Do bad ISOs/BINs/ROMs/whatevers even exist? Can they be compromised?

[BLAHblahBLAH123456]

Hello Everybody,

I am new to the forums here, just wanted to pop in and ask a few questions: one about general computing as it related to emulation and another about the way isos/bins/roms/whatever work here at Emu.

As for the first question: Is it possible to get a "bad" iso/bin/rom/whatever? (Im just going to say "iso" from now on...) Meaning an iso that some random dude maliciously cracks, inserts bad code (or works voodoo magic, etc) and posts online to harm people who download and use it in conjunction with an emulator? If these files are indeed crackable, is there any way (aside from simply trusting the source) to ascertain how clean and virus/bad code free the iso is?

This kinda brings me to my second question: where do the isos on Emu actually come from? Some of the links on the forums link out to other sites for the download, so that is pretty obviously not hosted here, but what about the isos that one gets from the list on the left side of the Emu page? We never leave the Emu domain, but we are given a download link. Where do these links lead and how trustworthy are they?

I would greatly appreciate any information you guys could provide, as well as any input you may have to offer. And if I have posted in the incorrect forum, I would ask a mod to move it to the appropriate one. I figure for now, "Everything Emulation --> Arcade, MISC & PC Games" ought to be a good place to start. So, lets begin!

Cheers,
BLAH

[Ragnar]

1) Yes technically everything can be cracked by a skilled hacker. But it just isn't done, it's easily caught, has little payoff, and somebody with those skills is better served tweaking the latest Windows build and throwing a torrent on TPB. The worst intentional modification I've ever seen done is somebody inserted a secret porn stash into one, which is a pretty good place for a kid to hide porn I guess. Parents would never find that.

You can EASILY discern if a rom/iso is clean by pushing it through whatever auditing system is appropriate. People that know what they're looking at have spent countless hours verifying what's perfect, and distributing that information. An easy example to look at would be Redump.

2) Aside from the forum uploads everything on EP should be hosted on its own servers. Virtually everything hosted on EP was placed there by MasJ, the site owner.

[Zorlon]

There are bad dumps still though in the way that some of the games are not dumped correctly rather than any sort of hack to make things go bad in the way of a virus the only one I ever came across was an early DS mod by the guy that originally cracked the DS also made a virus that would in effect brick the DS (this had no effect in emulation or on a PC), but that is an old one and was rectified by the same guy and has never happened since and not something that can be found now anyway

I like to collect clean sets so
Redump
Trurip/Tosec (Trurip took over a lot of CD based sets but those started as tosec sets)
No-Intro
Those are the best ones to collect for good dumps of games without mods ect...

Redump has a mix and match of sets some I prefer to get the trurip sets of instead or even as well as depending on how complete they are, mostly I edge towards trurip though, with only a few exceptions

Trurip sets are not that easy to come by though

Goodroms Not a one I like to use because of all the mods and junky homebrew slideshows ect but for those that want everything from hacks (as in modded games) 3rd party developed games aka homebrew as well as dodgy slideshows and demo's, then good roms is the only way to go

There has only been one bad rom I have seen that bricked the DS (can't be found now and was done by the same guy that cracked it in the first place) that had no effect to any computer systems only effect was on the DS, that wasn't pretending to be a game it was pretending to be the same as the original crack or an update to it that let you play backup DS roms from a GA flash kit and an original DS cart (this was from before there was any DS flash kits or passme/passthrough devices)

So yes they have existed in the past but even then it was not heard of, it's just not something that happens day to day or even year to year

There are no virus containing roms or iso's on our main server, though some have been found not to work, as in they just got dumped badly

Note that some games may seem not to work at first on not work as intended to but this can often be because of Copy Protection rather than any bad dump, the common ones are PSX & DS that have some games with protection against backup play, but there are various ways round those

[MaslowK]

As for the first question: Is it possible to get a "bad" iso/bin/rom/whatever?

Others have already answered why it's highly unlikely you'll find actual .bin, .iso, etc that have been compromised, but there's another dirty trick you should watch out for. A lot of download sites will advertise their downloads as being what you're looking for (say the .iso, or even .zip or .rar files), but when you click the download links, will give you a .exe file instead. Here's a good example of this scheme. Sometimes they'll be named something like "name of game downloader.exe", other times more like "romname.iso.exe".

