc 1.30.010 (Redump entries 31526 and 55080).
// 165,888 bytes corresponds to SafeDisc 1.35.000 (Redump entries 9617 and 49552).
// 172,544 bytes corresponds to SafeDisc 1.40.004 (Redump entries 2595 and 30121).
// 173,568 bytes corresponds to SafeDisc 1.41.000-1.41.001 (Redump entries 37832, and 44350).
// 136,704 bytes corresponds to SafeDisc 1.45.011 (Redump entries 30555 and 55078).
// 138,752 bytes corresponds to SafeDisc 1.50.020 (Redump entries 28810 and 62935).
// The file "drvmgt.dll" has been found to be incredibly consistent between versions, with the vast majority of files based on hash corresponding 1:1 with the SafeDisc version used according to the EXE.
// There are occasionaly inconsistencies, even within the well detected version range. This seems to me to mostly happen with later (3.20+) games, and seems to me to be an example of the SafeDisc distribution becoming more disorganized with time.
// Particularly interesting inconsistencies will be noted below:
// Redump entry 73786 has an EXE with a scrubbed version, a DIAG.exe with a version of 4.60.000, and a copy of drvmgt.dll belonging to version 3.10.020. This seems like an accidental(?) distribution of older drivers, as this game was released 3 years after the use of 3.10.020.
// Found in Redump entries 38541 and 59462 and 81096.
case"0AB8330A33E188A29E8CE1EA9625AA5935D7E8CE":
return"2.10.030";
// Found in Redump entries 55823 and 79476.
case"5198DA51184CA9F3A8096C6136F645B454A85F6C":
return"2.30.030";
// Found in Redump entries 15312 and 48863.
case"414CAC2BE3D9BE73796D51A15076A5A323ABBF2C":
return"2.30.031";
// Found in Redump entries 9819 and 53658.
case"126DCA2317DA291CBDE13A91B3FE47BA4719446A":
return"2.30.033";
// Found in Redump entries 9846 and 65642.
case"1437C8C149917C76F741C6DBEE6B6B0CC0664F13":
return"2.40.010";
// Found in Redump entries 23786 and 37478.
case"10FAD492991C251C9C9394A2B746C1BF48A18173":
return"2.40.011";
// Found in Redump entries 30022 and 75014.
case"94267BB97C418A6AA22C1354E38136F889EB0B6A":
return"2.51.020";
// Found in Redump entries 31666 and 66852.
case"27D5E7F7EEE1F22EBDAA903A9E58A7FDB50EF82C":
return"2.51.021";
// Found in Redump entries 2064 and 47047.
case"F346F4D0CAB4775041AD692A6A49C47D34D46571":
return"2.60.052";
// Found in Redump entries 13048 and 35385.
case"88C7AA6E91C9BA5F2023318048E3C3571088776F":
return"2.70.030";
// Found in Redump entries 48101 and 64198.
case"544EE77889092129E9818B5086E19197E5771C7F":
return"2.72.000";
// Found in Redump entries 32783 and 72743.
case"EA6E24B1F306391CD78A1E7C2F2C0C31828EF004":
return"2.80.010";
// Found in Redump entries 39273 and 59351.
case"1BF885FDEF8A1824C34C10E2729AD133F70E1516":
return"2.80.011";
// Found in Redump entries 11638, 52606, and 62505.
case"B824ED257946EEE93F438B25C855E9DDE7A3671A":
return"2.90.010-2.90.040";
// Found in Redump entries 13230 and 68204.
case"CDA56FD150C9E9A19D7AF484621352122431F029":
return"3.10.020";
// Found in Redump entries 36511 and 74338.
case"E5504C4C31561D38C1F626C851A8D06212EA13E0":
return"3.15.010";
// Found in Redump entries 15383 and 35512.
case"AABA7B3EF08E80BC55282DA3C3B7AA598379D385":
return"3.15.011";
// Found in Redump entries 58625, 75782, and 84586.
// The presence of any drvmgt.dll file at all is notably missing in several games with SafeDisc versions 3.20.020-3.20.024, including Redump entries 20729, 30404, and 56748.
// TODO: Further investigate versions 3.20.020-3.20.024, and verify that 3.20.024 doesn't use drvmgt.dll at all.
// Found in Redump entries 15614, 79729, 83408, and 86196.
// The presence of any drvmgt.dll file at all is notably missing in several games with SafeDisc versions 4.00.001-4.00.003, including Redump entries 33326, 51597, and 67927.
case"E21FF43C2E663264D6CB11FBBC31EB1DCEE42B1A":
return"4.00.000-4.00.003";
// Found in Redump entry 49677.
case"7C5AB9BDF965B70E60B99086519327168F43F362":
return"4.00.002";
// Found in Redump entries 46765 and 78980.
case"A5247EC0EC50B8F470C93BF23E3F2514C402D5AD":
return"4.00.002+";
// Found in Redump entries 74564 and 80776.
// The presence of any drvmgt.dll file at all is notably missing in several games with SafeDisc versions 4.50.000, including Redump entries 58990 and 65569.
// Found distributed in https://web.archive.org/web/20040614184055/http://www.macrovision.com:80/products/safedisc/safedisc.exe and https://web.archive.org/web/20010707163339/http://www.macrovision.com:80/demos/safedisc.exe, but unknown what version it is associated with.
return"Unknown Version (Report this to us on GitHub)";
default:
return"Unknown Version (Report this to us on GitHub)";
// File size of drvmgt.dll and others is a commonly used indicator of SafeDisc version, though it has been found to not be completely consistent, and is completely replaced by hash checks.
// 34,816 bytes corresponds to SafeDisc 1.0x
// 32,256 bytes corresponds to SafeDisc 1.1x-1.3x
// 31,744 bytes corresponds to SafeDisc 1.4x
// 34,304 bytes corresponds to SafeDisc 1.5x-2.40
// 35,840 bytes corresponds to SafeDisc 2.51-2.60
// 40,960 bytes corresponds to SafeDisc 2.70
// 23,552 bytes corresponds to SafeDisc 2.80
// 41,472 bytes corresponds to SafeDisc 2.90-3.10
// 24,064 bytes corresponds to SafeDisc 3.15-3.20;
