TIGSource Forums

Hey, guys!  Alec and I are looking into DRM for Aquaria and we wanted to ask you guys what you thought.  Figured we might as well aggregate our combined knowledge, like we did for our ECommerce thread (http://forums.tigsource.com/index.php?topic=257.0)! :)

Matthew Wegner, in his "indie bootstrap" talk at GDC, suggested SoftwarePassport (aka Armadillo).  This seems to be the most well-known DRM solution, certainly.  It offers several methods of protection.

SoftwarePassport (Armadillo)

Website: http://www.siliconrealms.com (http://www.siliconrealms.com)

Cost: $399

Used by: Flashbang Studios, more?

---

Apparently, eSellerate (http://www.esellerate.net/) and Plimus (http://www.plimus.com/) both offer DRM solutions, as well.  I found this quote on the Indiegamer forums, about Plimus:


The other alternatives are, of course, rolling your own protection scheme, or simply keeping the demo and full versions of your game separate.  Some people seem to think that's enough.  Although with a "hardcore" and therefore more tech-savvy audience, it seems like that would put you at a very real risk for casual piracy.

Thoughts?  Considerations?  Experiences?

I already showed these links to Alec, but I think they are good links for anyone looking into rolling their own license scheme

http://www.sentientfood.com/display_story.php?articleid=3

The author of this guide also provides his own license generating service: http://www.sentientfood.com/services/license_services/

I've had a good experience with eSellerate personally.  They provide their own serial SDK and handle orders and serial generation, issuing e-mails on their end, and you get a check each month.  You can also work with them, and a host of other software registration middlemen such as BMT Micro (http://www.bmtmicro.com/), to provide your own license generation system.

Ambrosia (http://www.ambrosiasw.com) has a system where they send out serials encoded with a timestamp that expires, to prevent the proliferation of pirate serials on the net.  They did a good write-up of this system, along with some piracy statistics here (http://www.ambrosiasw.com/forums/index.php?showtopic=34059).

I think the key is preventing casual piracy.  If your product is popular, it will inevitably get cracked, and there's not much you can do about that.  You can always invest more time to make your registration system more complex, but you also don't want to make your system a hassle for paying customers, and it's always better to spend your time working on features that add value than wasting too much time trying to battle piracy.

I'd say a good, simple system would be to protect a full game download with a serial hashed to the name on the credit card of the buyer, and update the downloadable with a blacklist periodically as pirated serials start popping up on the net... and hopefully have a serial system that is hard to make a keygen for....

Oh and another cool thing is to provide your users a printable certificate (http://rogueamoeba.com/utm/archives/cert.jpg) with their name and registration info.  It'll hopefully lessen issues with lost serials and also provides people nice,  tangible evidence that they've gotten something for their money.

Wow, thanks, Golds!  That's some great info there.  I like the idea of a printable certificate, as well.

Okay, I know some of you may hate me for what I will write but I have a strong opinion on this one...

Restrict your "protection" to just providing the user with a key. Every program will be cracked. Hell, even the worst indy games have cracks available on russian serverz available. Because it's not the popularity or demand that drives crackers to crack a game -- it's just the plain fun (hence a custom licencing solution actually draws more attention of the crackers xP).

Now if one adds complicated protection the only people that will suffer from it are the legitimate users. The illegitimate will have a easy to use crack instead. Probably the worst example of that that I've seen is the license management system on 3ds max, which actually made many people that bought the original download the cracked version afterwards because it's a lot easier to set up -_-.

I had even a similar situation myself -- after 10 minutes of frustration when trying to find my StarCraft box with the key on it, I gave up and googled one in under a minute -_-.

At the current technology there is no way to prevent copying unless you force something realy ugly on the user (like needing a dingbat in the USB port to run the program -- yet even that was quickly cracked in the case of some older version of 3ds max).

Of course, this is all opinion from a players perspective, for a developer that hasn't done any real buisness can't talk from experience :P.

Yeah, there's no question of whether your game will get cracked.  It will.  There's the casual pirates to consider though, people who will give their full version of the game to all their family and friends, who again give it to their friends, and so on, not because they desperately want to break the law or anything, but perhaps just because they like the game and want others to experience playing it too, and it's just a couple friends, right ..  So, people who never would've visited a crack site end up playing the full version of the game for free anyway.  On the other hand though, the game does get some extra exposure this way and people who perhaps never would've seen the game otherwise might actually end up buying it.  How much this matters though, I don't know.  It's been argued to death.

