One of the audio-cd protection systems, devloped by Sony. Most of the big labels have standardised on this protection now, so you wont find many other protection technologys. I expect key2audio CDs to beome more commonplace, espicially as the RIAA has announced plans to copy-protect all CDs.

Tracks can be ripped to files using either the standard analog method or, for people with suitable hardware, a digital audio cable. Digital ripping requires a sound card with a digital in capable of accepting the TTL logic level of a CD-drive digital audio output, or an adaptor can convert a CD drive digital audio out to the voltage level used by standard digital or optical connections. If you have enough money you can buy CD players with digital outputs.

This system can cause problems in imacs. It lockes them up and restarts them. They dont boot while that disc is in. But it also disables the eject button. Only cure is a paperclip in the manual eject hole. If your mac doesn't have a manual eject hole, its screwdriver time. This mostly affects the new iMacs. The warning on the disk ("does not work in pc/mac") could be an understatement.

A very unusual hack has been discovered for these now. Key2audio works using a corrupt outer track. CD players ignore that track, but CD-rom drives will attempting to read it and get locked in a loop of retrys. If they cant see the track the disc works perfectly normally. You can see where that track is by looking closly at the data side of the disc for a slightly different shade of silver in a ring. Get a black pen and carefully draw over the protected track. Now it plays in CD-ROM drives perfectly. Intrestingly if you now brought a pen to to copy a disc the pen would be classed as an illegal circumvention decive under the DMCA.

http://www.british-audio.org.uk/problemcd.html explains the technical side in more detail. Important section quoted here:

The Key2audio disc is a multisession disc, with several sessions each having lead-in, data and lead-out areas (but without visible dividing bands between them). The first session is normal and contains Red Book audio, but the lead-ins to the later sessions contain deliberately incorrect information. This mis-information points to other sessions, and these sessions contain deliberately incorrect timing and sync data.

An audio player should play only the first session and ignore all the other sessions, so never see the bad data they contain. But a ROM drive will look at the later sessions and become confused by the bad content. So PC play - and with it PC copying - is prevented. But the corruption can crash some computers, prevent re-boot and physically lock the disc inside the drive; it can also prevent normal playback on consumer players which happen to use ROM drives.

Plain K2A discs do not play at all on PCs. A newer feature called Key2AudioXSplus includes protected computer playable files on a data session.

The idea behind this protection is to make it hard for CD-ROM drives to identify the disc as being an audio CD. The disc is multisession, and uses a hacked TOC, so track rippers and disc copiers have trouble dealing with it. SunnComm hasn't publicly stated any details.

In August 2001, SunnComm announced v2.0 of their product, but didn't provide specific details.

Some personal notes on SunnComm's protection of the Charley Pride disc, including the steps I took to get a clean copy:

The packaging is labeled with the SunnComm logo, and states, "This audio CD is protected by SunnComm(tm) MediaCloQ(tm) Ver 1.0. It is designed to play in standard audio CD players only and is not intended for use in DVD players." However, my DVD player was able to play the disc after overcoming some initial confusion.

The disc itself has an unusual construction. There is a heavy band at about the point where the music stops, and thin bands between tracks. These appear to be purely decorative (and, I'm told, increasingly common on non-protected discs). Some images are available on http://www.fadden.com/cdrpics/.

A computer running Win98SE with a Plextor 40max CD-ROM drive saw the disc as having two sessions and 16 data tracks. My CD player only saw 15 audio tracks. This feature alone makes the disc difficult to rip or copy, because the software doesn't see any audio tracks, and a CD-R copy would be full of tracks that even a CD player would see as data. Another machine, with a Plextor 12/20 and a slightly different set of software, seemed to have a lot of trouble figuring out what the disc was. It eventually sorted things out, but I get the sense the disc has been tweaked in ways that confuse the drive firmware.

I tried using "Session Selector" to select the first session and then access the tracks. This resulted in a Plextor 8/20 CD recorder becoming unusable until a reboot. I'd guess the firmware got confused.

The next thing I tried was to crank up CDRWIN v3.7a (section (6-1-7)), and extract some tracks using my Plextor 12/20. No dice -- the display showed 15 unselectable tracks and 1 MODE-2 data track.

Next, I tried the "Extract Disc/Tracks/Sectors" function, selected "Extract Sectors", chose "Audio-CDDA (2352)" for the data type, and entered a nice range (0 to 300000, where each audio sector is 1/75th of a second). This choked when trying to read starting at block 173394, so I tried again stopping at 173390. This resulted in a rather large WAV file, which I opened with Cool Edit -- revealing the entire contents of the disc, plain and clear. Playback revealed no audible defects.

