Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion Groups
General
GeneralPortable MacsHardwareNetworking
Applications
Mac ApplicationsEudoraFirefox / MozillaInternet ExplorerOutlook ExpressMS OfficeEntourageExcelPowerPointWordVirtual PCMedia PlayerOther MS Products
Programming
Mac ProgrammingCodeWarriorPerl
Country Specific
Australian Mac GroupUK Mac Group

Mac Forum / Applications / Mac Applications / February 2005



Tip: Looking for answers? Try searching our database.

Adobe Demo products mess with System files (?)

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Matthew Hills - 07 Feb 2005 20:43 GMT
It seems that the Adobe Tryout products modify some system files?  Has
anyone else noticed this?  Is it part of the demo/expiration thing, and does
it cause any problem?

I just ran a routine permissions check and got a notice about incorrect
permissions for /System/Library/Sounds/Submarine.aiff  (it had been
set to global +rwx), and the timestamp on the file was pretty recent.

Checking my system logs to see what was going on at that time, I noticed
that was when I had tried a demo of Adobe's Illustrator CS.

To double-check, I restored the Submarine.aiff file, re-downloaded the
installer and ran it....  again, the permissions had been changed and
the file modified...

Any thoughts?

Thanks,
Matt
Tom Harrington - 07 Feb 2005 22:32 GMT
> It seems that the Adobe Tryout products modify some system files?  Has
> anyone else noticed this?  Is it part of the demo/expiration thing, and does
[quoted text clipped - 12 lines]
>
> Any thoughts?

That's a curious little detail, isn't it.

What's the size of this file on your Mac?  On mine it shows up as 172046
bytes.  I'm wondering if more was changed than just the permissions on
the file.

Signature

Tom "Tom" Harrington
Macaroni, Automated System Maintenance for Mac OS X.
Version 2.0:  Delocalize, Repair Permissions, lots more.
See http://www.atomicbird.com/

Dave Balderstone - 07 Feb 2005 22:57 GMT
> What's the size of this file on your Mac?  On mine it shows up as 172046
> bytes.  I'm wondering if more was changed than just the permissions on
> the file.

Here, the size is the same and modified date is Sept 22, 2003.

-rw-r--r--   1 root  wheel  172046 22 Sep  2003 Submarine.aiff

I have the full Adobe CS suite installed, but have never run a tryout
version of any of their apps.

djb

Signature

"The thing about saying the wrong words is that A, I don't notice it, and B,
sometimes orange water gibbon bucket and plastic." -- Mr. Burrows

Matthew Hills - 07 Feb 2005 23:11 GMT
>That's a curious little detail, isn't it.
>
>What's the size of this file on your Mac?  On mine it shows up as 172046
>bytes.  I'm wondering if more was changed than just the permissions on
>the file.

Since my earlier post, I updated from 10.3.4 to 10.3.7, and it looks like this
file was restored...

So I tried to duplicate the process (re-downloaded the illustrator demo):

Before install of Illustrator CS Demo:
 -rw-r--r--   1 root  wheel  172046 21 Jan 11:03 Submarine.aiff
after install (but haven't launced Illustrator CS):
 -rwxrwxrwx   1 root  wheel  172046 21 Jan 11:03 Submarine.aiff
after running the trial version of Illustrator CS:
 -rwxrwxrwx   1 root  wheel  172046  7 Feb 14:56 Submarine.aiff

An inspection with Hexedit shows changes to a few hundred bytes near the end
of the file after the trial version was run.  (Note:  my 30 days to demo the
software has expired, so it just starts up and tells me that my trial has
expired)

I don't notice any big change to the sound itself... I just got a bit queasy
about this, as I recall having one sound get pretty corrupted last fall, and I
seem to remember hearing of some problems with apple's Mail caused by
corrupted sound files...

Matt
Dave Balderstone - 07 Feb 2005 23:54 GMT
> An inspection with Hexedit shows changes to a few hundred bytes near the end
> of the file after the trial version was run.  (Note:  my 30 days to demo the
> software has expired, so it just starts up and tells me that my trial has
> expired)

That's very odd... If Adobe is screwing with OS installed files they
are behaving VERY badly.

djb

Signature

"The thing about saying the wrong words is that A, I don't notice it, and B,
sometimes orange water gibbon bucket and plastic." -- Mr. Burrows

Matthew Hills - 08 Feb 2005 00:02 GMT
>> An inspection with Hexedit shows changes to a few hundred bytes near the end
>> of the file after the trial version was run.  (Note:  my 30 days to demo the
[quoted text clipped - 3 lines]
>That's very odd... If Adobe is screwing with OS installed files they
>are behaving VERY badly.

I found it a bit odd -- in general I think very highly of Adobe's trial
program.

I'd be interested in seeing if anyone else has tried installing the trial and
whether they get similar results...  (ie, is it something weird about my
system? -- I do find it odd that I haven't seen lots of posts about
"repair permissions" tripping on this sound file before)

Matt
Dave Balderstone - 08 Feb 2005 00:31 GMT
> I'd be interested in seeing if anyone else has tried installing the trial and
> whether they get similar results...  (ie, is it something weird about my
> system? -- I do find it odd that I haven't seen lots of posts about
> "repair permissions" tripping on this sound file before)

I don't think I have a production Mac that hasn't had the CS suite
installed on it but I'll check at the shop tomorrow and see if I can
duplicate this.