Anyway, the point is, for casual pirates you don't need an uncrackable game (which is probably impossible in any case), although some protection would probably help a bit.  A serial should do the trick, or even separating the game into demo/full versions and telling people they can share the demo version freely but keep the full version to themselves seems to work fine (in my admittedly very limited experience), specially if you thank people for buying the game in the full version :).  More "hardcore" pirates on the other hand will get a crack/torrent/etc for the full version of the game no matter what you do.  In either case, I can't see any need for the more invasive DRM solutions, except perhaps for annoying your legitimate paying customers.

One other point to consider, if you're still planning to do a Linux version of Aquaria (I hope so :)), is that there's no standard DRM for Linux that I know of at least (except for the Direct Rendering Manager, but that's probably not what you want ;)), so you'll most likely have to roll your own there anyway.

Good points!  A Linux version would probably have no DRM.  It seems pointless.  And generally, I think Linux users would be more inclined to support software.

I'm starting to think at least a little protection is a good thing, as you stated.  It's mostly psychological.  Many decent people might not even consider it to be "wrong" if there is nothing in the way.

Copy Protection and Crack Protection should be considered two different things.  Crack Protection is more useful to AAA developers, mainly to  delay (not stop) cracks until their peak sales period has passed (first month or so). 

Copy Protection is more about putting barriers in the way of normal users, who will share it if it's easy enough (e.g. serials, copying installed files, sharing installers, file upload sites.) This is what I concentrated on for my own game. 

I rolled my own DRM, which only took a couple of days.  My biggest reason was user experience.  Most commercial DRM solutions relying on serials are ugly and clunky, negatively affecting the experience for both trial and full version players.  I think this is the main reason people are against DRM -- it's usually a PITA and it adds no value.

Here are the main things I did:

Separate Demo/Full versions
It forces pirates to distribute the full thing, instead of just a serial.  It also lets you distribute a smaller demo file, potentially increasing your trial download rate. 

E-Mail Verification
Instead of a serial, users just enter the e-mail address they used to buy the game.  It pings the server, gets the player's name, unlocks the game, and then writes out the license file.  It's a small popup with very friendly text.  Your e-mail is harder to forget/lose, and easier to type than a 16 character serial (e.g. is that an "O" or a zero?)

Tagged Installer
Each Full installer contains an ID that is appended by the server when they download it.  If it starts spreading, I'll know who started it when someone tries to unlock it or use any of the online features.  If it's obvious that a ton of people are using it, I can lock it down.  Also, I use the same code to tag the trial so I  can track where players got the demo from.

Name in the Game
The buyer's first and last name appear in the Options screen.

So far, 100% of my players have unlocked it without complaining and I even got one compliment on it!

And yes, strictly speaking, I would have *more* players if I just let people pirate it.  But I would rather have a smaller fan base that is actively supporting what I do,  versus a larger one that will just look out for a free copy every time I release a new game.  And I only need sell about 8 more copies to make up for the time I spent developing it.

If anyone is thinking of rolling their own DRM, I'm willing to share more details in private.

I think that two-factor keys are probably a good way to go... Make them put in both the name and serial. That way, unless your key gen is subverted, it discourages redistribution to 'crackz' sites.

just throwing an idea

but wouldnt a OTP key pair pretty much defeat any cracking effort?

Implementation matters -- if I can hit your game into a debugger and attack the particular chunks of code which check the key, it's less than useless.

Then I can just distribute the patched binary (a "crack").

Inevitably, someone will figure out how to do this with any copy protection method, which is why my system won't work either. Perhaps one of the better ways is to download "part of" the game from a central server -- Steam does this -- but people have cracked Steam anyway.

that can be fixed by the slightlyy annoying serverside checking

and your right the keychecking code would be the main weak spot, since i doubt that they could attack the crypto directly

No, it can't.  Crackers just disable the serverside checking then, see.

Well, the problem with encryption is that a game has to be able to decrypt itself to be playable by the players.  You could have an unbreakable encryption (one-time pad), but it's useless if noone can play the game, right?  The only way to get around this is to do the whole thing in hardware on a system designed to only allow running officially approved software.  This is what's known as "Trusted Computing" though, which is a truly horrible idea for a number of reasons.

