Clicklocker Is a Bad DRM Solution

[ChesterFritz]

I wrote a reverse engineering article on my blog about the DRM solution known as ClickLocker. While the author claims that it has industrial strength security, I prove in this tutorial that this just isn't so. The goal of this tutorial is not to teach you how to pirate clicklocker protected ebooks, but to show you how weak this protection is. I hope that you enjoy and find it useful when choosing the best DRM solution for your product:

http://reverseengineeringtips.blogspot.com/2015/02/the-exagerated-promises-of-clicklocker.html

[HarryT]

Moderator Notice
Please bear in mind, should you decide to post in this thread, that detailed discussions of DRM removal are not permitted at MR. Any posts which violate this rule will be deleted without comment or notice.

Thank you.

[Quexos]

Originally Posted by HarryT

Please bear in mind, should you decide to post in this thread, that detailed discussions of DRM removal are not permitted at MR. Any posts which violate this rule will be deleted without comment or notice.

Thank you.

I wonder (and this is only curiosity) why on one hand it is made clear that DRM removal discussions are not allowed and at the same time there is a thread somewhere (too lazy to look for it but I know it's there) about DRM removal and what software to use and how to do it, something about a certain apprentice named Alf... which, apex of irony, was started by a mod...

Don't get me wrong, I'm not starting a discussion here about whether MR should or should not be a free place where DRM removal should or should not be encouraged and discussed, I'm only questioning the logic behind the obvious contradiction of MR's stance against such tools and the very existence of that particular thread?

[Shades]

Originally Posted by Quexos

I wonder (and this is only curiosity) why on one hand it is made clear that DRM removal discussions are not allowed and at the same time there is a thread somewhere (too lazy to look for it but I know it's there) about DRM removal and what software to use and how to do it, something about a certain apprentice named Alf... which, apex of irony, was started by a mod...

Don't get me wrong, I'm not starting a discussion here about whether MR should or should not be a free place where DRM removal should or should not be encouraged and discussed, I'm only questioning the logic behind the obvious contradiction of MR's stance against such tools and the very existence of that particular thread?

The site's host country changed and so MR is forced to obey the U.S.'s laws. Including those on DRM.

[Quexos]

Originally Posted by Shades

The site's host country changed and so MR is forced to obey the U.S.'s laws. Including those on DRM.

Oh the site changed its host country? I never knew that. But that still would not explain it all clearly. I mean US law has something called the 1st amendment on freedom of speech so the US being host to this website does not explain the contradiction mentioned in my previous post.
The mystery thickens... or at the very least remains the same

[Sweetpea]

Let's go back to the OP:

Originally Posted by ChesterFritz

I wrote a reverse engineering article on my blog about the DRM solution known as ClickLocker. While the author claims that it has industrial strength security, I prove in this tutorial that this just isn't so. The goal of this tutorial is not to teach you how to pirate clicklocker protected ebooks, but to show you how weak this protection is. I hope that you enjoy and find it useful when choosing the best DRM solution for your product:

http://reverseengineeringtips.blogspot.com/2015/02/the-exagerated-promises-of-clicklocker.html

The best DRM solution is the one where the legal user of the product doesn't encounter any problems when he wants to use said product in the way it was supposed to. In case of ebooks, that means that if I buy a book, I should be able to read it on all my ebook reading devices, without having to jump any hoops, like DRM removal. So, either let me convert one format to the other without having to remove the DRM or offer me the format of my choice when buying the book. Also, let me download the book without having to install any extra software so I can download it on any device I own that has an internet connection. And lastly, let me read the book on any device. With or without internet connection.

[twowheels]

I've never run across Clicklocker and am not sure who uses it, but wow... that's bad.

This is ALMOST as bad as a game I cracked for a roommate back in ~1993.

A common copy protection scheme back then was to include a card or booklet of things to look up before you could play the game. These were often low contrast images that were hard to photocopy on the machines of the era. He was colorblind and unable to decipher these and unable to play the game without asking somebody else to start it for him, so I took a crack at it.

In about 2 minutes I found where they were calling to the protection... replaced the jmp & jne calls with nop instead, and I was done... it no longer asked for the codes.