What OS version are you running?

Signature

"The thing about saying the wrong words is that A, I don't notice it, and B,
sometimes orange water gibbon bucket and plastic." -- Mr. Burrows

Matthew Hills - 08 Feb 2005 00:48 GMT
>I don't think I have a production Mac that hasn't had the CS suite
>installed on it but I'll check at the shop tomorrow and see if I can
>duplicate this.
>
>What OS version are you running?

I first noticed this with 10.3.5, while running "check disk permissions"
in anticipation of my update to 10.3.7 -- that precipitated my first post.

My recent posts have been since updating to 10.3.7

Matt
Dave Balderstone - 08 Feb 2005 01:22 GMT
> I first noticed this with 10.3.5, while running "check disk permissions"
> in anticipation of my update to 10.3.7 -- that precipitated my first post.
>
> My recent posts have been since updating to 10.3.7

I'll try and reproduce this in the next couple of days and let you know
what I find.

djb

Signature

"The thing about saying the wrong words is that A, I don't notice it, and B,
sometimes orange water gibbon bucket and plastic." -- Mr. Burrows

Kevin - 18 Feb 2005 06:20 GMT
> >> An inspection with Hexedit shows changes to a few hundred bytes near the end
> >> of the file after the trial version was run.  (Note:  my 30 days to demo the
[quoted text clipped - 3 lines]
> >That's very odd... If Adobe is screwing with OS installed files they
> >are behaving VERY badly.

> I found it a bit odd -- in general I think very highly of Adobe's trial
> program.

> I'd be interested in seeing if anyone else has tried installing the trial and
> whether they get similar results...  (ie, is it something weird about my
> system? -- I do find it odd that I haven't seen lots of posts about
> "repair permissions" tripping on this sound file before)

*delurk*

Hi folks,

I know I'm a latecomer to this thread, but it caught my attention as I
very recently had similar problems with Submarine.aiff.  I use it as my
"new mail!" sound in Mail, and at one point noticed that the sound was
playing oddly -- when I got new mail, the sound would play ("Bling!")
always followed by a burst of static.  It didn't always manifest itself;
some apps played it fine without static.  I eventually solved the problem
as I recall, by opening Submarine.aiff in a sound editing program and
chopping off the last few milliseconds of the file, which indeed seemed to
be staticy (blips on the waveform).

I had no idea how this happened, and has not been a problem ever since,
but having read this thread I remember now that I installed the Adobe
Indesign CS tryout right around the same time...
Brian Hughes - 08 Feb 2005 08:55 GMT
> It seems that the Adobe Tryout products modify some system files?  Has
> anyone else noticed this?  Is it part of the demo/expiration thing, and does
[quoted text clipped - 10 lines]
> installer and ran it....  again, the permissions had been changed and
> the file modified...

I can confirm this same thing with the Adobe After Effects tryout.  I
ran a "repair permissions" first, then I opened the terminal and did an
"ls -l" for "/System/Library/Sounds/Submarine.aiff"

Then I installed the Adobe AE tryout, then reran the permissions check:

Permissions differ on ./Applications, should be drwxrwxr-x , they are
drwxrwxrwx
Permissions differ on ./Library/Application Support, should be
drwxrwxr-x , they are drwxrwxrwx
Permissions differ on ./System/Library/Sounds/Glass.aiff, should be
-rw-r--r-- , they are -rw-rw-rw-
Permissions differ on ./System/Library/Sounds/Purr.aiff, should be
-rw-r--r-- , they are -rw-rw-rw-
Permissions differ on ./System/Library/Sounds/Submarine.aiff, should be
-rw-r--r-- , they are -rw-rw-rw-

Now I should mention that I verified here, I didn't repair.

So in my case, 3 sound files and 2 directories had their permissions
changed. The before and after ls for the 3 files only shows
"Submarine.aiff" was modified. I can also hear a very loud glitch at the
end of the sound file.  I silenced the glitch in Peak and replaced the
Adobe modified file. Then I reran the AE tryout application.

Guess what!  The sound file was modified again!

So I again replaced the file but this time used XRay to set the file
permissions to 0400 (read-only, for owner root).  When I tried to launch
AE, the License Manager hung for about 20 seconds (and quit and
relaunched) then AE opened.  The sound file wasn't modified this time.

I quit AE and replaced Submarine.aiff with a backup copy and repaired
permissions.  Running AE again I found that it didn't modify the file
this time and it took some time to launch.

So, what is going on here?  I'd venture a guess that After Effects is
hiding a code or date data in the sound file.  Perhaps it's not supposed
to be audible, I don't know why it is on my system.  It also looks like
the License Manager is verifying this data but it doesn't appear to be
able to modify it if the permissions are reset. It's not the only thing
it uses so I don't see why it has to modify system files.

