• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Uncovering Sony's DRM software

grazzhoppa

New Member
Joined
Apr 16, 2005
Messages
219 (0.03/day)
Processor Core 2 Duo E6750 @ 3.3GHz
Motherboard Abit IP35 Pro
Cooling Scythe Ninja, two 600RPM 12CM fans
Memory 4GB DDR2 @ 832MHz, 4-4-4-12 2T
Video Card(s) NVIDIA 8800GT @ 715/980 passively cooled
Storage 1TB WD10EARS, 500GB WD5000AAKS, 250GB HM250JI
Display(s) Samsung 204b LCD
Case Ultra Wizard
Audio Device(s) Onboard Realtek ALC888
Power Supply Seasonic S12-II 380 watt
Software Windows 7 Pro. (x64)
The Digital Rights Management software that Sony BMG Music Entertainment uses is a bit of a security risk and CPU hog according to sysinternals.com. The website disassembled the DRM software and found a variety of problems with it.
The worst of it is that the software "hides any file, directory, Registry key or process whose name begins with '$sys$'" from the Windows API. Which can obviously allow malware writers to hide their programs from Windows users courtesy of Sony's DRM software.

Another problem is that it's un-uninstallable for most users. It doesn't register itself with Windows' Add/Remove Programs.
You need to have access to a variety of specialized programs and Windows knowledge to be able to first "uncloak" the files and reg keys the DRM software installs.

The guy who wrote up the original article had his CD drive disabled after he deleted the software. He had to get rid of more reg keys the software had created but...
Those keys have security permissions that only allow the Local System account to modify them, so I relaunched Regedit in the Local System account using PsExec: psexec -s -i -d regedit.exe. I retried the delete, succeeded, and searched for $sys$ again. Next I found an entry configuring another one of the drivers, Cor.sys (internally named Corvus), as an upper filter for the IDE channel device and also deleted it. I rebooted and my CD was back.

Obviously all the wrangling around to get rid of the software is to protect itself from being tampered with by the casual computer user. But by giving no option to uninstall itself if the user doesn't want it on their computer anymore is unnacceptable.

Another problem with it is the CPU usage it takes up after being used. It'll scan all the processes you're running even after you've "shut down" the software. The author of the article says it was taking up 1-2% of his CPU usage constantly after closing down the program.

bit-tech.net calls it malware and spyware but it looks as if it's a badly though-out and coded piece of software. Calling it spyware is pretentious, but Sony should enlighten it's customers on why such a poor program is required to listen to DRM protected Sony music on a computer.

Just another reason why DRM is a consumer's and end-user's dream come true...

View at TechPowerUp Main Site
 
Last edited:

XooM

New Member
Joined
Oct 17, 2004
Messages
468 (0.07/day)
Location
Close to FrozenCPU.com
Processor Athlon 64 3800 x2 Windosr @ 2.65 (and rising)
Motherboard BIOSTAR TForce 550
Cooling Custom Liquid (WMD20RLZT, Swiftech STORM, 2-302 w/ custom shroud, 2x sanyo denki)
Memory Patriot PDC22G5300LLK
Video Card(s) Sapphire x1900GT
Storage 1x maxtor 40gb, 2x hitachi T7K250 160gb drives RAID 0, 1x 160gb Spinpoint
Display(s) 2x 17" CRT (dells; one from 1998, one from 2001) at 1600x1200 each
Case Aspire X-SuperAlien
Audio Device(s) integrated
Power Supply Seasonic S12 600watt
Software WinXP SP2, Folding@Home, Battlefield2, etc
wikipedia said:
Spyware is a broad category of malicious software intended to intercept or take partial control of a computer's operation without the user's informed consent. While the term taken literally suggests software that surreptitiously monitors the user, it has come to refer more broadly to software that subverts the computer's operation for the benefit of a third party.
Well, i'd call CD drive hijacking and thoroughly embedding a program into one's system spyware. Actually, it sounds worse than most spyware.
This is yet another reason why DRM is bad and needs to burn in hell.
 