I then looked at it a little closer and saw that it had an executable called prot.exe. I ran that directly and saw that it was a program that had you make the choices. If you ran it and gave the correct answer it would return 0 and if you ran it and gave it the wrong answer it would return 1.

So... I fired up my editor and wrote this program in C:

int main() { return 0; } // I didn't know back then about the implicit return value

Compiled it and saved it as prot.exe... done... cracked it two completely different ways in less than 10 minutes. Their copy protection clearly served no purpose beyond inconveniencing actual paying users.

[Brazen_NL]

Originally Posted by twowheels

A common copy protection scheme back then was to include a card or booklet of things to look up before you could play the game. These were often low contrast images that were hard to photocopy on the machines of the era.

Sierra comes to mind. I loved those games!

I even remember playing them and reading it out loud for my kid brothers. It was like an interactive book to them.

[Ghitulescu]

The only way to get rid of DRM is to buy physical products.
You know that grey bricks, the paper books?
These are not paired with any brain/eyes so they can be borrowed, sold, bought like a pair of shoes.

[HarryT]

The main purpose of DRM is not to defeat the professional criminal who wants to steal your product, but to give the overwhelming majority of honest users a gentle reminder when they try to do something that's outside the terms of usage of the product, such as giving a copy of it to their friends. Just as door and window locks won't stop a burglar from breaking into your house, but remind the casual by-passer that it's private property.

In that sense I really don't think it's terribly important how strong or otherwise a DRM system is. The typical user won't care; the professional criminal won't be stopped by it.

[murg]

Originally Posted by HarryT

The main purpose of DRM is not to defeat the professional criminal who wants to steal your product, but to give the overwhelming majority of honest users a gentle reminder when they try to do something that's outside the terms of usage of the product, such as giving a copy of it to their friends. Just as door and window locks won't stop a burglar from breaking into your house, but remind the casual by-passer that it's private property.

In that sense I really don't think it's terribly important how strong or otherwise a DRM system is. The typical user won't care; the professional criminal won't be stopped by it.

A gentle reminder? So, breaking the law is now gentle?

[HarryT]

Originally Posted by murg

A gentle reminder? So, breaking the law is now gentle?

No, the fact that the product stops you from doing illegal things unless you specifically take action to circumvent the DRM is the gentle reminder that I was referring to. Apologies if I didn't make my meaning clear.

[webroot]

this is an excellent post on how he cracked that software, but it is misleading too, as to many here, specially when we use the term DRM, its just about license cracking for this particular software and not really ebook DRM cracking ( or piracy). I wonder why original poster mention the need for encryption in executable binary! If that holds true then there is nothing wrong in cracking this app and posting details.

[theducks]

Originally Posted by Quexos

Oh the site changed its host country? I never knew that. But that still would not explain it all clearly. I mean US law has something called the 1st amendment on freedom of speech so the US being host to this website does not explain the contradiction mentioned in my previous post.
The mystery thickens... or at the very least remains the same

the US also has the DMCA which supersedes your interpretation of the 1st amendment. The Supreme court was not of your opinion on this either.


Best laws Disney (lawyers) could buy

(you don't think all those bills are written by the staff? )

[rollei]

http://reverseengineeringtips.blogsp...icklocker.html

Now that we are finished, I must state that the goal of this tutorial was NOT to teach you how to pirate a ClickLocker protected product, but rather to show you that this product is not as strong as their website implies. A good DRM management software would employ encryption that could not be broken without a valid decryption key being supplied by the server upon activation. This is far from the case with ClickLocker. While my goal here is not to defame ClickLocker, I hope that you will consider these factors before using their low security product. Until next time, happy reversing.

Posted by Chester Fritz at 12:30 PM

OP did say "the goal of this tutorial was NOT to teach you how to pirate a ClickLocker protected product, but rather to show you that this product is not as strong as their website implies."

The tutorial also helped owners of software, e-books, video, audio, apps etc to take corrective measures to safeguard their properties, which otherwise may have been stolen while using ClickLocker to secure their properties.

The tutorial may cause ClickLocker to lose sales, shutdown, face lawsuits or a total revamp of their "locking" product.