One of the axioms of computer security is that there are no 100% secure systems.  It's always about how far you're willing to go versus how far *they're* willing to go.  Unless you want to spend your entire life in that arms race, you have to make judgment call on where to stop. 

That's why my attitude is "if you can crack it by modifying the executable, you can have it."  Same for anyone willing to risk a download on a crack site.  My focus is on preventing the easy stuff like copying the files after they've unlocked it, or modifying the license file.

I just did the "simply keeping the demo and full versions of your game separate" route because I thought the work wasn't really worth the hypothetical increase in sales I'd see. I have seen reports that copy protection increases sales of independent games by about 35%, but to me even a 35% increase at the cost of weeks of figuring these types of questions out and installing protection wasn't worth the time. Plus I think my sales/popularity are low enough (like 130 sales or something now) for this not to matter. I haven't seen a download of the full version on p2p networks yet, but with a game like Aquaria you probably would.

I think the best way to prevent piracy is shaming people out of it. Chris Crawford once posted a picture of him and his wife in one of his games, with the caption "we put our live savings into this game, please don't pirate it". Of course, some people are too heartless even for that, but I think most people are good at heart, they just need to be reminded that they are.

C64 Exile is the only game I know of which hasn't been cracked. I suppose it used a honey-pot of sorts. The cracker thought they had cracked the game since they got it to work. However, Exile is a very difficult game, and the crackers never took time to play it though... maybe they were too eager to get the crack out and brag about it with a flashy sinus scroll.

Exile somehow sensed the break in and stealthily removed items a bit into the game in a random fashion. This allowed a copyright infringer to play the game, but he wouldn't be able to get very far.

This is what I've heard anyways. I've tried maybe 3 cracked versions, and none is working properly. The original (uncracked) works fine.

The method is clever since it exploits the cracker's eagerness to rush out the crack. If the mechanism for items, inventories and pickups is coded in a way that makes it tricky to disassemble (encrypted/compressed?) it could work quite well.

It doesn't have to be just items that disappear, it could be enemies and enemy projectiles getting stronger, the heroine becoming more fragile, a stream that becomes slightly stronger pushing the heroine back. Really subtle, random stuff which is hard to notice but eventually render the game unplayable. Then when people whine about it on a forum you know why too.

I believe Operation Flashpoint did a similar thing. When it detected that it was being illegaly ran, it started degrading the gameplay. Your guns malfunctioned and all kinds of graphical bugs would start to pop up.

Problem with that method is that if the person is downloading it as a 'try-before-you-buy' sorta thing then they won't buy it later. Also, they might tell their friends not to buy it, because they 'downloaded it yesterday and it was buggy as hell...'

Yeah that's true if you introduce annoying bugs on purpose, but that's different from just making the game harder or whatever, maybe with the first level/area running normally. You could also add stuff that makes the player feel like he'd need a manual . Since he knows he copied the game he's less likely to blame the game for issues that could be solved with a manual. Like, the game could sprout nonsense such as "Configure your HKS Inventory with the HKS bind key to proceed" or "To open this door, use the Merge button on the 4 guardian keys"... then the player will sit there looking for buttons and functions which doesn't exist, wishing he had a manual.

 :D  I like that, actually.  Probably not worth the effort, but it'd be funny to see someone ask about it on a forum and see the responses (e.g. "what are YOU smoking?")

Or how about an entire game that is 90% BS like that... basically, if you don't tear all your hair out, you win.

Demo and full version being separate is definitely something to do. Other measures will probably be necessary, but that's a really good place to start.

The trouble I've always had with the whole idea of "lost sales" is, well, you're assuming someone's going to buy your game, OR pirate it.

This is ridiculous.

Casual piracy doesn't mean "easy to crack", it means they're playing it because it's there. They load up a torrent site, or check an IRC channel, and say, "Hey, that's new, I'll play that." And they do, for a week. Then it gets forgotten, and they're playing next week's releases. They were NEVER going to buy it. If it wasn't there, it simply wouldn't be played.

So if you're not going to use DRM as some kind of protection (because it is worthless and only serves to irritate folk who buy the game).. why use it?

