THE DRM MINEFIELD

Based on some emails and PMs that I have been getting regarding our decision (technical more than anything else really) to drop the use of Byteshield in our game, I’d like to discuss a few things about this whole DRM issue in gaming.

Before you read any further, please familiarize yourself with what DRM actually means.

There are various DRM schemes available for use in games. These range from basic disc checks (SafeDisc, SecuROM, Starforce etc) to online authentication (SecuROM, Starforce, ActiveMark, Impulse*, Tages, Steam etc)

*Yes, Stardock’s Impulse is a form of DRM. Anyone who says otherwise is either lying or has no clue what DRM actually means.

For our part, we are currently evaluating new versions of Tages, Game Shield, SecuROM etc in order to decide which DRM scheme to implement for the game’s upcoming commercial release. Later this month, we’re going to be looking at SteamWorks as well. We looked at Starforce ProActive5 again recently and discarded it for the same reasons we stopped using it several years ago.

Since we already have experience with SecuROM and have been using it for some of our previous games (UCCE, GCES) with NO incident or issues, we just decided to re-release the demo using SecuROM and disabled the disc and activation checks. In other words, you won’t even know its there. We advised Byteshield well in advance of this decision. Not to mention that the fact that it would be unfair to leave the Byteshield demo out in the wild and using server resources that nobody is paying for.

As things stand, we are still running our tests with various DRM schemes but have yet to decide which scheme we will use for the game’s actual release.

The reason for having DRM in demos and such is because hackers use demos, XB360 binaries, press copies etc as comparison to the final retail version. A talented hacker can then easily break the DRM from a released game using binary comparisons, search and replace hacks etc. Sure they’re going to break the DRM regardless, but why make it easy for them?

The cleverness of how the Byteshield enabled demo was cracked took me a bit by surprise I must admit. So I personally did the same thing on a different build using different (and more aggressive) settings. I was able to reproduce it. That influenced my final decision greatly. It wasn’t an easy decision, especially given that we’d been working on it for almost a year and helping them iron out various quirks and issues here and there.

Sure any DRM scheme can be broken, but why adopt a new scheme if it doesn’t improve on the curve? There is a reason why there are so many DRM products on the market. That reason is because each caters to a different audience. It is called competition.

Any talented and determined hacker can break a DRM scheme. But thats not saying much because at the end of the day it is up to the developer/publisher to do a good job of implementing the DRM while taking performance and other issues into consideration. e.g. SecuROM, Tages, Starforce etc all give you so much control over how to protect the code, its not even funny.

And we’re not talking about mere binary wrappers here – which all of them (and others like Armadillo, Game Shield etc) do support. Most – if not all of the high end protection schemes – can and will impact performance in certain games. e.g. while you can use source code implementation in something like Peggle, you can’t particularly use it on something like AAW or Crysis. Why? well think about it. If you have a 10% performance drop in Peggle, you won’t notice it. But you will notice it in a real-time and CPU intensive games.

When you do source code level DRM implementation – the most difficult to crack – using something like SecuROM, Tages, Starforce etc, you leave most of the protection work to the DRM scheme because it replaces those bits of your source code with their own. If you don’t do enough testing, you end up with a situation whereby the game is unacceptably slow, crashes due to some critical piece of code being protected etc. e.g. you can do code replacement on something like resource initialization – called only once at the start of a game – but not in something like the game’s mainloop which has to iterate though LOTS of processing EACH FRAME. So you can run your tests and five minutes into the game, no problem. Then twenty minutes in, you get hit with an fps drop from 30 to 24. Then you have to go find what is causing the drop. Then you move the code injection elsewhere. It is a VERY LONG AND ARDUOUS process and not something you can just slap together. Sure you can use the basic DRM protection in under thirty minutes and call it a day, but thats what Day One cracks and all manner of problems gamers have upon release are all about. If you don’t want your game cracked on Day One or you don’t want to deal with performance issues, crashes etc then you have to put A LOT of work into the DRM implementation by way of various tests.

Most developers tend to leave DRM wrapping to the very end of the game’s development cycle. Yes, really. Thats why you see all those reports of so many problems when that happens. Problems that they, in some cases, could have reproduced and fixed through stringent pre-release testing and QA. And when stuff like that happens, it is the DRM scheme – not the developers doing the implementation – that tends to be in the spotlight.