I believe this worked because the sector extraction function ignores track and session boundaries, and just pulls the blocks straight off. Losing the track markers is annoying, but it's easy to add them back with something like CDWave (section (6-2-16)).

(FWIW, this same approach did *not* work for the _My Private War_ disc with the damaged TOC, described in (2-4-2). It would probably not be of help with a SafeAudio disc either.)

"zEEwEE" came up with a complicated but enlightening scheme for side-stepping the protection on discs with damaged second TOCs. It has the advantage of allowing you to use standard tools, such as Exact Audio Copy ( section (6-2-12)), which keeps the track breaks and can do fancy tricks to get the best extraction quality. See http://cdprot.cjb.net/. [ I'm told the disc used as an example was actually protected with Midbar Tech's Cactus Data Shield 100, not MediaCloQ. ] The method involves making the outer rim of the disc unreadable to the CD-ROM drive. It appears you can use dry erase markers instead of adhesive stickers for the procedure, which is good since an adhesive label might peel up and damage your drive. This method, first posted in August of 2001, resulted in a flurry of media attention in May of 2002.
CD-R FAQ, used without permission

Early versions of suncomms protection were infamous spyware, requireing users to register personal information to play the CD on computers:

Let me give some examples of DRM technology that have been introduced. Sunncomm, the record company, introduced a system that restricted the ability of individuals to listen to music on their computers. Purchasers of the copy-protected CD were required to disclose their name and a variety of personal details in order to gain access to the digital content. And, Sunncomm's privacy policy allowed the companies to share the information with business partners. There was no right to opt-out. Ira Rothken, a California attorney, sued Sunncomm and in a settlement, guaranteed that the company will not use the information or continue collecting information in exhange for access to digital content.
Somewhere - I lost my notes on this one

Another audio cd protecter, first produced by Midbar Tech, but now owned by Macrovision Corporation. The Midbar Tech website is here, with some very vague information on the CDS system.

There were rumors of CDS copies damageing speakers. Its partially true. A square wave will damage speakers. Because part of CDS is designed to affect error correction in rippers it would be possible to make a disc which "corrects" to a square wave if its ripped. However the speaker-damageing effect would have to be deliberatly applied to the protection, and because of potential lawsuits and angry customers it has never actually been used. New scientist once mentioned it.

Like key2audio, CDS can sometimes be defeated with the felt tip pen :-). Newer versions fix that problem by removeing the visible ring. A pen would still work, but its almost impossible to get the mark in the right place.

Also like key2audio, CDS can sometimes lock up macs, which must be rebooted to eject the CD. Both technologys use multisession CDs, and are probably almost identical.

I have finally completed the first stage of my own study of this protection system. It is, well, PATHETIC! It stoped all my rippers easily enough, and the player programs tamper proofing is beyond my (admitidly poor) debugging skill, but I found an intresting flaw. When I used cloneCD to image the disc I was able to mount it as a virtual drive (again, using cloneCD and the clonedrive feature) easily. The virtual drive appears as an audio CD, and every ripper and player works flawlessly on it. I presume if I was to write it to a CD that would play as well :-) Safeaudio provides protection from all the elaborate hacks, but is defeated by a simple raw copier. I suppose results might vary depending on CD drive used to read the CD through.

Cactus data shield is produced by Midbar tech (since aquired by Macrovision Corp) and is available in three versions.

The first version, CDS-100, is a plain audio CD protector. These CDs are playable in most audio players, but not PCs. Like most audio CD protections, it doesn't work well if at all in games consoles, DVD players and professional CD players.

The second version, CDS-200, will also play on audio players, but also includes a data track which holds compresed and encrypted tracks and a secure player. CDS-200 CDs can be played in windows PCs, but only using the CDS secure player on the disc. The secure player doesn't use the audio track (which is inaccessable because of the dud TOC), instead reading compressed encrypted low-bitrate WMA format audio from the data track. As if this isn't annoying enough, the player doesn't run from the disc. It has to be installed, and it writes junk to various pieces of ths system applications are supposed to leave alone.

Some rippers can handle CDS-200 discs, such as Feurio! and Exact Audio Copy, but only on certian systems. Its dependent on OS, drive hardware and firmware.

