Digital rights management (DRM)

Digital Rights Management (DRM)

• Types of DRM
• DRM-free (Steam list)
• Stores
• Middleware
• DRM removal

With relation to PC gaming, digital rights management (DRM) is commonly used to refer to copy protection and/or technical protection measures employed by companies in an attempt to limit the manipulation and copying of game data and content by end-users after the purchase, download, and/or install of the product.

Technically speaking, the term refers to all form of access control technologies used to control the use, modification, and distribution of copyrighted works, as well as systems that enforce these policies, regardless of how it affects the end-user.

More information

Copy protection

Digital rights management

Controversy

Due to its very nature DRM sparks controversy as the limitations/restrictions enforced can, and sometimes will, affect customers as well. The consequences for customers can either be intentional or unintentional; therefore DRM requires a balancing act on the part of studios where the intended purpose of the DRM (e.g. prevent cheating or delay piracy) is weighed against possible customer inconveniences (e.g. prevents modding or offline play).

Examples of controversies:

• DRM is not always disclosed on the retail packaging or digital store page and might be installed silently on computers, sometimes without user consent. Many people as an effect do not know they have DRM software installed on the computer, nor how it might limit or restrict their use of the software.
  • The DRM itself, or data related to it, might also undisclosed remain on a system after the protected software is removed.

• DRM can make resale of computer software difficult, in some cases impossible, which conflicts with the exhaustion/first-sale doctrine many countries follow. See DRM and second-hand software for more information.

• DRM can present an issue for long-term games collectors as it can lead to games becoming completely locked out as CD keys are lost, studios close or withdraw support, or online services are discontinued. This can be resolved by studios issuing a patch that removes the DRM, although not all studios do this.
  • It is possible that existing installations may continue to function, but new installations will no longer function unless the DRM is removed or bypassed.

• DRM might have its own compatibility issues, causing unexpected hardware/software problems or lower the forward compatibility of the protected software.
  • Early versions of StarForce allegedly caused strange behavior in some optical drives, occasionally making Windows XP unable to detect and access CD-ROMs.

• DRM might malfunction, and flag a legitimate game as pirated.
  • The copy protection of Command & Conquer: Red Alert 2, Command & Conquer: Generals, and The Battle for Middle-earth series looked for signs of pirating (at the very least, an omitted or invalid serial key in the system registry) that was known to trigger even on legitimate installs, causing the player's units and structures to be destroyed after a short period of time after the match start, triggering an automatic defeat. The only fixes were to perform a clean game reinstall or a manual serial key fix in the registry files.

• Key-based or online-based DRM can be revoked without a customer's consent, has the potential for errors, and is susceptible to abuse from piracy.
  • This is more common nowadays in relation to grey market resellers whom might sell fraudulent keys to buyers that may have been or will become invalidated by studios.
  • For a few games key generators used for piracy produces install keys that can be registered on official platforms; flagging the keys that were shipped out to legitimate customers as invalid.
  • Some games might have a history of key banning for trivial reasons.

• DRM may contain security vulnerabilities that makes a computer more susceptible to malicious attacks. The more tightly integrated in the operating system a DRM is (such as "Ring-0 DRM"), the more critical a vulnerability becomes.
  • Security concerns with Macrovision SafeDisc's kernel drivers prompted Microsoft to disable/remove them from modern versions of Windows.
  • Ubisoft's Uplay browser plug-in (although not directly related to the DRM of Uplay games) were found to have a security vulnerability that could be exploited by an attacker using a specially crafted website.
  • Capcom's anti-cheat/DRM driver Capcom.sys, used at least in Street Fighter V was known for its vulnerabilities, to the point that it was blocked by Microsoft in newer builds of Windows.

Second-hand software

Used software is very susceptible to anti-piracy measures. Some problems can occur when buying used games, due to DRM or copy protection.

• Lost code wheels, manuals, or similar physical DRM. Older games, such as Pool of Radiance, require a physical tool to progress in the game. Used copies do not always include these materials, and online replacements may be difficult to find, rendering the game useless.

