Several years ago, I got concerned about the preservation of some home movies we still had on 8mm and VHS tapes. The formats were already practically obsolete and I wasn’t sure how much longer the playback devices would survive anyway. The 8mm Sony HandyCam had developed problems with some of the control and volume keys, for example. Also, no one wants to fast-forward through a 2-hour VHS tape to find that one short clip of the first day getting on the school bus.

I purchased a fairly cheap KWorld DVD Maker USB 2.0 (VS- USB2800D) capture device from Newegg that came bundled with a copy of CyberLink PowerDirector 7 and I started converting some of our 8mm tapes into digital format. PowerDirector did a really nice job converting these tapes into MPEG-2 videos with well- synchronized audio. I was pretty happy, especially given the low cost of the setup. I captured several full tapes and trimmed them down into separate videos of the various events they contained.

There was one extremely annoying bug, however. Some of the videos I was working on had gaps or noise at various points in the tape and when PowerDirector reached these spots in the tape, it would stop recording and pop up a message saying, “This movie is copyright-protected. Recording is prohibited.”

How utterly insulting. My guess was that the software was confusing the noise for the presence of an old analog copy protection system called Macrovision ACP (Analog Copy Protection). Or more likely, the USB capture device’s hardware implementation of the check for ACP was. Although I wasn’t allowed to digitize my home videos, at least some filthy video pirate couldn’t rip their VHS copy of Weekend at Bernie’s II and post it on the internet. Crisis averted! In any case, I got sufficiently annoyed and set aside the remainder of the shoebox full of tapes to digitize another day. I did not want to babysit the capture process and intervene every time it suddenly decided I was trying to record copyright-protected material. A few weeks ago, we cleaned out the hallway closet and found some more 8mm and VHS home movies that I had not yet digitized. I remembered the remaining tapes from the first batch as well.

In the intervening time since I digitized the first batch, the crappy laptop computer running Windows Vista that I had been using to work on the videos died. I plugged the KWorld USB video capture device into the replacement computer, a desktop running Windows 10, and reinstalled the PowerDirector 7 software. No dice. Although the latest driver for the capture device was installed correctly (e.g., VLC and VirtualDub could capture from the device), PowerDirector couldn’t initialize it correctly in order to use it. At that point, I could have tried to capture the rest of the tapes with VLC or VirtualDub but I really liked the quality of the output from PowerDirector. I also had persistent audio synchronization problems with VirtualDub that I did not feel like trying to tune away. I had paid for PowerDirector, after all, so I decided to reconstruct the working setup I had before. I used a spare hard drive to install and boot the desktop into 32-bit Windows 7, installed PowerDirector, and was back in business - PowerDirector 7 could read from the capture device again.

I was quickly reminded how annoying the copyright protection bug is. The few tapes I started on contained lots of short scenes with video noise in between and the ACP check was tripping frequently. As the copyright holder for these videos I’m trying to digitize, I hereby grant myself explicit permission to copy them. I decided to fix this bug once and for all using Immunity Debugger. The following is a summary of what I did. I’m sure there are more efficient and precise methods and there may be other more powerful tools but hopefully someone finds this information useful.

After starting PowerDirector under Immunity Debugger and navigating to the PowerDirector “Capture” tab, I searched through the process memory map for instances of the string “macrovision”.

One module in particular, PDRecord, has a large number of occurrences in its .data section so I looked at the code in its .text section.

Next, I searched for “All referenced text strings” in this module and then searched that result for “macrovision” again.

There were a lot of matches and I decided to go ahead and set breakpoints on almost all of them. I skipped a number of addresses that had strings with clear references to hardware that did not match my own and some other fairly obvious conditions. Immunity Debugger allows one to simply disable breakpoints instead of unsetting them entirely so I could come back to interesting code later if I needed to.

Based on what I had seen in the code, it looked like the general operation was for PowerDirector to set a filter in the capture device for the ACP check, periodically check for the triggering of that filter, and set a flag based on that check. My goal was to start looking for return values that appeared to be a simple flag. If I could modify the return value, I could bypass the check for the presence of what the capture device and software misinterpreted as ACP.

It took a bit of trial and error and a few false starts but I made my way to the code shown below. Notice how the return value from the callee is set to 1? I went back and confirmed that if the offending video signal is not present at this execution point, the value of EAX is 0. Let’s make sure it’s 0 all the time. We can do that by simply changing the MOV to XOR EAX,EAX.

Returning to PowerDirector, I observed that I could now hit the Record button and save a file without getting the copy-protection message.

This is how I felt.

Now that things appeared to work correctly, I saved my changes back out to the file so that I could later run PowerDirector outside the debugger.

I can now record my home videos without the copy protection bug!

My sincere thanks to Immunity for releasing such a powerful and intuitive tool.