Starforce enforces DRM by instant reboot (without warning)
Posted on 21/03/06 00:00 by Seán Byrne                             
Starforce enforces DRM by instant reboot (without warning)

Despite all the problems DRM has been causing lately, it seems like companies involved in copy protection just keep trying to create more dangerous copy protections.  Originally, they were more of a nuisance causing compatibility issues, installing wanted software, etc.  Next came Sony Rootkits which used cloaking to hide its DRM processes and files, but with the side affect of being able to cloak spyware & viruses, thus causing a serious security risk.  More recently, the Settec Alpha-DVD protection has been reported to cause DVD writers to malfunction.

Now, Futuremark* has uncovered a very dangerous anti-piracy system Starforce is now using.  This copy protection system installs a driver that runs at the highest level of access on the system, which gives it low level access to the PCs hardware and any drivers and processes.  This driver runs regardless of whether the game runs; keeping an eye out for any suspicious activity such as attempting to copy a protected disc.  If something suspicious is detected, it forces the PC to make an immediate reboot, regardless of any other applications running and whether or not the user has any unsaved work.

To make matters worse, this copy protection interferes with DPM readings from software that is designed to allow the playback of copied game discs, which means that any game backups that rely on this Data Protection Manager will no longer play with the Starforce protection driver in place.  Finally, as the Starforce protection has been found to interfere with certain device drivers, some drivers will run in legacy PIO mode instead of DMA, which not only slows down the PC by hogging CPU resources, but also slows down the data transfer to the affected hardware.

This latest identified threat by Futuremark* is one that relates to a driver being installed on your computer that gains RING0 access (the highest level of access to your computer). The installation requires Administrator level access to install the driver, which runs all of the time regardless of whether or not you're playing a game with Starforce DRM.

With such a high level of processor access (sharing the same levels the operating system enjoys), the Starforce driver can do anything to your computer at any time. This very ability is demonstrated, since the Starforce driver will force a reboot (not a shutdown) when it thinks it has discovered suspicious activity related to copying. The reboot occurs instantly, and any and all unsaved data could be lost.

With the reported side effects of this copy protection system, this is one thing I would not trust on any system.  For example, if one wanted to make a copy of a disc and didn't realise they had a Starforce protected game in their DVD-ROM drive, their PC is rebooted without even being given a chance to save any work!  Worse still, this is likely to give some people a major headache trying to figure out why one or more of their device drivers are acting up, certain hardware cause the PC to run sluggish when used and so on.  However, for those who get affected or lose several hours of unsaved work due to an unexpected reboot, chances are that they are not going to get any compensation or sympathy from Starforce or the game publishers using the copy protection.

* Update:  According to a news post by Futuremark, apparently they have not carried out any research or uncovered anything relating to StarForce, however this discovery was made by users who posted about this on their public discussion boards.

Feel free to discuss about CD/DVD copy protection measures on our forum.