The second one can be harder to spot if you don't have file extensions for known file types enabled, as all you'll see is the legitimate-looking extension (the .iso part).

Normally showing known file extensions isn't enabled by default in windows, and for reasons like that I always recommend people do. If you haven't already done so, this is how. Open up a folder window then click Organize near the top left corner, then "Folder and search options". In the new window that comes up, click the View tab, then scroll down the list of items it shows until you find "Hide extensions for known file types", and uncheck it if it isn't already unchecked, then click Ok.

[BLAHblahBLAH123456]

Ragnar,
1. Thanks for the explanation (as well as an interesting, yet seriously funny story). I'm of the same opinion, that anyone with skills would undertake something more lucrative, but I also happen to be quite paranoid when it comes to this kind of thing. Mostly because there's a lot I don't understand about it, I suppose. At the risk of sounding completely asinine, I'll admit that I had no idea what you and Zorlon were talking about my first 3 read-throughs of your comments. After reading the Redump Wiki and a couple of forum posts elsewhere, I think I understand the jist of it. My next question would be: what defines an appropriate auditing system and how does one go about using the appropriate files (SHA1, MD5, etc) to actually audit the iso/rom?
2. Ah, I see. So does that mean that every file in the "ROMs, ISOs, & Games Section Listing" of the Emuparadise site is hosted by Emu directly? Or is it possible that there would be a download link in there somewhere that brings you to a 3rd party-hosted file?

P.S. Your avatar and sig pics are ridiculously cute. And what does Ragnar mean? Did you just chop off the "ok" when "Ragnarok" was already taken? (JK)


Zorlon,
Those domains should all prove to be useful for later when I actually know what I'm doing and can validate my own isos/roms. So thanks for listing them. I definitely wouldn't have stumbled upon them otherwise. Sadly, Tosec is undergoing maintenance right now, so I couldn't check them out yet. You also mentioned Copy Protection on some PSX and DS rips, which prompted me to do some research on that. I just couldn't figure out why my Final Fantasy VIII and IX (German versions) refused to work in the past. Now I know it's Libcrypt that was giving me all those problems, and I can finally play them! Completely unrelated to my original question, but a welcome surprise nonetheless. So thanks for that.


MaslowK,
I definitely appreciate your warning about the file extensions trick. I don't think I would have thought to check, but now I'll be more diligent. I actually did a full wipe on my computer a few weeks ago and forgot to re-enable show file extensions, so for a few days, I was just scratching my head whilst using my file explorer trying to figure out what was wrong. It wasn't until I tried to change a .txt to a .html that I realized what it was.


Thanks for the responses guys!
Cheers,
BLAH

[Ragnar]

My next question would be: what defines an appropriate auditing system and how does one go about using the appropriate files (SHA1, MD5, etc) to actually audit the iso/rom?

Every console has a different assortment of tools available, it takes some research to see which one you'd prefer. I'll let Zorlon explain some usage (if he feels like doing it), I haven't actually used this auditing stuff since GoodTools.

2. Ah, I see. So does that mean that every file in the "ROMs, ISOs, & Games Section Listing" of the Emuparadise site is hosted by Emu directly? Or is it possible that there would be a download link in there somewhere that brings you to a 3rd party-hosted file?

I think MasJ may have experimented with mirroring some files onto filehosts. But it's a pain in the ass, stuff just falls offline, I don't think he's doing it anymore. It's plainly clear if you find such a link, and those links were just offered as options on the download page. You could always find the link to download off EP right there.

P.S. Your avatar and sig pics are ridiculously cute.

Masao. Not everything is cute, good god, those Mario pics are infamous...

