Chapter 7: Protection Mechanisms for Preventing Playback in PC CD-ROM

Castrated Lead-Out

Another popular method of preventing the playback of Audio CDs in PC CD-ROM drives is invalidating the TOC contents in such a way as to make the pointer to the Lead-out area point to locations closer to the disc s beginning than the actual Leadout. The overwhelming majority of low-end CD players ignore the value of this field, since they don t need it. PC CD-ROM drives, on the other hand, behave less predictably when encountering an invalid Lead-out. Some of them obediently stop the playback after the time specified by the TOC elapses. Some drives simply freeze, vainly trying to find the fictitious Lead-out in a location where there isn t anything of the sort (this may even happen before the start of playback, that is, immediately after loading the disc into the drive). Although some drives are intelligent enough to guess that the TOC has been purposefully disfigured (or, perhaps, they simply ignore it) and successfully bypass this protection, but this is something that you can t count on.

To create a protected disc, you ll need any normal audio CD (which we are going to protect) and any protected CD copier (such as Alcohol 120% or Clone CD). The CD recorder doesn t necessarily need to support RAW DAO mode.

Having created the image of the disc that you are going to protect, open the CCD-file created by the copier and find the following text string: point=0xa2 . This is the entry that points to the Lead-out area, the address for which is stored in the PMin , PSec , and PFrame fields, containing the values in minutes, seconds, and frames , respectively. Reduce the absolute address to a reasonable value (28 seconds, for instance), save the changes, and burn the edited image onto a CD-R/CD-RW disc. Wait some time for the burnt disc to cool down (just kidding!), remove it from the drive and insert it into any low-end CD player. The protected disc will play normally in almost all cases; although, some chance of running into problems remains. Now, insert the test specimen into a PC CD-ROM. The drive will obediently stop the playback at the 28th second.

In practice, this type of protection can easily be bypassed. Create a disc image using Clone CD, and edit the TOC by restoring the correct Lead-out position. To determine the correct value for the Lead-out pointer, manually view the content of the Q subcode channel. Find the track with the TNO field containing the value 0xAA . Note that Clone CD can remove such protection on its own.