wazzledoozle

New Member
Joined
Aug 30, 2004
Messages
5,358 (0.75/day)
Location
Seattle
Processor X2 3800+ @ 2.3 GHz
Motherboard DFI Lanparty SLI-DR
Cooling Zalman CNPS 9500 LED
Memory 2x1 Gb OCZ Plat. @ 3-3-2-8-1t 460 MHz
Video Card(s) HIS IceQ 4670 512Mb
Storage 640Gb & 160Gb western digital sata drives
Display(s) Hanns G 19" widescreen LCD w/ DVI 5ms
Case Thermaltake Soprano
Audio Device(s) Audigy 2 softmod@Audigy 4, Logitech X-530 5:1
Power Supply Coolermaster eXtreme Power Plus 500w
Software XP Pro
Hmm I had Sony Sonicstage on my computer for a whole 15 minutes before realizing what crap it was. Havent noticed any problems :twitch:
I did a find keywords : sony, sonicstage in regedit and deleted any entries.
 
Joined
May 27, 2005
Messages
3,651 (0.53/day)
Location
Little Rock Arkansas, United States
System Name Monolith
Processor Intel Xeon E3110 Wolfdale@3.5GHz
Motherboard MSI P35-Neo
Cooling Active Air
Memory 4GB DDR2 800
Video Card(s) Sapphire HD 3850 512MB PCI-E
Storage 1 x 80GB Internal, 1 x 250GB Internal, 1 x 40GB External
Display(s) Acer X203w
Case Generic black case with locking front bezel
Audio Device(s) Creative SB Audigy 2 ZS
Power Supply 500 Watt Seasonic M12
Software Windows 7 Ultimate x64
All legit programs should be easily removable by users who have little knowledge of advanced computer operation. None of these programs should require that you hunt down and manually delete registry keys, with the added bonus that you might disable one of your hardware components. Sounds like a pretty malicious program to me. Shame on Sony:shadedshu
 

grazzhoppa

New Member
Joined
Apr 16, 2005
Messages
219 (0.03/day)
Processor Core 2 Duo E6750 @ 3.3GHz
Motherboard Abit IP35 Pro
Cooling Scythe Ninja, two 600RPM 12CM fans
Memory 4GB DDR2 @ 832MHz, 4-4-4-12 2T
Video Card(s) NVIDIA 8800GT @ 715/980 passively cooled
Storage 1TB WD10EARS, 500GB WD5000AAKS, 250GB HM250JI
Display(s) Samsung 204b LCD
Case Ultra Wizard
Audio Device(s) Onboard Realtek ALC888
Power Supply Seasonic S12-II 380 watt
Software Windows 7 Pro. (x64)

boruvka

New Member
Joined
Jun 21, 2005
Messages
88 (0.01/day)
Location
Hessia
System Name 479er (Springdale/Dothan, >50% OCed)
Processor Intel Pentium M 730 (Dothan) @ 2.5 GHz (12x208)
Motherboard Asus P4P800 SE
Cooling Zalman 7000 AlCu
Memory Corsair CMX 1.5GB
Video Card(s) Powercolor X800 GTO @ 500/500MHz
Storage Maxtor 6L250R0, Samsung SP2514N (250+250GB)
Display(s) ELSA Ecomo 741 (22NF121) 22" CRT
Case Avance B030 black, 3 x 80mm case fans
Audio Device(s) Intel 82801EB ICH5 - AC'97 Audio Controller
Power Supply Enermax 350W
Benchmark Scores 38-41°C at full load... nice clocker
From what I gathered I doesn't REMOVE the malware, but only helps to FIND it on your system. To really REMOVE it you have to lower your pants in front of Sony and give them all sorts of personal data they have no right to ask for.
I do not know what it's like elsewhere, but in Germany the DRM malware used by Sony is a criminal offence, punishable as unlawful "Data manipulation", leading to sentences of up to two years imprisonment or a monetary fine.

http://bundesrecht.juris.de/bundesrecht/stgb/__303a.html
 
Top