And what does Ragnar mean? Did you just chop off the "ok" when "Ragnarok" was already taken? (JK)

I just borrowed a name I liked when I wandered onto the internet in the 90s:
http://en.wikipedia.org/wiki/Dragon_...sen#Characters

[Zorlon]

Rom Auditing

The best one is ClrMamepro
The other that I would not really use for checking roms myself but is cool as a front end for sets that is RomCenter

Both use dat files, most of those checksum sites use ClrMamePro dats though they can be converted or imported into RomCenter anyway

ClrMamePro kind of has a deceiving name that insinuates it is only for MAME roms but this works with any roms set dat as well as iso rom dats

http://mamedev.emulab.it/clrmamepro/index.htm
www.romcenter.com

[Warrior]

If you wish to learn how to easily audit your various sets you will need to learn the ways of CLRMAME Pro - http://mamedev.emulab.it/clrmamepro/

And DAT files, I am still learning on how to use it correctly but all of my friends are efficient at using them .

Me on the other hand tend to screw up using them to check/update so I just redownload sets when the time is right.

Regarding your original question, only disc images you have to worry about are rebuilt iso's of PC games/software from places like TPB and the like, those can possibly contain viruses/malware.

[BLAHblahBLAH123456]

I think MasJ may have experimented with mirroring some files onto filehosts. But it's a pain in the ass, stuff just falls offline, I don't think he's doing it anymore. It's plainly clear if you find such a link, and those links were just offered as options on the download page. You could always find the link to download off EP right there.

Sorry to beat a dead horse about this, but what about this link here for Breath of Fire 3 for PSP for example: http://www.emuparadise.me/PSP_ISOs/B...rope%29/155737? In the "Game Release Info" section, it seems as though PGS were presenting the iso. Also, in the case of, say, Dragon Quest games for DS: http://www.emuparadise.me/Nintendo_D...ting-With-D/32, is it safe to say that the roms came from the names in parenthesis and the roms without the names in parenthesis were uploaded by MasJ? Even if it were the case for both of these, I guess the iso/rom could have been run through an auditing system and have checked out, making my point moot. Hm... any thoughts?

Masao. Not everything is cute, good god, those Mario pics are infamous...

. . . ? (Particularly masao, and I speak a little Japanese)

Rom Auditing

The best one is ClrMamepro
The other that I would not really use for checking roms myself but is cool as a front end for sets that is RomCenter

Both use dat files, most of those checksum sites use ClrMamePro dats though they can be converted or imported into RomCenter anyway

ClrMamePro kind of has a deceiving name that insinuates it is only for MAME roms but this works with any roms set dat as well as iso rom dats

Thanks for the suggestions. I needed a place to start. So I checked out ClrMamepro and did some reading up on it, and it seems like the industry standard at the moment. That having been said, I couldn't really figure out how it is supposed to "audit" my game files (meaning tell me if they have been tampered with, have a virus, etc). After re-arranging my game folder to that ClrMAMEpro would recognize my files, I ran a scan, but the results are confusing me a bit. For example:

My Japanese copy of Breath of Fire IV had a few suggested fixes. The first was to resize the .cue from 283 to 265.

So if I resize the .cue, what does that actually do? What does it mean that my .cue is too big? That it was a bad dump? And the results say that my .cue has the wrong crc32. What does that mean?


The next prompt was to remove an unneeded file (a .ape).

Does this also mean that my dump was bad since I have a .ape sound file instead of the second .bin that the scan results say is missing?

If you wish to learn how to easily audit your various sets you will need to learn the ways of CLRMAME Pro - http://mamedev.emulab.it/clrmamepro/

I really wish you had said, "If you wish to EASILY learn how to audit your various sets . . ." I'm beginning to see why you have trouble with this...


Once again, thanks for the replies. And if I'm getting too far off topic here, let me know and I'll move to a different, more appropriate thread.
Cheers,
BLAH

[Zorlon]

It means the file is still compressed

the cue sheet may not be the original either though by the sounds of it

ClrMamePro is very easy to use, best to start with a rom set though, there are less complications to find

The dat you want though is the redump one that I presume you have anyway that will e the est you can get for PSX dumps

APE and ECM files are still compressed though and require you to un-ecm to bin format and convert the APE files back to binary *.bin files

But I can tell you now you will not find any virus's inside of any of the PSX games stored on our main site anyway

[Ragnar]

Sorry to beat a dead horse about this, but what about this link here for Breath of Fire 3 for PSP for example: http://www.emuparadise.me/PSP_ISOs/B...rope%29/155737? In the "Game Release Info" section, it seems as though PGS were presenting the iso. Also, in the case of, say, Dragon Quest games for DS: http://www.emuparadise.me/Nintendo_D...ting-With-D/32, is it safe to say that the roms came from the names in parenthesis and the roms without the names in parenthesis were uploaded by MasJ? Even if it were the case for both of these, I guess the iso/rom could have been run through an auditing system and have checked out, making my point moot. Hm... any thoughts?

