Microsoft’s original DRM scheme for the Marketplace was not particularly strong – it lived on the premise that nobody would find a way to access the CAB files used for installing the applications.
As it was broken almost instantly, Microsoft felt itself pressured to push developers towards its “advanced” protection. Unfortunately, it didn’t turn out to be much stronger:
I have now cracked the “advanced” copy protection used by Marketplace. As you may know, this is a “better” protection than the original “CAB copy protection” Marketplace offered. This “advanced” protection uses license keys that are verified when you run the application, and given out and controlled by Microsoft.
Several developers are annoyed that Microsoft does not allow us to use our own licensing schemes, and are forced to use “no protection” (the original CAB copy protection) or use Microsoft’s scheme which is essentially a single point of failure for all Marketplace protected apps.
This new “advanced” protection was released today by Microsoft, and as far as I know no app available already uses it at the time of this writing.
So I got the code snippets you are supposed to put in your app and it was simply jawdroppingly WTF. While it was not exactly easy to beat, it took me less than two hours to devise a “generic” hack, without modifying any files on the device. (Well hey, at least it’s better than the 5 minutes it took for the “basic” protection, right?)
A “generic” hack? Yes, by this I mean that this single hack (actually, running an EXE in the background) will completely bypass the entire code snippet provided by Microsoft that is supposed to check and validate your license code, for all Marketplace apps that use this “advanced” protection.
I will not publish the code that performs this hack, so don’t ask. My goal is not to crack Marketplace apps, my goal is to get MS off their ass and allow us to use our own licensing systems, like the good little resellers they’re supposed to be. I will tell you that it has to do with runtime patching the crypto API, but that’s it. All in all, I don’t think it will take long for the warez people to duplicate this hack.
Even though I salute Chainfire on his achievements, I think that he draws the wrong conclusions and/or requests from his experiences. If Microsoft would allow developers to run their own encrpytion / DRM schemes, the whole idea of the Marketplace is put ad absurdum – keep in mind that the Marketplace was devised to make purchases easy in the first place.
However, I assume that Microsoft is aware of what’s going on – let’s see whether they respond to my email asking for further statements…