Source: Geek.com

Reactions
Discuss this article with your fellow community members! We appreciate your valuable input, but please keep the reaction policy in mind and make sure your reaction is constructive.
By Dutchman01, Tuesday 21 March 2006 00:07
I think that that stuf should be illegal. I'ts a shame that they take over your pc and reboot without your knowledge.
By Wischmop, Tuesday 21 March 2006 00:08
This is awful. puke PPL, don´t buy any starforce-protected products
By hajj_3, Tuesday 21 March 2006 00:29
die starforce, hope you are sued soon!!!
By Warzer, Tuesday 21 March 2006 00:42
What games are these expected to be in? I will make it a point not to purchase them. This is OVER THE LINE. This Should defiantly require its own separate Agreement and Be printed all over the game box as to warn consumers just as if it contained adult content. I have had viruses that were less malice.
By Crabbyappleton, Tuesday 21 March 2006 00:42
CrabbyappletonHere is a listing of StarForce protected games that is frequently updated from the Boycott StarForce Website. The best thing is to boycott these products until it is safe to use them again. Frown
By XStylus, Tuesday 21 March 2006 01:27
Anti-spyware programs should start sniffing against garbage such as this.
By tylau, Tuesday 21 March 2006 02:40
tylauProtecting one's intel-right doe not mean they can do anything on a system they do not own; SF should be sued for whatever damage they did!
By DJ Specs, Tuesday 21 March 2006 03:34
I gave up buying and playing games.. its too much hassle and BS. This should be illegal. Someone needs to take a bat to the head of these fools.
By Baba, Tuesday 21 March 2006 08:17
simple...boycott. in my eyes, gaming companies would be foolish to use this protection.
By dvdfaetter, Tuesday 21 March 2006 10:04
This could explain what I experienced a couple of days ago: After using a partition manager to merge two harddrive partitions (C/D) to one (C) and changed the driveletters of my two dvd-drives from E/F to D/E, my pc rebooted without warning when I tried to start a Starforce protected game (Colin Mcrae Rally 2005 - dvd bestseller edition). When my system came up again Windows reported a serious malfunction in my system. When I tried to startup the game again it requested the cd-key and the game then started properly. I have now decited to uninstall the two games I own with embeded starforce mal-ware (Colin Mcrae Rally and Peter Jacksons King Kong) Frown
By Jim Kiler, Tuesday 21 March 2006 15:48
i hope the EFF will sue, we should contact our state Attorney Generals as this is spyware just like Sony.
By kostorwan, Tuesday 21 March 2006 17:00
kostorwanStarForce Not Investigated by Futuremark
url tags inserted
[edited by H3rB3i on 21.03.2006 17:46]
By agomes, Tuesday 21 March 2006 17:25
Brave guys, nobody can say they haven't got the courage to defend their interest$$$$$!!!! And about us?...Do you think we are entitled to decide something about what happens inside our machines? It comes a guy...and destroy you drive; Afterwards, another reboots you computer, not because you are using something belonging to him but because he decided to install a piece of spy software that assumes you are going to do someting its master doesn't allow...and you unsaved work goest down the hole... Another one decides to modify your firmware, changing you hardware behaviour...or to install some dlls that will conflict with some other application you use...now better to say "used to use"... What a nice and fair world...by the way, is today's date the 30th of December 1983? Can't wait to see the Big Brother coming on the 1st of January!!!!
By megatron, Wednesday 22 March 2006 02:13
Not sure what 1983 has to do with things or big brother for that matter. I can catagorically state that I would not buy a starforce protected game. Software companies have to learn that consumers will vote with their feet, if they dont like something about a game. Consumers will not support them in future.
By BitRate, Wednesday 22 March 2006 02:55
This is worse than the Sony rootkit and is basically an act of terrorism on a users PC. Having a low-level device driver installed and running on a user's PC without their knowledge is downright dangerous. This Starforce mob should definitely be sued for this.
By Dutchman01, Wednesday 22 March 2006 08:52
I'm not going to buy game's withe a protection like this ever. that's clear for me.
By cynicalbastard, Wednesday 22 March 2006 11:07
Starforce just keeps digging their own hole. Gotta love it.
By the voelk, Wednesday 22 March 2006 12:02
Megatron, he's talking about George Orwell's book "1984" and how close we are getting to a society described in that book. Good reading, honestly.
By Lord KiRon, Wednesday 22 March 2006 15:25
THEY REMOVED STARFORCE REMOVAL KIT FROM THEIR SITE !!!!