To sum up: any kind of DRM or copy protection is dumb, it has never worked (even hardware DRM gets cracked), but it's your dev money to throw away. If you're really looking to secure some kind of money-loyalty, you should be looking at paid tech support or subscription forums; access to a server that you control.

Sure, there are people who will never buy your game, but that doesn't mean there aren't people who would have bought it but pirated it instead - the concept of 'lost sales' is entirely sound. And casual piracy is a problem - friends copying games for each other etc. Sure, all DRM can be cracked, but it's generally not serious pirates that you're trying to discourage.

Copy protection which irritates and drives away people is certainly undesirable, though. I've said it more times than I can count, but the aim of the developer is maximise sales, not to minimise piracy. It doesn't matter how much a game is pirated if you've sold as many copies as possible.

YEAH. Paid tech support for games makes a TON of sense. (okay, maybe it does for MMOs)

Nobody thinks you can stop piracy. Believe me, nobody thinks that. The point is to keep the honest people honest. i.e. Make it slightly more difficult to share the game than to buy it.

Its a different type of protection than serials/whatever, but i always thought it was damn amazing that bleemcast! never got cracked. Im not sure what the programmer used but it was a standard CD that couldnt be copied or something like that.

Of course not all people who pirate a game would have bought it if they couldn't find a pirated version. But some percent of them would have, and it's not 0%. It's ridiculous to say that 'not everyone who pirates it would have bought it' leads to 'preventing piracy probably doesn't get you a single extra sale', but that's the argument I see people making all the time (on places like digg.com and the like).

YOU may know why, but most people won't.  They'll just read all these mini-reviews on forums about how unbalanced and sucky the game is.  That would probably lose more sales than the worst of DRM.  Especially with the flow of information we have nowadays.  If people "find out" a game sucks, they're not going to investigate far enough to find out the subtle details of why the particular opinion they read may or may not be valid.

I personally think people just need to be reminded that you're human, and you'll be hurt by their not paying for your work.  It's so easy for most people to only see the product, and it's amazing how many people don't even think that there even was a programmer/designer/artist/musician, let alone the sacrifices they may have made to release without outside funding.

Does anyone know a way to implement copy protection that will deter honest people from copying the game to friends, but won't be a pain when they want to reinstall it themselves?

CD/DVD-checks work well for that. They can be cracked, but they deter copying to friends, and deter "casual piracy" a bit, and aren't that bothersome except for multi-CD games.

Thanks for the reply, rinkuhero. :beer:

I should have specified, however, that I meant for downloadable games.

CD/DVD checks are a reason to download a cracked version of the game, even if you bought it legally.  They are that inconvenient.

I've never found them inconvenient, except for multi-cd games as said. What is the inconvenience? Do you like to play music from your CD drive at the same time? I think that might be the only reason it'd inconvenience me.

As for downloadable games, if a game is just downloadable, protection from piracy is much more difficult. The two major ways are:

- registration keys, checked on a server (can be cracked, but it'll at least force them to go through that trouble). You don't have to limit installation number, Aquaria doesn't (to my knowledge), but it does use registration keys.

- make the game require online play on a server, i.e. design the game around being an online game. this doesn't have to mean mmo, it could just mean online vs or cooperative games being a strong component of it, as in starcraft or diablo 2.

It's inconvenient because it means that every time I want to play the game, I have to find the CD and put it in.

This doesn't sound like much of an inconvenience, but my point is that I don't use that drive solely to play that one game.  I also burn CDs, watch DVDs, install other games, play other games with CD/DVD presence requirements, and rip audio CDs. 

If I don't play the game for a month, now I have to hunt around for the disc.  If I scratch or break or melt or lose the disc, it disables the installed copy of the game and any backups I've made.

Fortunately, as long as the disc isn't equipped with one of the more tenacious damaged-disc forms of duplication protection, I can rip the original CD to an ISO and (if I used Windows) mount it with Daemon Tools or Alcohol so I never have to look for the disc again.  Of course, now I'm trading hundreds of megabytes of hard drive storage for that convenience...

These are the reasons that I, as a customer, search for no-CD cracks.  I'm not a commercial game developer.  You may decide, as a developer, that it's a worthwhile tradeoff.