The latest version, CDS-300, will allow limited low-quality "personal use" copying based on windows media player DRM or plugins. Users can use WMP to "rip" the CD to their hard drive, but only to encrypted WMA format files, which cannot be edited, copied, transfered to another computer or converted to another format. In theory these could be transfered to one (and only one) WMA and WMDRM compatable portable player, but I dont know if any portable players with the required level of DRM are available yet. Protection on these files is secure, but the bitrates not too good and its not very difficult to get to the raw PCM sound in the audio tracks.

One person has studied these discs in detail and published information on his own attempts at ripping.

Again, the (rather outdated on this protection) CD-R FAQ has some usful information:

Midbar Tech Ltd (http://www.midbartech.com/) appears to have two different schemes under the "Cactus Data Shield" brand. (The web site shows three now: CDS100, CDS200, and CDS300.) The first uses a non-standard TOC. The position of the lead-out and the length of the last track were tweaked, resulting in a disc that appears to be only 28 seconds long. The alterations didn't confuse all CD-ROM drives, and it has been reported that some Philips CD players couldn't play the discs. BMG Entertainment reportedly tried it and abandoned it.

In late 2001, Midbar Tech announced a different approach. A US patent (http://www.delphion.com/details?&pn=US06208598__) describes the invention.

The approach appears to involve inserting frames of bogus control information into a relatively constant part of the CD audio stream. During playback, the extra frames are skipped. A disc copy or digital stream on an S/PDIF output will include the bogus frames, and when written to CD-R the extra control information won't be included. The result is bad samples that only appear in copies.

A protection technique which is carried through an S/PDIF (and presumably toslink, as every layer except physical is identical)? Facinating. Finally, here is my own evaluation:

Analasys of a CDS200 protected CD

The CD being used here is "Rod Stewart: The great american songbook" published by BMG. The CD packageing only mentions the protection in one paragraph of very small print (repeated in german). The retailer, Virgin megastore, has added a much more visible label stateing "This product features copy control technology".

The CD works perfectly in an ordinary CD player, but fails to play in both a CD/DVD player and a Playstation 2.

The packageing does not state the protection system used. When I inserted the CD in a windows 2000 computer it was recognised as a data CD. Directory follows.

\autorun.inf 31b
\MacPlayer.app 2.01k
\player.exe 56.0k
\UninstallPlayer.exe 44.0k
\UninstallPlayer.txt 197b
\player\audio.dll 36.0k
\player\audio.exe 1.94M
\player\CDSPlayer.app 497k
\player\info.ini 2.26k (hidden)
\player\Lang.dll 36.0k
\player\macaudio.dll 1.48k
\player\skin.exe 708k
\player\version.txt 27b (hidden)
\player\wmmp.exe 392k
\player\yucca.cds 800M (large!)
\player\Interface.nib\classes.nib 35b
\player\Interface.nib\info.nib 528b
\player\Interface.nib\objects.xib 12.7k
\player\skin\about.skn 13.0k
\player\skin\info.skn 20.5k
\player\skin\main.skn 57.5k
\player\skin\playlist.skn 13.5k

The file version.txt contains two lines, "CDS200.0.4" and "4.0 build 10a", indicating the disc is protected using the CDS200 protection system.

Of particular intrest is the 800M file yucca.cds. An 800M file might fit on a high-capacity CD, but not with audio tracks as well. Obviously something strange has been done here. The file probably has a falseified directory entry, possibly containing the audio tracks.

Of more immediate intrest is the TOC. Windows does not recognise any audio tracks, so clearly the TOC has been altered. But strangely, when the disc is copied to an image file using CloneCD and the resulting file mounted with the associated CloneDrive, the virtual CD appears as an audio CD and is easily playable or rippable.

Update: The Register did a review of a CDS300 beta. This is some facinating tech. Based on a hidden session, but backed up with a stealth-install CD-ripper-blocker (Not too stealth - it installes only if you agree to install the DRMed 'personal use' features'). For archiving, I made a local copy.

Another audio CD protector. Like the CDS protections, audiolock is produced by macrovision corp, but MV appears to be trying to drop audiolock to concentrate on its CDS systems. Again http://www.british-audio.org.uk/problemcd.html Explains:

Macrovision also has another system, called AudioLock which can stop people using a PC burner by preventing all playback on PCs and CD and DVD players that use ROM drives. Deliberate errors are added to the Table of Contents (e.g. to say the lead-out comes immediately after the lead-in or wrongly describing music as computer data). These errors stop CD-ROM drives dead in their tracks, but music CD players usually just go on playing until the disc ends.

