As a young intern, I arrived early one morning to find the PCB layout software (PADS PowerPCB) on our "design PC" wasn’t working. (I use quotes because it was just the beefiest machine we had, naturally our boss’s PC, which he kindly shared)

Obviously the dongle. I tried unplugging and replugging it, with and without the printer daisy-chained. Nothing.

So I begrudgingly asked my colleague who’d just arrived. He looked at the dongle, looked at me, looked at the dongle again, and started laughing.

Turns out our Boss had stayed late the previous night processing customer complaints. One customer had sent back a "broken" dongle for the product we were selling. Boss tested it on his PC, found it worked fine, and mailed it back on his way home.

Except he didn’t send our dongle back. He had sent my PowerPCB dongle. More fun was had when the rest of the team and finally our boss arrived. Luckily he took it with good humor.

So I first decompressed the executable program (Windows executable were often packed at that time [0]), then I opened a binary editor, looked for that specific number in hexadecimal notation in the binary and changed to something much higher. I was than able to burn CDs without limitation.

[0] https://en.wikipedia.org/wiki/Executable_compression

Since we sold (and still sell) perpetual licenses, it becomes a problem when a dongle breaks and replacement parts are no longer available. Not all users want to upgrade. Also, you may hate cloud licensing, but it is precisely cloud licensing that makes subscriptions possible and, therefore, recurring revenue—which, from a business point of view, is especially important in a field where regulations do not change very fast, because users have little incentive to upgrade.

Also, despite investing a lot of effort into programming the dongle, we can still usually find cracked versions floating online, even on legitimate platforms like Shopee or Lazada. You might think cracking dongles is fun and copy protection is evil, but without protection, our livelihood is affected. It’s not as if we have the legal resources to pursue pirates.

[0]: https://mes100.com

Seems like it was an appropriate amount of engineering. Looks like this took between an afternoon and a week with the help of an emulator and decompiler. Imagine trying to do this back then without those tools.

Perhaps an indication that the code in that segment was hand-written in assembly language rather than C?

The code decrypted itself, which confused debuggers, and then loaded a special sector from disk. It was a small sector buried in the payload of a larger sector, so the track was too big to copy with standard tools. The data in the sector was just the start address of the program. My fix was to change executable header to point to the correct start address.

The crack is a little bit harder these days as there is a special compiler that encrypts the binary using an on-dongle key, decrypting it after it's loaded.

A big reason for the dongle is to regionally control features (e.g. users in country A must not have feature X but users in country B should) and able to "expire" offline desktop software.

They should be glad the copy protection is not more in the style of "The Games: Winter Challenge", where playing a pirated copy would make it subtly impossible to play many levels [1]. Would be 'fun' if the exported accounting data would contain all kinds of subtle errors.

[1] https://mrwint.github.io/winter/writeup/writeup.html

> It required an input key that was unique to our dongle series & our own code that was whatever we wanted. The reply was a hash of both values.

> The last version we used was USB. They retired the parallel style long ago.

Wrong! To my great surprise Linux wouldn't load, even after trying three different versions of Linux. After doing a massive search on the internet, I finally found a post that said I should crack open the case and remove the Optane chip, which I did. Presto, Linux was loaded and working fine!

In our case, the copy protection would still be as easy to bypass as the one in the article.

That's likely because it's one of those (of which many existed) which attempt to dumbly pattern-match against what a typical C compiler of the time (with equally dumb and extremely inefficient code generation) would do, but that routine clearly looks like handwritten Asm. I've never seen a C compiler from that era generate a LOOP instruction, for example, and of course "cli" nor the I/O instructions are not expressable except perhaps as intrinsics. Ghidra might be a bit better at this, as it's a generalised decompiler.

In fact, when the compiler (RPGC.EXE) compiles some RPG source code, it seems to copy the parallel port routine from itself into the compiled program.

This reminds me of the classic Ken Thompson attack.

Software companies love to milk enterprises for all their worth, because they're the entities who will pay the most amount of money if it means that the software they use can still work - and a big part of how they do this is via vendor lock-in. We can see in this article that this company was still using Windows 98 - they're clearly locked-in!

All of which is to say that this intellectual property might actually still be owned by a company who'll be able to sue.

If you haven't already checked whether the patent and other intellectual property is still owned by any company, OP, I would strongly suggest doing so first.

in/out instructions wouldn't have a C equivalent. My assumption would be it only translates instructions that a C compiler would typically create.

Nowadays we don't bother with copyright protection other than a license key, because we know enterprises generally will pay their bills if you put up any indication at all that a bill is required to be paid.

This was basically the 80s version of that.

I had to do this for a company so they could continue to use their old specialised Win98 software on modern computers using Dosbox and an emulator.

You pay for software? You need to keep that big dongle plugged in your computer all the time! You pirate the same software? No need for any dongle!

I recently did similar thing for the FineReader 6 using a hardware dongle [0]. It was surprisingly easy, no disassembly at all, just injecting srand(0) and a hardcoding the responses from the dongle. I had no prior reverse-engineering experience at all.

[0] https://slomkowski.eu/abbyy-finereader-6-ikey-1000-hack/

It worked well enough and allowed the company to run until the founder retired and folded the business.

it’s wild to think about the hardware risk people used to accept putting your entire household's financial history on a system that bricks itself the second a 40-year-old plastic dongle fails. really great read.

Not being snarky - genuine question! I am not from the US :-)

There is also their webpage for ordering PC RPG II. The company address is a residential house.

https://web.archive.org/web/20010802153755/http://home.netco...

I remember my Dragon 32 (6809, Color Computer clone) had a dongle you plugged into the joystick port to protect a really crap game - Jumping Knights? I never tried to defeat it.

    General Availability
        02-Nov-1981 , 281-999 
    No longer available for order, Withdrawn from Market
        05-Dec-2022 , 922-053 
    Transition to Extended/Sustained or End of Support
        30-Sep-2023 , 922-078 
    Completion of Extended, Sustained, Extension availability
        30-Sep-2023 

You have no idea how deep this rabbit hole goes.

Patents are barely better than copyright, as far as society net-positive.

  >Very importantly, there doesn’t seem to be any “input” into this routine. It doesn’t pop anything from the stack, nor does it care about any register values passed into it. Which can only mean that the result of this routine is completely constant!

I know there is cost associated with the hardware, but surely the costumer can cough 15 more dollars.

The only reason I can think of is wanting as wide adoption before max revenue as possible. But then, this has never been too popular, not even for games!