Found this on a website...
dont know if it will work

Source: Chip.de

As I´ve seen this, I was impressed, but in the end it is logical.
The most recent versions of Cactus Data Shield and Key2Audio try
to confuse the CDRom drive with a additional data track at the
end of the audio CD.
Now we try to "cut" off this track, with using a normal glue strip:



This should work, but it is a bit dangerous, since the CDROM drives
spins the CD with real high speed, and so the strip may loose.

Better is to do it this way, but if you reach the audio track
misstakenly, the CD is defect !

With the permanent marker pen you need to cover the dividing line and
parts of the outside track without affecting the last audio track



Hope this helps

Here's one more picture...

This is a layout of Cactus DATA Shield 200
(Daten means Data In German... )

Well, chip.de have some great tricks on breaking audio protections so give it a visit...

If you can't read German, use http://babel.altavista.com/ to translate German into English

Also here's another link 2 translate the website...
http://216.239.37.120/translate_c?hl...26lr%3Dlang_de

This one is bannerless and it's just like Babelfish, some words there are weird...

If you need one that is good but w/ banner...
go here:
http://www.translate.ru/

I have heard about this 'trick' before but never saw screenshots. Seems like a nice trick to try someday when I can get some CDS protected discs.
I'll move this thread to the Audio forum since it has nothing to do with CloneCD.

Here you can also find a screenshot.

Thanx for posting this information and these screenshots!

To everybody: you can use this 'trick' to copy audio-protected cds if you don't have a reader which can handle the protection.

Considerations:

• Preferably use a non waterproof marker instead of using tape. Tape could fly off when reading the cd!
• With some hardware you might still not be able to copy the protected disc... my LiteOn ltd-163 and LiteOn ltr-40125s still won't read the audio tracks after the use of the adhesive-tape-trick/hide-illegal-session-trick.
• As you can see in the pics, the second session is clearly recognizable, this makes it easy to use this trick. Unfortunately this will be a lot harder for Key2audio... Apparently Key2audio available on recently released cds uses version 3 of Key2audio. With this version you can't see the gap between the 2 sessions...

Does anyone have a layout of Key2Audio then?
I would just like 2 take a look of that

I have 2 key2audio cd's (both apparently with v3 of key2audio). No matter how I look, no matter how I let the light reflect, I can't recognize something which indicates the second or third session...

Some people used our newssubmit to have this news posted on the frontpage. I decided to put it up: www.cdfreaks.com/news2.php3?ID=4068

Let's see if we can get some reports on this
If it really works then bye, bye CDS...
Key2Audio may be a little harder as Upp3rd0G said.

wouldn't it be easier and safer to just run a audio cable from a cd player to the line in jack on the back of the computer and record it that way?

Most people prefer a digital copy, you are talking about an analog copy.

i know it is an analog copy, but if you have decent equipment it doesn't sound that bad.

If you can't see the gap between the sessions near the rim of the cd, you could try to mark just the outerpart of the end of the data part on the cd near the outerrim. The extra sessions (with the protection 'inside' it) are always situated near the end of the cd.

So just mark the outerside and try if you can play the cd.
Playable? => Try to play the end of the last track to find out if you didn't cover too much with your marker.
Not playable? => extend the marked part of the cd, and try again.
Playable, but not the last track? => decrease the width of the marker and try again.

I haven't tried this myself, but I am going to try this this weekend. I will let you know the results.

I don't think it's the end for CDS, they will just make a new version (400?) where you can't see any difference between first and second session...

I don't think many people will try to defeat that and clutter all over the disc... But I'm sure someone will try...

I think Midbar just modifies CDS200, they will not give it a new productname when they made just a small modification to the CDS200 protection...

i just got a new idea.