Variants of this system alter the timecode information in the P and Q "subcode" data channels. Once it has started to play a track, a music player should ignore the bad code (albeit displaying incorrect time), but a ROM drive keeps on checking the code, tries in vain to correct the errors and shuts down.

Yet another audio CD protector produced by Macrovision. Originally by TTR technologys, but then sold to macrovision. Better known for their analog video protection technology macrovision has started moveing into audio protection. Unlike CDS and K2A the safeaudio system cannot be defeated by a pen. Usual methods here. Copy the entire disc with a raw copier, use a CD player with digital output or rip tracks analog.

In some versions, and if the CD has the feature enabled, safeaudio will rip protected CDs to the hard drive for you, in a DRMed format obviously. The music can then be played without the disc. After a while the disc must be reinserted to ensure you havn't sold it or given it to a friend. This feature is called SafeAuthenticate, and is based round the Windows Media DRM system. You could try freeme or unfuck from the utilities page to unprotect the safeauthenticate files, but then all you get is an unprotected WMA file, when a lossless WAV would be far better. The analog ripping and raw copy methods still work obviously. But the best way is to use the replacement CDFS.VXD. It rips safeaudio discs perfectly ( I think, havn't tested it myself). I have a copy on the tools page.

There are expensive home audio recorders available, which anyone without a PC can connect to their stereo. Those devices usually rip CDs to MP3 on an internal hard drive, play MP3s and record mp3 back to CD. Those recorders only work if you use those "audio CD-R" discs.

Every audio CD-R sold sends a bit of money to the RIAA (more accuratly to soundexchange, a royalty collecting company owned and operated by the RIAA, famous for somehow giving the audio CD money to all the labels while ensuring the artists dont get any), as compensation for the copyright infringement they assume you are using it for. The discs are identified by a unique key, so the players can recognise them and check they are not being given an ordinary CD-R. Because the key is unique discs can also be approximatly tracked, so consumer audio CDs being counterfitted in a mass-pirateing operation can at least reveal what country the discs are produced in. These figures are used by the RIAAs lobbyists (ie "Were being ruined by piracy in (insert underdevloped country here)! They must set up excessive copyright protection before these pirates destroy the world economy!". The RIAA tends to go overboard a little when lobbying.)

You can use audio CD-R for data we well, but they are sometimes less reliable. Errors in audio CDs are not as serious as errors in data CDs, so often they are manufactured to lower standards. It also helps the RIAA, so use normal CD-R. Audio RWs are also available. Of course if copying protected computer games you have a much greater chance of success with data CD-R than audio, as these closer resemble pressed data CDs.

These audio-cdrs are attracting comment from critics of audio CD copy prevention. It seems obvious that there is no point giving the music labels money for assumed infringement and personal use if they are using copy prevention to prevent it anyway.

If you want to use a data CD-R in one of those home recorders there are ways. The usual method is to insert an audio CD-R, let it check its an audio CD-R, select what to record, and then open the tray using a screwdriver and replace the audio CD-R with a data CD-R. Simple, sometimes works, its very recorder-specific. Sometimes you need to cut the wire to a tray sensor as well, sometimes it doesn't work at all. It would be possible to make a firmware hack of course, but I have not found records of anyone having made one. In any case those are full of anti-tamper technology, partly for DRM and partly to stop repairs so they can sell you a replacement :-). The HP models are particually well known for that. They have a chip which holds the serial numbers of every componant, so parts cannot be replaced or upgraded. They are also programed to connect to an ethernet network and run a windows file server that will not allow read access to files, so its useless for backup.

SACD (Super Audio CD) is a sony-propritary audio format competing with, and very similar to, DVD-audio. The DVD FAQ explains this intesting piece of unusual protection, but its not the only protection issue:

SACD includes a physical watermarking feature. Pit signal processing (PSP) modulates the width of pits on the disc to store a digital watermark (data is stored in the pit length). The optical pickup must contain additional circuitry to read the PSP watermark, which is then compared to information on the disc to make sure it's legitimate. Because of the requirement for new watermarking circuitry, SACD discs are not playable in existing DVD-ROM drives.

Well, that seems excessive. A physical watermark? Why? Its not used to store actual audio content. I can only guess its to stop ordinary DVD burners writing SACD discs, so SACD must be stamped. It seems rather excessive, there are easier ways.

(Just out of intrest, in CD and DVD information is not stored in pit length but the transition between pit and no-pit. A transition is a one, no transition is zero.)