• Missing, registered, or banned keys. Games that require an installation key may not always have the key with them when bought used, preventing the use of the product. In other cases, games such as Fable III and Bulletstorm can not effectively be bought used because they combine a one-time key with an account-based DRM to tie the one-time key to the account owned by the user. Another potential problem is buying a used game, and finding the multiplayer, online features, or even outright play of the game disabled due to actions of the previous owner.

• Maxed out activation limit. Related to the registered keys problem, some software requires online activation, and used copies may fail activation if they have already been played. Activation effectively makes games unsuitable for resale or transfer.

Removal

DRM is often a critical component of a game, and a removal of the DRM might affect the functionality of the game; sometimes even make the game unplayable. Removing the DRM while these games are installed is therefore not recommended; although in some cases, running the game might reinstall the DRM. If you uninstall all software related to the DRM, the DRM can typically be removed safely. Many DRM companies provide a removal tool; other programs can be uninstalled directly.

Occasionally a developer will remove DRM from a game with a patch after a period of time. Patching the game in these cases is a legitimate way of running the game without DRM. For example, Civilization IV: Beyond the Sword was eventually patched to remove DRM and CD checks from the game, and Civilization IV and its expansions were re-released as a DRM-free complete edition soon after. Other games, such as some Epic Games Store and Steam titles, can be made DRM-free by basic file manipulations without the need of external tools or patches (e.g. using specific command line arguments to launch the game).

Circumventing DRM is illegal in some countries (unless consented by the developer/publisher), however there are circumstances where it is possible, legal, and advisable to circumvent or remove the DRM of a product.

The PCGamingWiki policy on bypassing copyright protection and fixes lists the restrictions that apply when it is necessary to cover bypasses for games in articles and files available on this site.

Anti-cheat

While the primary intention of an anti-cheat protection is not to enforce or serve as the copy protection of a game, because of their intended goal being to prevent players from gaining an unfair advantage over other players they often enforce similar, or sometimes harsher, restrictions on customers as regular DRM meant to limit piracy (copy protection).

See the main article for more information.

DRM-free

GOG.com, ZOOM Platform and itch.io generally deliver DRM-free copies of games, although some might require additional DRM for online-based features. GamersGate, Epic Games Store and Humble Store also offer a substantial DRM-free catalogue, and some titles on Steam are also in essence DRM-free post-download. For a list of games, see DRM-free games and DRM-free games at retail.

DRM-free means a game is shipped without any technical restrictions on how it is installed, copied, or activated.

Once a DRM-free game has been bought and/or downloaded, it can be installed on any computer and copied freely between machines, with no activation limits.

Some DRM-free titles might require the use of DRM to access or enable online-based features.

Although no technical restrictions are in place on DRM-free titles, formal restrictions specified in the license may still apply.

Types of DRM

Disc check

Games which use a disc check include The Sims 2 and Age of Empires II: The Age of Kings. For a list of games, see games using disc check DRM.

Also known as CD/DVD check, it is an older form of DRM becoming less common as PC gaming moves to digital distribution.

The game will not run without the appropriate CD/DVD being present in the disc drive, and/or a specific file otherwise present only on the disc is detected.

This system will operate regardless of whether or not the entire game content is installed on the hard drive.

Frequent use causes disc decay over time, putting the media at risk of becoming unusable.

Can additionally be combined with several methods:

• Dummy files – inserting dummy files which point to segments of other files, resulting in significantly larger files when copying them.
• Illegal table of contents – uses a second data track contrary to ISO standards.
• "OverSized" – lead-out area on the disc is also used for the data, a method which could not be replicated by most CD-RW drives in the late 1990s. Present mostly in games on 659 MB (74-minute) CD-R discs.
• Intentional disc errors – damaging the disc in production so that an error in reading a sector would confirm the game is legitimate.

CD-key

Games which use a CD key include Command & Conquer: Red Alert 2 and Tom Clancy's H.A.W.X. For a list of games, see games using CD key DRM.

