1. Make your own, free saved game server and alter the application code to use it.
This means a lot of work and expense, both to duplicate Ubisoft's game saving code and to set up and maintain the servers. Won't happen.
I'm not even a very good game hacker, and I've done much more dramatic things. It's really not a huge deal. People have reverse-engineered entire online game protocols in order to have their own unofficial servers before the games were even out of beta. The client<->server model of protection is actually a good thing to cracking and the people who use cracks, since the original binary doesn't need to be modified in any way. You just run a little thing in your system tray that emulates whatever portion of the server protocol it needs to. And now you can also get the official updates from Ubisoft, re-activate with your own fake server any time, etc. It's not a "disable one line of code" type deal, but if you think that's even a simplification of how things have been for a while, that's pretty naive.
This is assuming the game is complete, what if the server is sending back parts of the game in response to state saving. For instance, perhaps some of the AI is running remotely. This could explain dropping out of the game: the game is unable to continue.
They could do that. Run some portions of the game on the server, which would remove some of the game logic from the client, making any sort of crack to require adding back in instead of simply stripping out logic.
They probably will not do anything non-trivial for this. It costs money to run servers, and they would have to run much more powerful servers in order to be running game logic for each player. That would eat into revenue, and this game is not even subscription-based.
They don't actually have to run portions of the game on the servers. They can just serve bits of logic code back to the client as certain milestones are met. You can easily cause 1000's of halting points in a program at the price of just a few kilobytes of data this way.
The point is not to make a game hack-proof. Just to make the time to crack long enough for your purposes. (In this case, it just has to last a few more weeks than ususal.) Safes are rated like this, partly by the worst-case time it takes to break into them. http://en.wikipedia.org/wiki/Safe
EDIT: I see from other posts that AC2 has been cracked since 2 weeks before release. In the case of safes, the laws of physics are on your side. In the case of general purpose Von Neumann architecture computers, the mathematical laws are on the side of the crackers.
In short, if you can execute it, you can read it, therefore you can crack it. To work perfectly, which is equivalent to working at all, DRM needs a "trusted" execution environment supported by hardware. Even a server environment is not going to cut it.
It's not settled computer science that the content protection problem always favors attackers, although it's clear that the state of the art does.
I'm only reacting to the "laws of physics" comment you're making. It's not true that "if you can execute it, you can read it", at least for important definitions of "read" (that include "understand" or "modify"). Take, for an example, white box cryptography.
Some problems clearly favor attackers (executing code on general purpose shared Von Neumann architectures with general purpose operating systems). Other problems favor defenders (the halting problem). It's also the case that, smart as (say) 'DarkShikari is, high-end performance graphics and systems coders are not necessarily expert practical compiler theory people.
What would be a summary of that part of "White Box Cryptography" which is new and distinct from the software obfuscation techniques that have been around for most of the history of programming? Is it more than just a bit of mathematical formalism applied to such? That's all I can tell at a first glance.
Within the context of this discussion: WBC on AES would mean that one would be able to execute a white-box AES software implementation, but would not be able to "read"/extract the secret key that is used.
Basically, WBC is a set of very dedicated obfuscation techniques to implement a cryptographic scheme in a "secure" way.
IMHO, The main disction with "usual" obfuscation is the following:
* Obfuscation is a computer science term that refers to hardening a given application, such that it is difficult to reverse engineer. That is, to make it difficult to understand what functionalities are implemented, and how.
* In white-box cryptography on the other hand, an adverary will know that a specific scheme (such as the AES) is implemented, and how it is implemented: the compiler and program specifications are public; the cryptographic key, and the randomness that is used at compilation-phase is private. This is similar to the Kerckhoffs-principle in cryptography, where the security of a scheme should not break down when the specifications of a scheme are known.
If you have any further questions, feel free to contact me.
In the near future, I plan to setup a webpage on http://www.whiteboxcrypto.com where I will adress these issues, and explain how WBC works.
It's a legitimate question by a curious onlooker who's was just introduced to the whole concept of "White Box Cryptography." Apparently there's not a whole lot of proofs, though I perhaps it's plausible to get something useful proved.
Hopefully for it, your (non) answer is not telling.
It costs money to run servers, and they would have to run much more powerful servers in order to be running game logic for each player.
Heh... This is assuming that they do not realize that the more players are connected, the bigger the distributed computing cluster they have available.
the original binary doesn't need to be modified in any way
It's easy for Ubisoft to also force the binary to be cracked: have the client request the server sign a random token with its private key, and verify it with a public key embedded into the client. This way a third party server could only be written if the client was also cracked to either change the key or remove the check.
It's a loss for them either way -- if Ubisoft goes out of their way to add this feature, the effort required by the crackers is proportionally smaller.
I tend to think most of the draconian copyrape is actually internal political maneuvering at these large publishers. Ways for one department to counter another's with figures "look! After implementing xxx DRM scheme in order to prevent loss from copyright infringers in market yyy, total predicted sales volume was not met by zzz! In addition, piracy rates remained at or above zzz1! This proves that our console-focused sales track etc etc" Kind of like how the digital distribution from EA for Crysis actually did not work at all, probably on purpose, for various reasons pertaining to retail and corporate in-fighting (my theory, anyway.)
Something tells me both game developers and crackers have been at this a lot longer than Skype... I remember playing cracked Atari games as a young kid, but back then I didn't know what "cracked" meant. In case anyone wonders, I found the games in a huge box of 360K floppies that came with the Atari system when I got it.
3. Hack the game to not need to save games on a remote server.
This means a hacker has to figure out the saved game format, somehow jam into the application new code to write the saved data and new code to read it, TEST IT, and get it to work.
In most of the cases, there is no need to figure out the game format. Just read the binary data sent to the server and save it. Usually save game files are not that large and I suspect that most games read them at once to the memory.
Again you don't have to write a lot of code to do all these stuff. Just redirect whatever is sent to the Ubisoft server to a local server host in the same machine. This way the user can carry the save file anywhere. This is an added advantage for pirates while legitimate users should rely upon Ubisoft to save their game files for them. Heck, they can even play when the Ubisoft server is down, or even if there is no internet connection.
They could (probably have) limit that approach too by signing the data (as already suggested) or encrypting it with different keys for sending / receiving.
There are people working on it... whether or not they will succeed, I can't say, but considering that fake WoW servers exist, I'm guessing they'll pull it off eventually.
This means a lot of work and expense, both to duplicate Ubisoft's game saving code and to set up and maintain the servers. Won't happen.
I'm not even a very good game hacker, and I've done much more dramatic things. It's really not a huge deal. People have reverse-engineered entire online game protocols in order to have their own unofficial servers before the games were even out of beta. The client<->server model of protection is actually a good thing to cracking and the people who use cracks, since the original binary doesn't need to be modified in any way. You just run a little thing in your system tray that emulates whatever portion of the server protocol it needs to. And now you can also get the official updates from Ubisoft, re-activate with your own fake server any time, etc. It's not a "disable one line of code" type deal, but if you think that's even a simplification of how things have been for a while, that's pretty naive.