For me, I think the time spend hunting down a no-CD crack, installing it, making sure it works etc, with the danger of possible viruses, far exceeds the time spent switching a CD in and out a few times. It also helps if you're organized, you don't have to hunt around for the disk if you keep all your games in one place and don't have a messy room or leave them in random spots.

Also, most of the time a no-CD crack involves storing massive amounts of data on your hard drive, especially if it's a DVD game. A lot of people don't have huge hard drives and prefer to keep that stuff on the CD or DVD. I don't have much room to spare so I don't use no-CD options even when the developer has it as an option, with the exception of Starcraft, which I play often enough and which is only about 200mb to keep on the hard drive, and Blizzard supports it anyway; a recent official patch allows you to use it without the CD. But for most games, I'd gladly trade a minute in switching the CD for a few extra free GB of space.

You've seen the personal workspace thread, right?  :P

Yeah, and I posted in it a while ago -- not sure if I saw yours there though.

Mine's not there, I mentioned it as an example of other workspace photos.

Oh, I've seen a lot of them, and there is some clutter but I don't see tons of CDs laying around. Certainly I've never heard of anyone losing a game's CD permanently, they're rather large and kind of hard to lose. And most people that I know keep them all in one spot.

earthbound is supposedly unpiratable it had random in game checks that would destroy game play for pirated versions of the game. If one could figure out how this was accomplished you would at the very lest have a game that would have to pretty much be completely reprogrammed. And also I heard that either the xbox360 or the ps3 would have some sort of protection that would fix a game to only run on that console.

???

Earthbound is pirated all the time, though. You can download a ROM of it from billions of internet sites and play it on an emulator.

Oh, yeah. Earthbound had some pretty clever anti-piracy measures in place. I'm pretty sure it only worked if you had the game on an pirated cartridge. The game was able to tell it wasn't on the original cartridge, and it would make a bunch of crazy things happen.

It would do things like dramatically increasing the number of enemies. It would even wait until you were close to the end of the game, then lock up and erase your saved game files.   :o

What would really suck is if you were just some unsuspecting kid whose parents bought you a pirated game as a gift. That's enough to make someone stop playing videogames.

You read more about it on Starmen.net: http://starmen.net/mother2/gameinfo/antipiracy/

Most of the times when I lose CD's, it is because they fell off the desk and cracked. And take "fell" and replace with "sadistic cat who likes to shove things off desks". There were a couple times when I found no CD cracks simply because I didn't want to buy another copy of the game just to keep playing it.

As for slowing down cracking, I remember reading an article about cracking Mario 64. Apparently the developers put a couple, slightly different versions of the game on the CD, then bounced around the versions. It also didn't crash right away, but later in the game, so you would have to play for a few hours to see if you succeeded. I thought that was cool, just as the thank you to the developers from the crackers for making a fun challenge.

I also read that Chris Crawford made an uncracked protection system (although this was also Earthbound style, where it didn't work for emulation) and he even paid a hacker to try to figure it out, who couldn't get past the first few steps (although perhaps it was an incompetent one) after several months. The story was in one of his books, I think Chris Crawford on Game Design. I remember that it employed mainly psychological techniques and tons of fake leads, e.g. duplicating the registration code part thousands of times and doing thousands of crazy operations on each one and then combining and recombining some of them etc. so that anyone following it in a hex editor couldn't follow what was going on.

...

Hm? I'm not sure why you quoted those. Unless you mean that anything someone writes about themselves is inherently distrustworthy, in which case I probably give people more credit for honesty.

You don't need to go all philosophical on me. I was just saying that "uncracked protection" is very rare and mr whaterver needs to sell his book so yeah, in this case I kind of doubt his claims.

Well, it wasn't a selling point of his book. And he's an honest person, and accusing someone of lying just to sell books without doing any research on it or having any other reason than that he has to sell books is really cynical, especially when the person has done as much for game design as Crawford has (he founded the GDC, for instance, and wrote the first book on game design back in 1982, and was one of the first early voices for seeing games as an art form).

I'm not saying he is an awful liar, I'm just thinking that it's higly possible he put a bit of make-up on the facts to make them more presentable.
What he has done for the game industry is irrelevant to this topic.

I still think that's very cynical. Why do you think that it's highly possible? I don't really follow your reasoning here. Do you just believe that most people are liars, or what? Wouldn't it be very risky to lie and say your game was never cracked when it was? Wouldn't it be very easy to check and discredit?