Games with those names and nfo files are scene releases. Basically when a new game comes out, respected groups in the dumping scene all rush to get the game on the internet first. The winner basically gets their name on the game forever as payment, assuming they threw out a good dump. If it's bad that stuff gets quickly sorted out, when/if a bad release happened collectors/distributors label it "nuked", it stops spreading around and somebody else gets their name on it.

Scene releases may not pass current auditing, newer dumping methods may have been created in the years since a games release. But even so, the scene releases have been beyond extensively tested, and are assuredly fine to play.

Edit: Here's a information listing of that copy of Breath of Fire 3:
http://renascene.com/info/umd/287

Renascene notes if PSP scene isos are good, and if not points you at fixes and stuff.

[BLAHblahBLAH123456]

the cue sheet may not be the original either though by the sounds of it

I think I finally figured out the problem with the cue sheet. It IS the original, though the original from EMU (found at: http://www.emuparadise.me/Sony_Plays..._%28J%29/52918 ), which doesn’t follow the naming conventions used by Redump. So the FILE line of the cue looked like this:

FILE "Breath of Fire IV - Utsurowazaru Mono (J) (Track 1) [SLPS-02728].bin" . . .

When it should look like this (according to Redump):

FILE "Breath of Fire IV - Utsurowazaru Mono (Japan) (Track 1).bin" . . .

So, after changing the FILE lines, the file size is correct (according to what ClrMamePro said before) and the scanner didn’t say that it had a problem with the cue. I assume that no problem means the data is perfect, meaning the checksums are good too.

A brief word about checksums (crc32, MD5, SHA1, etc). I think I understand what they’re about now, but I would appreciate it if you would just hear me out and let me know if there’s anything faulty in my understanding.

So a crc32 is just a string of letters/numbers which is the product of some polynomial division and other processes, which generates a unique code from some set of data (say a BIN in this case, like Breath of Fire IV). It’s mostly included with downloads to make sure the data wasn’t damaged or corrupted in any way during transfer/download. So one just takes the crc32 provided with a download and compares it to a crc32 that one generates from the data he has after downloading it, and if the 2 crc32s match up, that means the data is perfect, right? Nothing got screwed up during transfer. Because there is some possibility of having 2 files with the same crc32 (cause crc32 has only 36^8 possibilities?), we can use other checksums like MD5 and SHA1, which are just longer, more complicated, more accurate versions of crc32. So in this case, if I generate a crc32 from my “Breath of Fire IV - Utsurowazaru Mono (Japan) (Track 1).bin” and it matches the crc32 that Redump has, it means that my file is totally clean and all the data is identical to Redumps 'perfect dump'? And that becomes even more certain if the MD5 and SHA1 match up too?

ClrMamePro is very easy to use, best to start with a rom set though, there are less complications to find

By rom set, I guess you mean “Full Sets in One File” like found here: http://www.emuparadise.me/Complete_R...ile%29_ROMs/37? So I should download one of the full sets and run it through ClrMamePro just to see how the program works, since there won’t really be any problems with a full set I get from there?

APE and ECM files are still compressed though and require you to un-ecm to bin format and convert the APE files back to binary *.bin files

Ah, that makes sense. I feel kind of stupid now for not realizing sooner. I just read your “ECM And APE Guide” (found here: http://www.epforums.org/showthread.p...73#post1251373), which suggests using Monkey’s Audio to go from APE -> WAV, then using “WAV to BIN.exe” to go from WAV -> BIN. As the guide is a few years old, would you say that’s still the best way to do it, or is there some other, better method you would now suggest?