This laughably improvised technology is a recent product from Sunncomm. While most CD protections work by modifying the disc in some way, usually the TOC, to prevent computer CD drives reading the disc this also causes compatability problems in DVD players, games consoles, car CD players and high=end CD players. Mediamax takes a new approach. The TOC, error correction and everything else on the CD is perfectly standard. When a Mediamax CD is inserted in a windows 9x/me/2k/xp system or a macos X system, autorun (yes, just autorun, its that improvised) will run a program that installs a driver which will recognise that CD and disrupt attempts to read the audio section. This driver remains loaded in ram (waste of memory) until the next reboot. If you look in device manager the driver can be clearly seen. Stoping its process will allow CD ripping as usual. Its a very messy technique, leaveing software loaded, but at least Mediamax doesn't install it perminantly. Not yet anway. I woultn't be surprised if the intermediate-cd-driver also prevents some copy protected games working.

Mediamax ripping procedure:
1. Reboot.
2. Hold down shift to disable autorun.
3. Insert CD. Do not release shift until CD is loaded.
4. Rip CD.

If you dont realise how trivial it is to get past that, the software will permit you to make a few DRM restricted WMA-format copies. These are obviously non-transferable, but can be copied onto a maximum of three "secure" (SDMI? WMA? Both?) portables. Intrestingly, to gain access to this feature you must agree to a license which states

1.2. Your rights to use the Digital Content are conditioned on your ownership of a license to use and possession of the original Compact Disc (CD) media and are terminated in the event you no longer own or possess the original CD media.

Which means makeing a backup WMA copy is not allowed, because in the conditions where you need a backup you are legally forced to delete them. Also, macos 9 and linux (or other unix varients) are able to copy or rip the CD without problems.

A full report was released by John A Halderman. I made a copy as usual, in case of lawyers. Halderman has since been threatened with the DMCA by Sunncomm, who accuse him of damageing their reputation as well as a DMCA violation, and say his report cant possibly be fair because he didn't read their own whitepapers describeing (in non-techspeak) the system.

Mediamax has, at time of writeing, been used only on the Anthony Hamilton album "Comin' From Where I'm From".

A prevous version of this format was protected with CSS2 (specs in dvd_audio_CSS2.pdf for historical reference). After the DeCSS crack the CSS2 system suddenly became very unpopular with rights holders, so the format was switched to CPPM :-). CSS2 is no longer used, it was abandoned shortly after DeCSS was released because of a severe lack of confidence in a CSS-like technology. Specs are included here purely for reference.

As usual, quality is severly downgraded if you dont use complient licenced equipment from player to amp. Their description of CD-quality might look good, but remember it means going from six-channel to two-channel, probably with the cheapest downmixer available. Also, in a idea which is stupid even by Evil Empire standards, each recorder is only permitted to make one CD-quality copy. This is to prevent people from makeing many copies at CD quality and handing them out to their friends at school or work. This is acomplished by requireing every recorder (DVD-audio-to-CD recorders, I dont know how this would be implimented on SPDIF-linked recorders) keep a list of ISRC title identifiers copied to CD, and refuseing to copy a disc if its already been listed. That means nonvolitile storage, which means another expensive chip.

This would be a fairly effective anti-ripping protection, if it wasn't for one huge hole. The players are still permitted to use SPDIF or toslink outputs. They must be protected with SCMS, but thats ineffective, as must computer sound cards with SPDIF input ignore it.

The DVD-audio standard has been delayed, and adoption is currently almost non-existant. Music labels do not use DVD-audio because very few people have players (dvd video players do not plat dvd audio, yet) and CE manufacturers wont make affordable players until more music is available. To complicate things further, Sony refuses to go anywhere near the format because it competes with its very similar but propritary SACD format. I would have expected the entire usic industry to be in favour of DVD-audio and rushing to adopt it because of its (so far) unbroken encryption, but strangely they are instead useing various copy protected CD formats, with all their weaknesses and incompatabilities.

This system is used in Japan by Sony music. Recently, Sony announced it will be discontinuing production of Labelgate protected audio CDs. I found some vague information in English. Labelgate is a form of two-session system: one containing the protected audio portion, the other encrypted-compressed audio and the tamperproofed player applicaion. Unusually, Labelgate version 2 allows users to copy a CD onto a computer hard drive in DRMed form an unlimited number of times, but charges for each copy using an internet-based system. The pricing is ambiguous - I believe it is 200 yen per track, but individual tracks cannot be copied. Only whole CDs. So an eight-track album will cost 1600 yen, even if only one track is wanted.