Also known as a serial or product key, the game comes with a unique code (often printed in the manual, on a sticker inside the game case, or more uncommonly on the exterior case), which the user must input to complete the installation. Some games (e.g. Empire Earth) require a key only for multiplayer access instead of the whole game.

In this way, the installer can verify whether or not a game has been illegally copied.

If activation is completed offline, then a single key has unlimited uses. Like physical DRM, these keys can often be found freely online.

If key activation is completed online, then a single key may be limited to a specific number of installations (see Activation limit). Retail copies of games requiring Steam or the EA app for example include a CD key that is tied to an account and can never be reused (see Account-based).

Online activation

Games which require online activation include Two Worlds and Earth 2160. For a list of games, see games using online activation DRM.

Requires an internet connection in order to activate the product.

This is often paired with identifying information about the user's computer.

The publisher can therefore track when the game was first installed, and how many times it has been installed since.

If used without a hardware-based token of ownership (the original game disc) or an account-based software license, the software license is typically tied to an easily duplicated and shareable serial key which necessitates the use of activation limits in order to discourage/prevent sharing the serial key.

Activation limit

Games that set an activation limit include Mirror's Edge, Crysis and Spore. For a list of games, see games using activation limit DRM.

Almost always used in conjunction with online activation, a limit is placed on the number of times a game can be installed simultaneously, or independently.

The most common limits are three or five activations, but some solutions would later increase this to 50 or even infinite.

After this limit is reached, the user has to contact customer support in order to extend their limit and install their game again.

Uninstalling the game may not free up an activation unless a specific 'de-authorizing tool' is provided (e.g. EA Games Authorization Management).

The need of enforcing activation limits came from the move from traditional retail disc-based copies, where the uncopiable disc acted as the hardware license and indication of ownership, to newer but crude digital distribution platforms where the license was instead tied to the easily duplicated and transferable serial key of a game. Activation limits were therefor imposed to ensure that the easily duplicated game and serial key could and would not be shared endlessly. Once digital distribution platforms and third-party DRM solutions matured, the permanent activation limits mostly went away as a result of the off-market DRM solutions replacing the easily shareable serial key of a game (which held the software license), to being account-based and tied to the buyer's personal account on the supported digital distribution platforms (which were not as easily or commonly shared).

Account-based

Services such as Steam and the EA app are examples of account-based DRM. For a list of games, see games using account DRM.

Once a game is purchased or redeemed, the copy is tied to a specific email address or account, and therefore requires online activation.

These services often allow unlimited product activations.

An account can only be used on one computer at a time, meaning a single account/library cannot be active on more than one PC simultaneously. One logged in user playing one game on one PC will prevent access to the entire rest of the library for anyone else.

Games can never be unbound from a user's account, meaning they cannot be given away, lent, traded or sold.

Always online

Games that require a constant internet connection include Diablo III. For a list of games, see games using always online DRM.

Some games, like Red Dead Redemption 2, Tony Hawk's Pro Skater 1 + 2 and Dota 2 in Source 1 engine only require an internet connection each time they are launched. Those games don't currently fit in the "Always online" category.

To play the game, the user must remain connected to the internet for the entirety of the session.

Any loss of connection will boot the player out of the game after a pre-determined length of downtime.

Game files may be consistently downloaded from the publisher's server in an attempt to reduce piracy (e.g. Silent Hunter 5 pre-patch).

If a game server is shutting down, the game will be rendered unplayable as there is no connection between the network and the game servers.

If the entire game is stored server-side, it is known as cloud gaming.

Cloud gaming

Google Stadia is an example of cloud-based gaming.

No game files are stored on the user's computer itself, instead the game is run on a rig set-up by the service provider and video and audio are streamed to the player over the internet.

Any loss of connection will boot the player out of the game after a pre-determined length of downtime.

No game files are accessible to the player.

Players lose access to the game once the service has gone defunct such as in the case of Stadia, unless if the publisher offers refunds or some other way for the player to access the game.

Physical

Many DOS-era games like The Secret of Monkey Island utilized some form of physical DRM system. For a list of games, see games using physical DRM.

