First, this was a decade and a half ago. SHA was slow, open source SHA implementations were rare at the time, crypto had a stigma due to export restrictions, and was generally problematic to work with due to limited hardware support and speed.
Second, several different implementations were needed and they needed to be different enough that a simple pattern search would not find them all. SHA implementations LOOK a lot like SHA implementations in the disassembly, and it's hard to modify them in a way that leaves them functional but different enough that the compiler doesn't optimize away differences. A CRC is simple enough that you can do things like that.
Third, these things were all over the code, and run frequently. They couldn't just set a global flag and be done with it. They had to be fast. I am not sure, but I think the Playstation had hardware CRC support, but no hardware SHA support.
It's amazing that we now live in a world where you wouldn't think twice about using a cryptographically secure algorithm for data you don't actually need to hide (just obfuscate for a month or two) and not have any concern about performance.
I deleted it before I saw there were responses, because I mistakenly assumed this article was relatively recent (I mean, retro look is a thing in video games, right?). I had no idea it was from 2001 until the "(2001)" was added after it was first posted (I'm not a gamer at all). Sorry for the confusion, about 5 people responded at the same time right as I was deleting it (didn't know the comments were incoming).
2001 obviously makes a big difference. I'll pay more attention to dates now.
That said, I don't understand why you wrote "data you don't actually need to hide". Wasn't that the point? I mean, holding off cracks for a month or two was good, but wouldn't holding them off for years be ideal?
And yes (I can't tell if you're being disdainful or honestly amazed) but we do now live in a world when you don't have to worry about performance implications of using SHA in all but the most resource constrained environments (and even then, SHA hardware acceleration is often available).
But you make some other good points I had not considered.
I am honestly amazed by modern technology, and I have to keep reminding myself how cool everything is compared to just a decade back.
The article says October 17th, 2001, right at the start, and throughout the first page they speak of the development period informed by data accurate as of December 2000. The "ten seconds exclusive access to the CD" speaks for itself though.
And given the state of the game market (as described in the article) the difference in terms of revenue between a couple months and forever is minimal. The attention spans of the cracker groups, the peaks in revenue, and the peaks in interest (which drives both revenue and piracy) all have a very strong bias to new games. The primary stated objective of this hack was to prevent pirated copies of the US version from cannibalizing sales of the EU version (which presumably was delayed due to translation work). It's data that's distributed to thousands of machines worldwide, not something you want to keep desperately secret.
The article says October 17th, 2001, right at the start, and throughout the first page they speak of the development period informed by data accurate as of December 2000. The "ten seconds exclusive access to the CD" speaks for itself though.
Yes, and once again, I vow to pay better attention to dates and context. I already sincerely apologized. I was reading an article on anti-cracking, so that was the part I was concentrating on. And usually, I filter dates out when I read because the difference between a technical article published in 2012 and 2013 is fairly minimal (while the difference between 2014 and 2001 is pretty massive, which is why HN requires old articles to include the year). But clearly, this filter has caused both me and all the commenters unneeded grief, so I'll turn my date filter off.
And given the state of the game market (as described in the article) the difference in terms of revenue between a couple months and forever is minimal.
Fair enough. I'm not a gamer and don't claim to know much about gaming.
The key thing is that the choice of crypto algorithm makes no difference because that's not the route of the crack. The cracked version would remove the SHA check entirely.
Comments
I can think of a few reasons:
First, this was a decade and a half ago. SHA was slow, open source SHA implementations were rare at the time, crypto had a stigma due to export restrictions, and was generally problematic to work with due to limited hardware support and speed.
Second, several different implementations were needed and they needed to be different enough that a simple pattern search would not find them all. SHA implementations LOOK a lot like SHA implementations in the disassembly, and it's hard to modify them in a way that leaves them functional but different enough that the compiler doesn't optimize away differences. A CRC is simple enough that you can do things like that.
Third, these things were all over the code, and run frequently. They couldn't just set a global flag and be done with it. They had to be fast. I am not sure, but I think the Playstation had hardware CRC support, but no hardware SHA support.
It's amazing that we now live in a world where you wouldn't think twice about using a cryptographically secure algorithm for data you don't actually need to hide (just obfuscate for a month or two) and not have any concern about performance.
Incidentally, if you're interested in an application of essentially every known antidebugging and antimodification technique known at the time in the same binary, have a look at https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06...
I deleted it before I saw there were responses, because I mistakenly assumed this article was relatively recent (I mean, retro look is a thing in video games, right?). I had no idea it was from 2001 until the "(2001)" was added after it was first posted (I'm not a gamer at all). Sorry for the confusion, about 5 people responded at the same time right as I was deleting it (didn't know the comments were incoming).
2001 obviously makes a big difference. I'll pay more attention to dates now.
That said, I don't understand why you wrote "data you don't actually need to hide". Wasn't that the point? I mean, holding off cracks for a month or two was good, but wouldn't holding them off for years be ideal?
And yes (I can't tell if you're being disdainful or honestly amazed) but we do now live in a world when you don't have to worry about performance implications of using SHA in all but the most resource constrained environments (and even then, SHA hardware acceleration is often available).
But you make some other good points I had not considered.
I am honestly amazed by modern technology, and I have to keep reminding myself how cool everything is compared to just a decade back.
The article says October 17th, 2001, right at the start, and throughout the first page they speak of the development period informed by data accurate as of December 2000. The "ten seconds exclusive access to the CD" speaks for itself though.
And given the state of the game market (as described in the article) the difference in terms of revenue between a couple months and forever is minimal. The attention spans of the cracker groups, the peaks in revenue, and the peaks in interest (which drives both revenue and piracy) all have a very strong bias to new games. The primary stated objective of this hack was to prevent pirated copies of the US version from cannibalizing sales of the EU version (which presumably was delayed due to translation work). It's data that's distributed to thousands of machines worldwide, not something you want to keep desperately secret.
Yes, and once again, I vow to pay better attention to dates and context. I already sincerely apologized. I was reading an article on anti-cracking, so that was the part I was concentrating on. And usually, I filter dates out when I read because the difference between a technical article published in 2012 and 2013 is fairly minimal (while the difference between 2014 and 2001 is pretty massive, which is why HN requires old articles to include the year). But clearly, this filter has caused both me and all the commenters unneeded grief, so I'll turn my date filter off.
Fair enough. I'm not a gamer and don't claim to know much about gaming.
The key thing is that the choice of crypto algorithm makes no difference because that's not the route of the crack. The cracked version would remove the SHA check entirely.