To keep the cd drive from autorunning to temporarily disable it, hold down the shift key when inserting a cd. Then, use a program like Isobuster or something else that will bypass the windows reading and use it to extract the audio files off of the cd

Always disable 'auto insert notification' and 'autoplay'! If you have these settings enabled there is no way too make sure that Windows did not try to access the protected audio cd. When windows tries to access the protected audio cd, the protection in effect is 'activated'. Activated means that the illegal entries confuse the standard reading routines of the firmware of your drive or that the illegal entries confuse the windows reading routines. This is something you really want to prevent! Programs like CloneCD/Feurio/EAC/Isobuster use special reading routines which can cope better with the protection!

ahh but if your stereo has a digital out like mine does you can run the fiberoptic cable to your sound card(and if you have a decent card it should have a digital in) and you have a digital copy. or you could take the digital out cable and put it in a rackmount burner and copy the songs that way, it burns in real time but you will have an uncopy protected cd.

... everyone seems to have forgotten that the likes of Cactus (according to their patent and my experience of their ba**ard creation) also uses scrambled and deliberately tampered with data in the audio portion of the disc as well. This is one reason why so many people (and not just audiophiles) have complained that the discs sound bad in some systems - my copy of White Lillies Island sounded like Natalie was singing with her head down the toilet when I found one of my players that didn't reject the disc but the replacement, unprotected version courtesy of BMG sounds as expected).

Sure, hiding a data session may make the disc more "accessable", but how good a backup copy would be is still going to depend on how good your hardware / software combination is at sorting out the mess that Cactus introduces.

There is no way that a post it note or a permanent marker is going to put that right, I'm afraid...

@Garry Heather

From what I have heard CDS uses also tricks on C2-errorcorrection level. C2 errors are recoverable errors. Personally I don't have experience with these tricks, my orginal and backups of Natalie Imbruglia sounds like it should sound (I think... at least I am sure it doesn't sound like Natalie is sticking her head in the toilet ), but then again I don't have high-end audio equipment, (it is just a little bit better than the average stuff (Denon cd-player, $350 6 years ago)). Can you explain why some high-end audio equipment have problems playing this cd? Are you sure that your high-end cd-player is fully compatible with the Redbook audio format? (Maybe high-end audio manufacturers have used tricks, which don't comply to the standard, but give better results with a non-protected audio cd, but these tricks might not work on a protected audio cd which may result in bad sound...)

It's not necessarilly high end that's the problem - in fact I would suggest it's more likely to be the cheapo decks that have difficulties, or semi-intelligent players that can say be upgraded by software on CD's, and decks (like DVD players) that can play different formats especially MP3 compatible devices.

From my experience with my original copy of WLI:

Would not play at all on an old Technics CD "walkman". Disc spun up like hell and the player shut down (with the disc still spinning).

Would not play track one and sounded rubbish through most of the disc on a Clarion in dash car CD player, loathed to eject too, which was worrying. Disc seemed to want to keep spinning. Had to turn the electrics off at the ignition, reapply the power and press the radio button immediately then the eject button in order to get the disc out.

Played OK after several "Disc ERROR" warnings on the same head unit but when the disc was in the boot mounted changer. Sometimes it worked, sometimes it didn't. Sounded iffy on occasions.

Played OK on a Sony DVD player but the sound seemed a little muted. Maybe I was getting picky as well as annoyed at this stage.

Old Yamaha AST-C10 - Track one played for an apparently infinite amount of time but in silence, closer examination showed a track time of -1 second going to 2 seconds than back to -1. Track 2 OK, track three up to the point I got well upset and needed beer sounded rough as hell.

Philips PCD-048 CD-ROM drive - seemed to play fine, didn't try ripping it because I was more keen on getting a red book compliant CD out of BMG since I paid good money for it and didn't like doing unpaid "guinea pig" research for Midbar Tech.

Unprotected version, sweet as a nut on everything. Funny, that. Thanks, BMG !!

My understanding of how the protection works in part is that rogue error codes are put into the disc content in places where there is a lot of duplication or regular bit patterns (a bit like the weak sector amplification tweak on CloneCD) and the player should be able to skip over these and / or guess at what the data should be. My older decks and a couple of CD players I had access to at the time seemed to be the least tolerant of the munged disc than the newer ones. In fact I happen to know that at least one recent CD player has had a modification made to it because it refused to play a David Grey CD (White Ladder ?) widely reported as being copy protected.

