The New System

As Ambrosia’s Matt Slot explains, the old system continued to allow a lot of piracy, so in the early 2000’s they decided to switch to a more challenging registration system. This new method was based on polynomial hashing and included a timestamp so that codes could be expired and renewed. Ambrosia now had better control over code distribution, but they assumed their renewal server would never be shut down…

They also took more aggressive steps to reduce key sharing. The registration app checks against a list of blacklisted codes, and if found to be using one, the number of licenses is internally perturbed so that subsequent calculations fail. To combat tampering, your own information can get locally blacklisted in a similar manner if too many failed attempts occur, at least until the license file is deleted. Furthermore, the app attempts to verify the system time via a remote time server to minimize registration by changing the computer’s clock.

You can disable the internet connection, set the clock back, and enter codes. There’s also a renewal bot for EV: Nova. But let us look at the algorithm more closely.

64-bit Codes

The first noticeable difference is that registration codes in v2 are now 12 digits, containing both letters and numbers. This is due to a move from a 32-bit internal code to a 64-bit one. Rather than add an ASCII offset to hex digits, every letter or number in a new registration code has a direct mapping to a chunk of 5 bits. Using 5 bits per digit supports up to 32 values, or almost all letters of the alphabet and digits up to 9 (O, I, 0, and 1 were excluded given their visual similarities).

The resulting 64 bits (really only 60 because the upper 4 are unused: 12 digits * 5 bits each = 60) are a combination of two other hashes XOR’d together. This is a notable change from v1 because it only used the registration code to verify against the hashing algorithm. Only the licensee name, number of copies, and game name were really used. In v2, the registration code is itself a hash which contains important information like a code’s timestamp.

Two Hashes

To extract such information from the registration code, we must reverse the XOR operation and split out the two hashes which were combined. Fortunately, XOR is reversible, and we can compute one of the hashes. The first hash, which I’ll call the userkey, is actually quite similar to v1’s algorithm. It loops through the licensee name, adding the ASCII value, number of copies, and shifting bits. This is repeated with the game name. An important change is including multiplication by a factor based on the string size.

The second hash, which I’ll call the basekey, is the secret sauce of v2; it’s what you pay Ambrosia to generate when registering a product. It is not computed by the registration app, but there are several properties by which it must be validated.

The chart below visualizes the relationships among the various hashes, using the well-known “Barbara Kloeppel” code for EV: Nova.

TEXTCODE:
------------------
| L4B5-9HJ5-P3NB |
------------------                    HASH1 (userkey):
	|                             calculated from licensee name,
        |                             copies, and game name
BINCODE:                              ----------------------
5 bits per character,             /-> | 0x0902f8932acce305 |
plus factors & rotations         /    ----------------------
----------------------          /
| 0x0008ecc1c2ee5e00 |   <-- XOR
----------------------          \
	                         \    ----------------------
	                          \-> | 0x090a1452e822bd05 |
	                              ----------------------
	                              HASH2 (basekey):
	                              generated by Ambrosia,
	                              extracted via XOR

I am technically less than 49.999999999 bot.

Take that as you will.

That’s exactly what a bot would say.

(I kid, I kid. Er, I think.)

Well op said “colleague” rather than friend, which I point out only because that is presumably why they made the connection to work.They’re referring to using pirated software at work, which could introduce ransomware without you knowing it. Ransomware can remain dormant for extended periods of time, giving it a better chance to evade security controls and spread to other machines.

lol I still would have gone on the same rant since it was him using cracked software at work after paying for it. No worries.

Too bad they don’t see the hypocrisy of them doing the same with tax loopholes.

I completed it because I started it (and it’s a shorter game), not because I was actually invested. I’ve played Black Flag 3 times, I’ve paid for it once, and would both replay it and pay for it again. I’ve played Rogue once, and I have no intention of replaying or paying for it.

Its about justifying it to myself. I’m not rich and don’t really have disposable income for games.

Actually, no… it’s telling you that it thinks it’s not a legal copy. The company doesn’t actually know. It’s not like they sit down and write out by hand every key that is created. Those keys are generated by some algorithm. The company can identify if an algorithm was compromised (either the generation method identified or a significant portion of keys from said algorithm being used without them having been generated by the company), or they surmise that a chunk of codes, that had been previously generated for distribution, were nabbed when a number of them start to get activated without the company seeing a corresponding increase in sales. They more than likely do not have an exact list of which codes were stolen, just an assumption.

Here’s an example for ya… Company gives Legit LTD a set of codes to sell. Unfortunately, the thieves seal hack into Legit LTD’s systems and are able to copy a chunk of those codes. Legit LTD does not realize the breach for a day, or a week, and sells those codes to customers. At the same time, the thieves setup a seeming legit web store and started selling their ill gotten codes on that site. Two different customers are looking for Company’s software. One buys a code from Legit LTD. The other buys from thieves seemingly legit store. Just so happens that both stores sold the same code. Now two people have a copy of the same code. Both customers, in this case, believed they were buying a legit code. Both believe their code is valid. Before either can activate those codes, however, Legit LTD realizes they’ve been hacked and tell Company. Company, not knowing exactly which codes were stolen, decides to invalidate the batch… but there are legit customers in the wild that have codes from that batch and there’s no way for Company to tell who bought from who. BOTH customers, at this point, go to activate their code and both are told they’re running a pirated code. Neither of them really pirated, however. The thief did, but the thief isn’t the run using the code.

As such, no… Company and Legit LTD would find it very difficult, if not impossible, to determine who bought legitimately. Most companies, when this happens, would say, fuck’em and let both customers suffer. This company chooses to tell them they’re running suspected pirated codes (though, they don’t know for sure), and, regardless, neither customer would be pirating because both believe they purchased legit codes all above board.

Welcome to software, my friend. :D

Legal or not legal isn’t determined by the licence key anyway. You can buy it for real, then crack it and you still have a legal copy.

You didn’t, you typed the words “I understand”, which isn’t acknowledgement of comprehension, exactly the same as it is when you “accept the EULA” after not having read it. The very thing that has been deemed non-defensible for EULA litigation.