The key to DRM for developers/publishers is that the longer it takes for hackers to break the game, the more chances you have of actually making some additional money on the game. There is no such thing as a casual pirate anymore. At least not since everyone discovered the Internet and Google. So DRM implementation is not about preventing uncle Tom from making a copy of your game for your cousin Harry. Tom doesn’t need to crack your game in order to make that copy for Harry when he can just go online and get it from someone who already has done the job for him. Heck, Harry can probably do it all by himself. Casual piracy is no farther than a trip to a search engine.

DRM only works so far as to stiffle the cracking of a game and giving the game some fighting chance in the retail space in the first weeks of release. Most gamers tend to justify their THEFT by saying that they wanted to try the game first before buying it – so they pirated it. Bollocks. Theft is theft. I can’t go next door and “borrow” my neighbor’s Ferrari just because I wanted to see what it drives like.

Without DRM – of some kind – you might as well just invite piracy and is no different than leaving your car door unlocked while you go running around in the mall. If a determined and experienced car thief wants your car, they’re going to steal it. No locks, GPS or anything is going to prevent that. Does that mean that that you should leave your car unlocked? Same with games. Just because DRM schemes can be cracked does not mean that you shouldn’t at the very least implement some sort of DRM scheme in it.

RESTRICTED ACCESS. HARD HAT REQUIRED. SERIOUSLY

Yes, we have used SecuROM in the past – and those games are still being sold. Yes we will use it again if we had any reason to do so. So there, I’ve said it. Go ahead, send me email about how you disapprove, you’re not going to buy my game etc and see just how much crying I end up doing. Fact is, if you’re not going to buy my game because of some DRM scheme – even though you haven’t even run the game yet to see if it even impacts you at all – then you’re probably not my target demographic anyway. And so I lose what exactly?

Lets move on…

Removing SecuROM is not the responsibility of any individual developer/publisher. Thats like putting the onus on us to remove DirectX – or any similar driver component – from Windows OS.

Do you REALLY think that when you remove something like DirectX, .NET, audio drivers, video drivers etc or most of the code drivers in Windows OS that they are really gone? Seriously? In fact, all you have to do is search online to find so many “driver cleaners” that you’d just as well wonder what all the fuss is about regarding the removal of DRM drivers. Sure some are difficult to remove. And so what? How are they different from any other driver that is difficult to remove?

Fact is NOTHING IS EVER REMOVED COMPLETELY WITHOUT ADDITIONAL TOOLS. Why? Because of the Windows OS. It is a bloated piece of crap that gets bloated each and every day just by doing something as simple as going online (oh look! There is something now called Silverlight, yeah, lets install that then).

When you remove something from a Mac or Linux OS – using the OS acceptable standards, trust me, its gone. Not so with Windows. Its like that aunt you have who just hoards and collects stuff. Then one day she dies. And you’re left with all this mostly worthless stuff. You might as well just torch the house because it would be far less painful than filtering through all her accumulated stuff to see what you can toss out. Which is pretty much what most of us do every few years when we save our precious documents, images, emails, games etc scrub our Windows OS and re-install from scratch.

Why would you want to remove a driver, any driver? Well, compatibility for one. Piracy for the other.

Back in the early days there was much learning to be done by way of how DRM schemes handled their drivers, implementation etc. Heck, they ALL install some sort of driver, hidden file, hidden registry entries etc. Just that some of the earlier iterations (e.g. Starforce) just went too far and rather than erring on the side of caution, decided to throw caution to the wind, thus compromising the integrity of not only the games they were protecting, but also garnering the ire of gamers. This is why it is hard to find a developer/publisher in North America, using Starforce these days. It is still widely popular in places like Russia and elsewhere. I considered looking at it again recently because of our Russian publishers (Akella) who would prefer to use it because it is cheaper for them than the alternatives.

The only reason why anyone would want to remove any DRM driver is if

i) they no longer have any games that use it

ii) they are having compatibility issues with it

In our tests, we found no such compatibility issues with SecuROM. If the SecuROM driver* or DLL files are already installed when the game/demo is run, then they are used. If you un-install the game/demo, it doesn’t do anything with SecuROM because we have NO way of knowing if the files are needed by another game. Thats not our responsibility.