Games with those names and nfo files are scene releases. Basically when a new game comes out, respected groups in the dumping scene all rush to get the game on the internet first. The winner basically gets their name on the game forever as payment, assuming they threw out a good dump. If it's bad that stuff gets quickly sorted out, when/if a bad release happened collectors/distributors label it "nuked", it stops spreading around and somebody else gets their name on it.

Ah, ok. So these groups rush to come up with a perfect dump (meaning just uploading the checksums [crc32, MD5, SHA1] like I was saying above, or loading the complete iso online?), and when the dump is verified by a second dump, their name is immortalized by being put in parenthesis next to the file forever?

Scene releases may not pass current auditing, newer dumping methods may have been created in the years since a games release. But even so, the scene releases have been beyond extensively tested, and are assuredly fine to play.

So there is no real benefit to finding an iso that passes current auditing methods over a scene release which I may already have? Or is there still some kind of preference to having the best dump period?

Renascene notes if PSP scene isos are good, and if not points you at fixes and stuff.

So, as you said above, the scene isos are tested extensively by tons of people, and Renascene would comment if a scene iso were bad. Do you know offhand of a scene iso on Renascene which is contested/bad? What I mean is: it would be more helpful for me to witness a contested scene iso and see how Renascene handles it instead of merely postulating about what one would look like, should it occur.


Thanks again for all of your posts. I'm trying to be as receptive as possible, and I'm really learning a lot here.


Cheers,
BLAH

[Warrior]

Renascene is pretty much the best source on all things PSP scene and they give accurate information on all dumps, if a game is listed as unverified its unverified, etc. etc.

[Zorlon]

Still the best way and is no way as old as the dumps done

Though that exe to change the wav to bin may detect as a virus as it is a simple convert from a batch file that just changes the file extension from wav to bin just create the bat file or just change the settings in Monkeyt audio to output in raw bin format

[Ragnar]

So a crc32 is just a string of letters/numbers which is the product of some polynomial division and other processes, which generates a unique code from some set of data (say a BIN in this case, like Breath of Fire IV). It’s mostly included with downloads to make sure the data wasn’t damaged or corrupted in any way during transfer/download. So one just takes the crc32 provided with a download and compares it to a crc32 that one generates from the data he has after downloading it, and if the 2 crc32s match up, that means the data is perfect, right? Nothing got screwed up during transfer. Because there is some possibility of having 2 files with the same crc32 (cause crc32 has only 36^8 possibilities?), we can use other checksums like MD5 and SHA1, which are just longer, more complicated, more accurate versions of crc32. So in this case, if I generate a crc32 from my “Breath of Fire IV - Utsurowazaru Mono (Japan) (Track 1).bin” and it matches the crc32 that Redump has, it means that my file is totally clean and all the data is identical to Redumps 'perfect dump'? And that becomes even more certain if the MD5 and SHA1 match up too?

Absolutely correct.

Ah, ok. So these groups rush to come up with a perfect dump (meaning just uploading the checksums [crc32, MD5, SHA1] like I was saying above, or loading the complete iso online?), and when the dump is verified by a second dump, their name is immortalized by being put in parenthesis next to the file forever?

Well not necessarily verified by a second group. Simply not discredited by a second group is enough.

So there is no real benefit to finding an iso that passes current auditing methods over a scene release which I may already have? Or is there still some kind of preference to having the best dump period?

There's no real benefit. You can go for better if you want, it comes down to how OCD you want to get on everything.

So, as you said above, the scene isos are tested extensively by tons of people, and Renascene would comment if a scene iso were bad. Do you know offhand of a scene iso on Renascene which is contested/bad? What I mean is: it would be more helpful for me to witness a contested scene iso and see how Renascene handles it instead of merely postulating about what one would look like, should it occur.

This is a game that needs fixing. The fix packs it mentions are uploaded on the forums here.
http://renascene.com/info/umd/2839

There are a lot of underdumps like this. Just dumped with old software AFAIK, and the missing 2kb are usually just 0's that don't do anything.
http://renascene.com/info/umd/91