Apart from the fact I don't appreciate someone deliberately introducing errors into a medium that I chose for it's quality (if I wanted it to sound to naff I'd have bought it on tape and left it in a hot car for a few weeks and saved myself a few quid in the process), it makes me wonder just how good the CD player's error correction will hold up to light scratches, finger prints and curry stains if the error mechanism is already shot to hell out of the box.

I hope that clears up a few things - my experience is probably far from the norm but my line of work means I have been able to try the CD on a few decks and may well have found more than my fair share of problems. But then if the established format for the CD hadn't have been tampered with, I shouldn't have found ANY...

Regards,

Garry.

This is the part I have not figured out yet... I know what C2 errors are, but I don't understand how the manufacturers of audio copy protections use this to fool cd-rom players (and old regular cd-players and some high-end cd-players) so you can't copy/rip the audio tracks. You say: 'rogue error codes are put into the disc content in places where there is a lot of duplication or regular bit patterns'. This I really don't understand. Can you say anything more about it?

I totally agree with you! This is the baddest part of the protection! Besides the fact that the protection won't let you play it on your cd-rom player or your stand-alone dvd-player (which is based on a computer dvd-player sometimes, especially the drives which can also play mp3 and where its firmware can be upgraded by inserting a cd with special datafile), they deliberately introduced (correctable) errors so this must mean that the protected audio cd will sooner have uncorrectable errors than an unprotected audio cd!!!

And because it can become easily damaged, we definitely need a way to backup these disks!!!

If you're interested in having a look, the first part of the Cactus patent is widely available and in the public domain at:

http://www.delphion.com/details?&pn=US06208598__

It is my belief based on my understanding of the principles involved and what information I have to hand that by finding parts of the data on the CD that is very similar, you could mess about with that data, especially on the low order, least significant bits, and the difference in audio terms should not be that noticeable.

Here's an easy example. Consider a fairly large number, like

1000.

Say that last digit becomes a 1, you get

1001.

Which is as close to the original number as makes practically no odds in a numerical sense (ok, what that number represents WILL make a difference, but in this example it's only a number and the "error" is a very low percentage).

Now if that FIRST digit was incremented by 1, you would get:

2000.

Which is obviously twice as big as the original and really noticable.

Now if we relate that to the binary audio data on a CD, it stands to reason that low order errors are not going to be that noticeable, and if the error correction of the player, if required, could interploate some missing or otherwise corrupt data, thus:

1000 <- real data

100X <- missing data, clock fault, etc. Error flagged, guess at 1 or 0

If the player "guesses" wrong and puts the last digit as a 1 instead of a 0, in sample terms you won't even notice a flaw in the audio because it's barely there.

Now if I remember correctly, the audio on a CD is interleaved so that a small scratch or some dust on the surface will not mean a whole chunk of data is no longer readable or guessable in one form or another. My belief is that Cactus locates a portion of audio data where there is a lot of consistency or low order bits, screws about with them, deliberately puts a hard error on the disc, and either leaves the interleaved portion alone or just tweaks the lowest bit(s) to create a subtle shift.

I believe that, in the ideal world, the CD player would come across the obviously flawed data, and would be able to interpolate or otherwise "second guess" what the data should be using the interleaved portion and the average listener would not notice anything screwey going on.

BUT what I think is happening really is that sometimes the players consistently read the bad data and this intereferes with the error correction (I notice that players with shock protection seem to fare better with these discs which may be evidence, albeit circumstantial) and we get bad sounding audio, skips and so on as the pick up tries to maintain tracking and a reliable stream. This would certainly explain my experience of an album apparently recorded in someones tiled bathroom !

Now if you apply this to a "smart" device like a CD-ROM which has to be accurate in reading the content of a disc (you throw an executable out by one bit here and there and tell me if it still works or not !!), such a knackered disc will cause problems. Similarly, if it tries to correct the data and comes across shifted patterns and error codes that don't correspond to anything or are highly repetitive, you will at best get a nasty sounding extraction or an error.

Now if you have a disc that has errors deliberately put onto it and then let your kids loose with it for a day or so, or forget to put it in the jewel case and someone slides it off the edge of the table in order to pick it up easily, you could scratch the disc and introduce many, many more errors that you might have got away with before, but have now presented the player with a disc that is similar to reading a book that someone has ripped a load of pages out of. If the scratch and errors deliberately put on a disc have erradicated several blocks, the audio will drop out, click or even cause the CD player to reject the disc. This is what I am guessing is what I have experienced albeit on a disc fresh out of the case.