* To the best of my knowledge and from my own testing, the version of SecuROM that we use does not use or install any drivers whatsoever.

In the past few years, we’ve released two commercial games with SecuROM and you won’t find a SINGLE post online or on our website about issues with it. Why? Well because:

i) we don’t leave things like DRM for last, then do a rushed botch job of it

ii) we don’t go all Draconian on the gamer and restrict their right to play a game they licensed (NOTE: buying a game does not mean you own it btw – you are paying for a license to use it and still preserves your First Sale doctrine rights).

We as developers, ALL know how to remove every single DRM scheme we implement. We just don’t do it because we would end up breaking other games. If we removed the SecuROM drivers when we un-install our game, we could end up breaking other games that need those drivers.

So, compatibility issues aside, the only way anyone is going to justify removing DRM drivers, is if they no longer buy or play games. In which case, you might as well re-install your OS and give up gaming.

One of the many reasons why I liked Byteshield was because it didn’t rely on drivers in any way, shape or form. So when you removed the game, you essentially remove Byteshield. Same thing with schemes like Armadillo, Software Passport etc. All of which are so easy to crack that you might as well not implement any DRM.

Implementing more than one DRM scheme presents its own set of problems. If you don’t adopt a worldwide standard, then it is a pointless venture. e.g. why implement different schemes in different territories when they can all be cracked anyway? Thats just more work because each has to be implemented and tested. Then the end goal is to see which gets cracked first. If they e.g. crack the Starforce enabled Russian version, then they’re 90% of the way to cracking the SecuROM English version. So why bother with two DRM schemes?

YES VIRGINIA, IT CAN ONLY GO DOWNHILL FROM HERE

And let me just point out one bit of rumour mongering nonsense right now. The drivers in the versions of Tages, SecuROM (no drivers detected in our version) and Starforce ProActive5 that we have, are NOT Ring0 level drivers. No matter what you read online, I can tell you clearly – and without breaching NDA – that none of these use such a driver. If they use drivers, they are top level drivers (i.e. not nesting between other drivers) that are not much different (at least not by much in terms of the OS level integration) from your video or audio card drivers.

This whole DRM rumour mongering nonsense, is just that, nonsense. Conjured up by mere mortals. The same mortals who are fallible in every sense of the word. It is not my job to defend anyone’s product, let alone walk a minefield like DRM discussions, but the fact is that in most cases, most of those making the loudest noise are doing so just from sheer pack/mob mentality because it just feels good to be one of the “guys”. Or fear. Or due to being under the influence of a controlled substance (OK fine, cough medicine then?).

FACT: There are millions of gamers happily playing their DRM enabled games with nary a problem. Sure, there may have been problems in the past but that has nothing to do with the present. People having DRM related (what are those problems anyway?) problems are no different from those having problems installing or un-installing their audio/video card drivers. And in most cases, a trip online is all that it takes to solve the problem.

The reason that the DRM argument is so loud – and noisy – is because gamers, by their very nature, are a very loud and vocal bunch.

At the end of the day, DRM scheme aside, the onus is on developers/publishers to ensure that they have performed stringent tests on any DRM scheme that they implement and to ensure that such a scheme does not

i) treat gamers like criminals

ii) prevent gamers from enjoying a game they paid for

iii) present incompatibilities as a result of any such DRM implementation

This is why we don’t leave our DRM implementation to the last minute.

No piece of tech is perfect; so at the end of the day, it is all about what you are willing to accept and compromise. e.g. a company like EA can afford to do whatever they like and still come out on top. Think about this. Both the The Sims 3 and Spore are amongst the most pirated games in the entire history of gaming. And both used a DRM scheme – and even more relaxed in The Sims 3. Small devs cannot afford to lose a single sale of a product, let alone anything remotely close to a million units. So in short, we have to be more careful in what we do.

And even though we have experience with SecuROM, for the past three weeks we have been working closely with Sony’s engineers in ensuring that the standards that we have for our game and gamers are not compromised. At the end of the day, the scheme we go with for the game’s final release will depend on only two factors: money (what the scheme costs us per unit) and performance/reliability (the negligible performance impact on our game).

OF MICE AND MEN

In conclusion, instead of being a member of the pack, why not just go over to Reclaim Your Game and PYAITK? The more educated you become, the better off we as gamers and game developers are.

Until next time.