A form of DRM that requires a random phrase or code to be entered in at some point during the game. The phrase/code can only be found in physical materials (or "feelies") provided with the game.

Sometimes integrated into actual gameplay as a puzzle or very difficult section.

A "defeated" DRM system, most of the physical content can be found online for free.

Digital releases of such games officially include scans of the physical objects (code wheels, manuals, etc.) which were used for the check.

The phrase/code usually needs to be entered in at every game launch and/or for every new game.

Floppy check

Games which use a floppy check include Donkey Kong and Arkanoid. For a list of games, see games using floppy check DRM.

Requires the floppy to be in the drive while the game is running.

Only found with DOS-era games.

USB dongle

A few games may require USB decryption sticks, USB barcode scanners, or special-purpose controllers to reach the proper gameplay. For a list of games, see games using dongle DRM.

Dongles may require drivers, which may in turn fail to work on newer OS versions.

Losing the USB dongle will cause the game to fail to boot.

PCjr cartridge

Games which use this form of DRM include ScubaVenture and Pitfall II: Lost Caverns. For a list of games, see games using PCjr cartridge DRM.

Requires the cartridge in a cartridge slot to play.

Middleware

Some games come bundled with and make use of additional copy protection and/or technical protection measures provided by middleware developers.

This section details the most common platforms and how they might affect users.

Certain middleware might also be designed to restrict the user's fair use rights.

Custom code

Many developers would add additional code unique to their games which would block game access or even sabotage the gameplay if a copy is detected by the game's code to be counterfeit.

Examples include the auto-defeat trigger in Command & Conquer: Red Alert 2 and the invincible arachnoid enemy in Serious Sam 3: BFE. For more examples, see List of games with custom DRM behavior.

May be triggered on legitimate copies in certain circumstances. See Controversy section.

ActiveMark

For a list of games, see games using ActiveMark DRM.

Online activation DRM created by Macrovision.

Used mainly by digital releases of Sega games from their store in late 2000s and early 2010s.

Since the activation servers have been shut down, any games which use ActiveMark are currently unplayable beyond the trial period (if one is available).

Official website (archived)

ActControl

For a list of games, see games using ActControl DRM.

Activation-based DRM released in 2010 and based on a licensed but heavily modified version of StarForce ProActive.

No longer functional as of late 2022 and unactivated games require a no-CD patch to bypass the activation check, or use this StarForce servers as a workaround.

Official website (archived)

Arxan Anti-Tamper

For a list of games, see games using Arxan Anti-Tamper DRM.

Used to strengthen the account-based DRM (e.g. Microsoft Store, the EA app, Steam, or Ubisoft Connect) of a game, considered an alternative to Denuvo Anti-Tamper and with similar functionality.

Used mainly by Microsoft-published games.

Battle.net

For a list of games, see games using Battle.net DRM.

Not to be confused with the multiplayer infrastructure of the same name.

Contrary to most other store-specific DRM, games released on the Battle.net application are required to be launched with appropriate account information.

Most games, like Diablo III, require a constant internet connection on top of the link to the Battle.net application to run. Others like StarCraft can be launched offline, but only if a recent-enough offline token has been stored on the computer.

CopyLok

For a list of games, see games using CopyLok DRM.

Also referred to as CodeLok. Not to be confused with the CopyLock DRM used on Amiga games.

Protection for games distributed via optical discs aiming to disallow disc duplication, used often for checking the disc.

Mostly used by Take2 and games by their subsidiaries (Gathering of Developers, Rockstar, etc) in the early 2000s.

Does not work on modern Windows versions and Windows XP support is limited.

Denuvo Anti-Tamper

See the main article for more information.

EA app

For a list of games, see games using EA app DRM.

Same as with Steam/Steamworks, the EA app provides a basic DRM wrapper and solution that protects against extremely casual piracy. An additional anti-tamper protection (usually Denuvo Anti-Tamper) might be used to strengthen the DRM of the EA app.

EA Cucko

For a list of games, see games using EA Cucko DRM.