The particular copy protection scheme Crawford talks about was in relation to his game "Patton Strikes Back".  Certainly one reason why it was never cracked (assuming you believe the claim) is that it was a commercial failure.  To this day, it's generally considered to be the worst game he ever worked on.

I thought he had a large document about that copy protection system on his web site, but it doesn't seem to be there..  maybe I'm just remembering reading about it from his book (which is sitting on my desk at work, ATM)


The crux of the idea was to use relatively common programming mistakes intentionally (out-by-one buffer overflows, etc) combined with knowledge of how stack frames work, to surreptitiously slip data around from one function to another without a cracker noticing what you're doing, while simultaneously doing normal copy protection checks to distract the cracker from paying too much attention to where you're doing the real work, and setting things up so that the second-tier protection (the stuff doing tricky work) didn't fail immediately, but much later into playing the game, so that the cracker can't easily find the place where the protection logic is really running. 

I recall being generally impressed with the approach, at the time.

But it's important to note that the scheme Crawford used was based around a code-wheel or instruction manual lookup scheme (which was the standard way to do copy protection at the time).  The software could be copied just fine; it was the manual or the code wheel which made it difficult to copy and distribute.  His copy protection system just made it difficult to remove that code lookup from the game executable.

Yes, that's true, his method probably wouldn't work today, but it's still very nice and parts of it can probably be applied to registration key systems (since those work in a way similar to code wheels or instruction booklet stuff). And good to know someone else here read that book too!

I think the best form of game copy protection is an enticing online multiplayer mode that checks for legit copies, and a thank-you-for-not-pirating-this-game/guilt trip note in the first time the game is started.

Agreed, but that poses a challenge for those of us who don't know how to code multiplayer games that well. Dead reckoning confuses me every time!

The bigger shame to me is how many great games aren't really feasible as multiplayer projects.  I love multiplayer, but I'd hate to see a world without dedicated single player games.

Come to think of it, this has already happened in China.  The country is so rife with piracy that the entire commercial games industry is now online-only (and microtransaction based for some reason, but that's unrelated).  I'm going to be really sad if the rest of the world goes the same way. :(

Oh dear god.

I regularly check TIGS but had to register to comment on this topic.

As many people say here, DRM doesn't protect your product and it punishes the customer.

I am incredibly disappointed to see (after checking out their website) that the OP has decided to go with Plimus. I myself purchased software via a Plimus seller.
Basically, the seller didn't have T&Cs on their website when I purchased, otherwise I wouldn't have done so. I contacted them to re-activate after a computer re-format, and they revealed that they wanted $5 every time I reinstalled the software.
From your description of the DRM services Plimus provide, the seller's stance makes a lot of sense now if Plimus is squeezing him for money every time an activation code is generated.

I'd be curious about the OP's license policy rgarding their game, Aquaria. Adobe and Valve promise their products in perpetuity to the end user, and every other software I've bought has allowed unlimited activations so far. This seller's policy (possibly dictated by Plimus?) seems to be one of hook and then extort.

to my knowledge, plimus is an e-commerce service provider, not a DRM provider -- it does have a key generation thing, but it's entirely optional. it doesn't have 'activations' and doesn't limit you to a certain number of installs. it's similar to bmt-micro and even paypal: a way for people to buy your game online.

if plimus is charging you 5$ to redownload a game you already bought, they're probably breaking the law, they shouldn't require that. i'd recommend emailing the developers about it and seeing if they know plimus is doing that; if plimus is indeed doing that they should probably change e-commerce service providers.

EDIT: re-reading the original post (from 2007!) it does seem that plimus has various drm options, including one of their own, so i'm wrong in saying above that they aren't a drm provider -- but they aren't *primarily* a drm provider in any case, they just offer it as a selectable option.

Yeah, sorry for bumping up an old thread! But I thought I'd respond to this since it's on here, a site I like and respect.

Wasn't a game, was just software. The seller presents themself as the developer, so... and the correspondence I've had where both the seller and Plimus attempt to justify additional charging on top of the $50 I've paid (e.g.: this policy is no different from Adobe or Microsoft...) is insane. Contacting Plimus and the seller both result in the same responses. I think it's against the law too but it's difficult to know how to pursue it. If they were based in the UK where I am, it would be easier.