Of course, this could all be cobblers - it's just how I would consider doing it based on my experience to date and information in the public domain. If anyone has a link to the Cactus patent proper, please post as I'm sure a lot of people would be interested in it. Speaking as a bit of a purist (and not someone who works for Philips, who also take a dim view on this if recent news reports are to be believed) and someone who can actually appreciate the problem of piracy, I still think deliberately knobbling an inherant part of the CD structure to be a very bad thing. Minor difference or not, if I've bought some music, I want it to be the best quality, not some second rate trash. Now if they slashed the price in half to reflect the lower quality I wouldn't mind so much.

But there's no chance of that, is there ?

Thanx for the interesting information you supplied! I will delve into this part of the copy protection!

Question: do cd-rom players never use interpolation while reading audio data? Interpolation is only used by audio cd-players?

The patent link you gave is also interesting, too bad you need to subscribe to Delphion in order to get more info than the page you supplied us with...

If you have more technical info on these matters I would like to have that information!

Well, I thought this was interesting.

Before I got rid of my nasty pressing of WLI, I had access to an old CD-ROM which wouldn't play the disc over the IDE bus (ripping by any other name) but WOULD play the disc if you just connected the drive to a power supply and pressed the play button on the front and listened with headphones.

That would suggest in this instance that the drive would play the disc as a conventional player but something was interferring with its ability to read the raw data.

I would guess that this is where the fact that some people don't have problems and some do come into it.

The fact that the disc would play in the CD-ROM drive if the PC was not in any way in control of it suggests that something running on the computer or the firmware in the drive was responsible for the discrepancy. I suspect that if you have a drive which does jitter correction (accurate stream) then chances are Cactus will cause it problems as it tries to find sectors on the disc that don't return one hell of a lot of errors. Damn, I wish I never got rid of my old 2x CD-ROM now !

Thinking about it, I reckon that by default the drives will try and return a perfect representation of the data, and this combined with the software running on the computer (ie how it handles errors, retries etc) is what decides whether or not you can rip (don't forget that if you CAN rip, the player is still having to interpolate the munged data thus you still don't have as good a quality as you could have had, had the disc not been tampered with - a bit like burning a CD from a track that has been previously compressed in a lossy manner, ie MP3). If you could get a drive - or tweak one - to return interpolated data for audio applications instead of one that insists on cleaning up the mess and return that data to your application instead, I think the issue of Cactus would be mute bar the degraded audio at source and thus lost forever.

I suspect that if you had a drive which could return the data accurately but blindly in 2352 blocks and could decode this in software, you could theoretically apply the interpolation at that software level and thus circumvent the protection, however since the amount of Cactus tweaking will most likely not only differ from CD to CD but from track to track, second by second*, you would probably need to analyse the data in order to try and work out what data is real and what is the errors deliberately forced into the audio. A bit like a brute force attack on a password or DVD decoding, if you prefer.

* since the audio content will obviously change throughout the duration of the track, it stands to reason like variable bitrate encoding of an MPEG2 video that the level of protection will NOT remain constant. To complicate matters further, if I was creating a copy protection scheme based around shafting the data I would also implement a level of randomness and / or persistance into the algorithm as well, just to make life difficult for a cryptographic attack, or put in a sliding scale of persistance that means that one track could be heavily encrypted at the start and end of the track where the fades are (and thus have more places in which to put corrupt the data at low order bits), but less agressive in the "real" content, for example. I bet Midbar have thought of this long before me...

Hey software guy. Can you please post the exact link for the site to the art.cle chips.de made? I can't read german, and the two pictures you posted don't load, so i don't know where to put the tape! Is there an English site for a guide about Key2Audio and CDS??

Also, are you saying that cds with 2 sessions in it with a session of data in it is a CDS200 protected cd? I ask this because i have a cd which when you put into the pc, it runs its own software to play the cd, and also has a ring separateing the 2 sessions like the 3rd picture you posted(one where cd is labeled)

thank you