Used in a few 2009-2011 EA games for checking the disc or online activation.

Used mainly by BioWare, EA Bright Light games and The Sims 3 spin-offs .

Keys can also be redeemed in the EA App.

Since the activation servers have been shut down, any games which use EA Cucko online activation and never got an EA App release are currently unplayable.

Enigma Protector

For a list of games, see games using Enigma Protector DRM.

Obfuscates the game executable in an attempt to combat piracy, cheating and modifications.

Suspected of negatively affecting protected program's performance.^{[citation needed]}

Used by Capcom games (primarily their back catalog) since 2024.

Epic Online Services

For a list of games, see games using Epic Games Launcher DRM.

As part of its larger set of features, Epic Online Services provides some basic authentication and ownership interfaces that developers can leverage as a basic DRM solution to protect against extremely casual piracy. An additional anti-tamper protection (often Denuvo Anti-Tamper) might be used to strengthen the DRM further.

Games for Windows – LIVE

See the main article for more information.

GameShield IronWrap

For a list of games, see games using GameShield IronWrap DRM.

Used in a couple of Rockstar games for online activation.

LaserLock

For a list of games, see games using LaserLock DRM.

Also referred to as LaserLok.

Protection for games distributed via optical discs aiming to disallow disc duplication, used often for checking the disc.

Achieved by combining files in the hidden LASERLOK directory and a modified laser marking during the disc manufacturing process.

Microsoft Product Activation

Used in older Microsoft games to activate.

Works the same way as Windows Product Activation

Microsoft Store

For a list of games, see games using Microsoft Store DRM.

An additional anti-tamper protection (such as Denuvo Anti-Tamper or Arxan Anti-Tamper) might be used to strengthen the DRM of Microsoft Store.

The AppX package(s) that make up Universal Windows Platform apps acts as a very restrictive form of DRM, preventing users from easily modifying game content.

PACE InterLok

For a list of games, see games using PACE InterLok DRM.

DRM used eg. in digital release of Need for Speed Carbon

ProtectDISC Software

For a list of games, see games using ProtectDISC Software DRM.

Protection for games distributed via optical discs aiming to disallow disc duplication and make cracking more difficult, used often for checking the disc.

Known also under the names VOB, ProtectCD and ProtectDVD.

Mainly used in games made by German developers or adapted for the German-speaking market.

Does not require a driver on the user's computer, with all relevant data found on the disc itself.

Official website (archived)

Ring PROTECH

For a list of games, see games using Ring PROTECH DRM.

Protection for games distributed via optical discs aiming to disallow disc duplication, used often for checking the disc.

Identified by a characteristic circle on the underside of the disc. The sectors within that circle contain data which is difficult to copy.

SafeDisc

See the main article for more information.

SecuROM

See the main article for more information.

SmarteSECURE

For a list of games, see games using SmarteSECURE DRM.

Protection for games distributed via optical discs aiming to disallow disc duplication, used often for checking the disc.

Earlier versions known as SmartE.

Used mostly by Microsoft-published games in the mid-2000s.

StarForce

See the main article for more information.

StarForce ProActive

See the main article for more information.

Steam/Steamworks

For a list of games, see games using Steam DRM.

In their pursuit of preventing piracy, over the years Steam have provided developers with various forms of DRM that are detailed in the sections below.

The big list of third-party DRM on Steam

Official website

Steam DRM

Steam DRM is the current and only official DRM wrapper provided by Steam. The DRM is noteable for only protecting against extremely casual piracy (i.e. copying game files between friends), and is primarily used by game developers to ensure proper Steam/Steamworks API functionality within their games for legitimate users.

An additional anti-tamper protection (e.g. Denuvo Anti-Tamper) is often be used to strengthen the DRM of Steam/Steamworks.

As part of its default protection settings, the game executable is obfuscated and will prevent binary mods and fixes from being applied to the game unless first removed.

For more in-depth information about the technical details of the DRM, see Cyanic's Steam DRM user page.

