SafeCast

SafeCast is a registered trademark for Macrovision's legacy software protection system. Safecast features product activation (via telephone, or through internet), and executable wrapping technology. SafeCast can be easily defeated with a keygen.

Controversy

SafeCast overrides operating-system security and safeguards and writes directly to the boot track of the local disk as part of its operation. TurboTax, Intuit's tax-preparation software product, uses SafeCast in some versions, and the protection scheme has been blamed for a wide variety of problems with product activation and use, leading Intuit to partially remove the technology. Adobe also uses a version of SafeCast for its CS products, and has had similar but less frequent problems, particularly with certain types of disk configurations (RAID, multiple-boot), but continues to use the technology for copy protection.

Removing SafeCast

Removing SafeCast from one's system involves multiple steps. Note that the SafeCast is changing, and so the information below may no longer be accurate or complete.

Cleaning the Registry

:You need a registry browser that supports displaying the last access date.
:The [http://ghisler.fileburst.com/fsplugins/wfx_registry.zip registry plugin] for the Total Commander will do the job.
:Sort entries for date and delete the newest (or search for "Local"="EN") in:: [HKCRCLSID*] ::Not needed::: [HKCR*] :: [HKLMSOFTWAREMicrosoftActive SetupInstalled Components*]

Cleaning the physical hard disk data

:Get some Hexeditor like [http://home.pages.at/peppie/Winhex_12.9.7z Winhex] that supports raw hard disc access.
:Zero data at current physical harddisk sector 32(offset 0x4000)
:Notes: :* physical harddisk is not C: <- which is only a logical drive:* Data at this sector should look like random data:* Improper 'editing' will do much damage. Backups/copy sector before filling

Cleaning SafeCast files

:Find and delete:
:%ALLUSERSPROFILE%Applicationdata*Product licenses*.dat:(in some older releases can be located at %ALLUSERSPROFILE%Applicationdata*Software licenses*.dat)

Protection Level

Manual unpacking is possible but may require averaged~elevated debugging skills.
Safecast uses some common known debugger detection tricks like::Kernel32.IsDebuggerPresent():Kernel32.CreateFileA ("\.NTICE") : [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/zwqueryinformationprocess.asp ntdll.ZwQueryInformationProcess] (...InfoClass = ProcessDebugPort(0x7)...)

Dll-Import-Redirection makes it somehow harder to produce a running exe.With common reverse engineering tools like Import REConstrutor it is possible to locate all redirectioned API ('Get API Calls') and call them ('level2 hook tracer').Safecast removes the redirection on first call of a redirectioned API, so after all are done, targetcan be dumped as usual. [Information refers to Safecast version 2.67.10]

ee Also

*SafeDisc

References

External links

* [http://newssearch.looksmart.com/p/articles/mi_zdext/is_200305/ai_ziff41829 Intuit to use kinder, gentler version of SafeCast] - May, 2003
* [http://www.extremetech.com/article2/0,1697,828326,00.asp Intuit Soothes DRM Fears with TurboTax Uninstaller] - January, 2003
* [http://web.intuit.com/about_intuit/press_releases/2003/02-24.html Intuit press release on independent testing] - press release, February 24, 2003
* [http://www.macrovision.com/company/news/press/newsdetail.jsp?id=21b619562a1ad9c40d4f69ef1e9eda89 Intuit licenses SafeCast] - press release, September 5, 2002
* [http://www.macrovision.com/company/news/press/newsdetail.jsp?id=ceaa3eb2c1f5ab0c11d5b38b58a79e80 Intuit continues use of SafeCast] - press release, May 15, 2003
* [http://news.com.com/Intuit+scrambles+to+ease+TurboTax+woes/2100-1040_3-982811.html Intuit scrambles to ease TurboTax woes] - January, 2003
* [http://news.com.com/2100-1017-979357.html Intuit pours oil on TurboTax troubles] - January, 2003
* [http://www.findarticles.com/p/articles/mi_zdext/is_200307/ai_ziff45338 Adobe tries out DRM in Photoshop] - July, 2003