By Dick Rivett, Wednesday 22 March 2006 16:18
Couldn't they be held liable for loss of data or even data corruption? You ever notice that little warning windows gives you when you don't shut down properly? If they are doing it on purpose without our permission...... If you want a game that has starforce, go ahead and buy it, but don't install it until gamecopyworld. com has a no cd patch that bypasses it. Take that starf*ck
By plextdude1234, Wednesday 22 March 2006 17:45
Man, its MORE like Dec 31, 1983 11: 59pm!!
[edited by plextdude1234 on 22.03.2006 17:47]
By Icy Mt., Wednesday 22 March 2006 17:56
Icy Mt.Did anyone look at the Starforce protected game list? Who would want any of those games anyway? Not buying a starforce game is an easy sell. The game makers should be forced to list the copy protection scheme on the box with the "minimum requirements" so that we can make informed decisions.
By KickF, Wednesday 22 March 2006 18:05
KickFHey in may places in EU you have a right that alow you to backup you Game_CD/DVDs .... So ... We`ll simply just SUE them if they don`t alllow uf to do that. 1MILLION USD here we come clown
By sage386, Wednesday 22 March 2006 18:55
That so called 'research' is a nonsense. SF doesn\'t watch over other processes/user actions. It also has absolutelly no intention to reboot one\'s PC. All this seems to me as just another black propaganda. PS. Yes, i\'m from SF dev team.
[edited by sage386 on 22.03.2006 18:56]
[edited by sage386 on 22.03.2006 18:57]
By Lord KiRon, Wednesday 22 March 2006 21:02
NOW , what black people has to do with it ? Aperently you are not only behaving like natzis but you natzis !
By sonyman, Wednesday 22 March 2006 22:33
Not to defend sage386, but if you're going to call him out at least check your spelling!
By sage386, Thursday 23 March 2006 14:17
@Lord KiRon: fyi black propaganda = black PR
[edited by sage386 on 23.03.2006 14:19]
By temix, Monday 15 May 2006 12:50
I have different problem. When i install Prince of persian (Starforce) and my wife likes to play The sims 2 (Safedisk4). The sims crash until i uninstall princeofpersian. Then it works fine. So if you are SF dev team member why you dont have tested how they work with different protection.
By ME (guest), Saturday 17 March 2007 16:34
Ohnestly starforce is absoultley crap. I had to run X3 Reunion at all low graphic settings and i have a killer card. THen i found out how to remove it and now i can run it WITH ALL SETTINGS ON HIGH AND NO LAG AT ALL. Before i rmoved it i got like 2fps and now im getting 50
By Viruz565 (guest), Sunday 03 June 2007 22:51
Well i will never buy a game with starforce thats for sure! Starforce=Virus hope anti-virus software will treat it as that. Especially since game developers doesnt mention that the game your about to buy comes with starforce. Piracy or no piracy, starforce should be sued and terminated.... Boycott starforce games! Dont buy any of the games listed--> hxxp://www.glop.org/starforce/list.php] devil
By lulxors (guest), Tuesday 14 August 2007 23:50
for all people that wanna know what games that use sf and how to detect/remove it find crabappleton's post he has some links
By Crazyguy1990 (guest), Monday 10 September 2007 08:55
puke I installed trackmania nations (which is free to download from the official website), it installed starforce...puke my C: drive used to have 12 gb of free space.... down to 6 for no reason! Yet I installed the game on my D: drive.... hmmmm.... Stupid SUCKFORCE!!! puke Frown
By anand (guest), Tuesday 02 October 2007 18:55
this star protection shit has entered my system cry , i dont know how. but now wot should i do. Please help me. and i am with u guys against this suckforce or starfuck whichever sounds good. devil
By kayden (guest), Tuesday 06 November 2007 01:49
Well if you can get sued in the states for sneezing on someone and they win then i am sure that you could win for them causing system failure with it is intentional because the program is told to do that
By shaolin007, Monday 03 December 2007 19:52
shaolin007First off, the definition of a computer virus. "A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. " I think there might be a legal case here against these people. It is time to make an example and show that this is unacceptable. Being a assembly language programmer who has done some low level programming, it is really scary that this program has Ring 0 access. Having this kind of access to the processor gives you everything at your command which could include doing some nasty things. I would highly advise against installing ANY game that might install this driver. I am sure some malicious programmer is already scheming how he could use this to his advantage!
Name: Email:


Your comment:

Receive notification on new comments?