Steamworks DRM

Steamworks refers to the set of services and tools used to develop, publish, and interface with the Steam platform and its features. However within the context of playing Steam games, it specifically refers to using the Steamworks API (often referred to as the "Steam API") from within a game to communicate with the locally installed Steam client, to enable and allow user-oriented features such as achievement unlocks, screenshot capturing, multiplayer functionality, cloud save synchronization, marketplace integration, and more.

The Steamworks API does not on its own facilitate or provide any DRM capabilities or anti-tamper protections, however developers can easily and mistakenly end up using it to act in a DRM-like capability. This behavior stems primarily from improper handling when game developers interface with the API to enable or engage the user-oriented features of the Steam platform, without making appropriate fallbacks available, and can include situations such as:

• If the Steamworks API cannot engage and establish a communication with the local Steam client (e.g. if the Steam client is not currently running), game developers might have instructed the game to terminate automatically and forcefully, as opposed to providing a fallback codepath that enables playing the game in a "non-Steam" state.

• If native Steam Cloud API games (games that do not rely on the Steam Auto-Cloud feature) handle their cloud save synchronization improperly on startup, the Steamworks API can inadvertently act as and enforce an always online DRM, as was the case with Sonic Mania and Ys Seven which refused to launch when the Steam client was in an offline state.

Custom Executable Generation

Custom Executable Generation (CEG) was a stronger first-party DRM scheme of the Steam platform introduced in 2009 which worked by generating unique game executables for each Steam user, tying the executable to that single Steam user alone.

The protection scheme seems to have been made obsolete sometime during 2014, although titles released before its obsoletion may still make use of it.

Game Cache Files

Game Cache Files (GCF) were a form of DRM for game content which was deprecated with the introduction of SteamPipe in 2013. The modern Steam client no longer supports these files.

Game data was packed in *.gcf files, which could be encrypted. Officialy, only the old Steam client could decrypt these files and extract the bare minimum data needed to launch the game. The rest of the data was streamed from the GCF archives via the Steam client. GCF archives were at the time used to improve disk read performance. When the DRM was phased out, games became either fully unpacked or used the new VPK archives which acted as standard pak files, although without the DRM aspects of GCF as the games now handling reading and streaming the game content on their own.

For more information, see Valve Developer Community.

While Steam no longer uses GCF archives, retail releases of Steam games contain it. Officialy, the data can no longer be used but the user can redeem the key for a digital copy of the game.

TAGES

For a list of games, see games using TAGES DRM.

TAGES, like StarForce, installs itself as a driver on your computer and uses multiple methods to prevent copying. The TAGES drivers can be removed or updated by using the TagesSetup tool. Comes in both a disc check and Online Activation version.

Official website

Solidshield

For a list of games, see games using Solidshield DRM.

Solidshield is TAGES' new DRM technology. Version 1 was used in tandem with TAGES and requires the same driver updates while Version 2 was standalone and purely based around Online Activation. Often incorporating activation limits.

Ubisoft utilized a custom version of Solidshield that did not allow deactivations. To revoke activations on unaffected games, use the executable in the installation folder (usually called activation.exe); see Activation and revocation client for further details.

Themida

For a list of games, see games using Themida DRM.

Protection for games distributed via optical discs aiming to disallow disc duplication, used often for checking the disc and online activation

Mainly used in Japanese games.

Ubisoft Connect

For a list of games, see games using Ubisoft Connect DRM.

Same as with Steam/Steamworks, Ubisoft Connect (formerly known as Uplay) provides a basic DRM wrapper and solution that protects against extremely casual piracy. An additional anti-tamper protection (usually Denuvo Anti-Tamper and/or VMProtect) might be used to strengthen the DRM of Ubisoft Connect.

VMProtect

For a list of games, see games using VMProtect DRM. Please note that this list might be incomplete as some iterations of Denuvo Anti-Tamper also reportedly used VMProtect.

Prevents code from executing on virtual machine and non-standard architecture.^{[citation needed]}

Suspected of negatively affecting protected program's performance due to usage of virtualization methods.^{[citation needed]}

Used by Ubisoft games since 2014.

Official website