Personally, I'm pretty ticked off that Adobe (or the installer maker)
would modify system files it does not own or have any right to.  Sure I
authorized the install but this borders on malware.  It's even worse
that it's files in the /System/Library path as those shouldn't be
changed by most applications.

Looking further I found what modifies the sound file, a small
application inside the AE bundle called VSetupT:

Adobe After Effects 6.5.app/Contents/MacOS/VSetupT

Just running it by itself, it will modify the sound file, assuming you
haven't fixed the preferences. It's made by Aladdin Knowledge Systems,
<http://www.aladdin.com/>, not to be confused with the StuffIt makers.

I already own the Standard Version of AE and it doesn't contain this
application, only the trial version. So be on the lookout for malware
made by Aladdin Knowledge Systems, modifying your system files without
your permission. Adobe probably isn't aware that these files are being
modified, they are just including the Aladdin HASP technology into the
trial software.

Signature

If you *really* need to e-mail me, send it to:
usenet at hughesvideo dot com

Matthew Hills - 08 Feb 2005 18:45 GMT
>I can confirm this same thing with the Adobe After Effects tryout.

Good to know that it isn't just me (or my system) going crazy...

>"Submarine.aiff" was modified. I can also hear a very loud glitch at the
>end of the sound file.

It is really strange that they leave such an obtrusive footprint.

I must confess some ambivalence about this--it isn't easy to release
a fully functional demo and ensure security...  If it was as easy as deleting
the odd ~/Library/Preferences/.Some_preference.pref, it wouldn't be much
of an obstacle for anyone wishing to "extend" their trial license.  And, as
I posted earlier, the opportunity to demo the software is wonderful.

I guess we should just be thankful that they aren't monkeying with
anything in the font folder!

Matt
Bruno Gaufier - 08 Feb 2005 20:30 GMT
>> I can confirm this same thing with the Adobe After Effects tryout.
>
[quoted text clipped - 4 lines]
>
> It is really strange that they leave such an obtrusive footprint.

Adobe is using this trick to check the demo period..
Some time ago, I tracked the files modified by an Indesign demo setup ;
They were :
- /System/Library/Sounds/Submarine.aiff
- /iNode72203691
- /Library/Preferences/AppleTalk 43A46D
- /.DRM_Home
Of course, there was a few more things in the classic system folder
(The "System" case if I remember) and all the things they are putting
everywhere.

And after reading Brian's post, it appears that they are also badly
trashing the OS security (I did not check security, but changing rights
on "/Application" and "/Library/Application Support" to "writable by
everyone" is absolutely stupid).

Someone, at Adobe, is probably thinking that Mac users are dumb ;-)

Signature

Bruno
Remove the "remove.me" part to answer

Brian Hughes - 09 Feb 2005 01:37 GMT
> >> I can confirm this same thing with the Adobe After Effects tryout.
> >
[quoted text clipped - 15 lines]
> (The "System" case if I remember) and all the things they are putting
> everywhere.

I found everything you did but not the AppleTalk file, I also found
/DRM_etc but there are probably others.  Thats the weak thing about this
"security" by Aladdin, it's basically "security through obscurity". If
you can find everything it modifies you can continue to use the trial
software as long as you want.  The software isn't crippled so it's a
good deal if you don't have any scruples.

> And after reading Brian's post, it appears that they are also badly
> trashing the OS security (I did not check security, but changing rights
> on "/Application" and "/Library/Application Support" to "writable by
> everyone" is absolutely stupid).
>
> Someone, at Adobe, is probably thinking that Mac users are dumb ;-)

Yes, and I think I'll be sending a message to Adobe about this.  I own
After Effects Std, I downloaded the trial to see if I wanted to upgrade
to the Pro version.  I'm rather ticked off that the installer corrupted
my sound file, let alone changed my permissions. What other files did it
modify and are they corrupted as well?

Signature

If you *really* need to e-mail me, send it to:
usenet at hughesvideo dot com

bruno - 09 Feb 2005 19:24 GMT
[snip]
>> And after reading Brian's post, it appears that they are also badly
>> trashing the OS security (I did not check security, but changing rights
[quoted text clipped - 8 lines]
> my sound file, let alone changed my permissions. What other files did it
> modify and are they corrupted as well?

For the Indesign demo, the only corrupted file was the ".aiff". All other
files were new ones.
The following files and folders were also created during setup (or first
launch - Some of them are also used by other Adobe apps) :

~/Library/Preferences/com.adobe.InDesign.plist : of course !
/Library/Application Support/Adobe/ : Misc support files
/Applications/PAO/Adobe InDesign 2.0 Trial/ : The app.
/Library/Application Support/Privilege/ : Licenses ? serial numbers ?

For indesign (I don't remember the exact version, but I think it was a
2.0), I'm pretty sure the list is exhaustive.

An easy (Something easier may be possible) way to find all modified files
is to use the fs_usage command and search the result for every suspect
file access (The fs_usage must be run as root while installing and on
first launch).

Signature

Bruno
Remove the "remove.me" part to answer

Brian Hughes - 10 Feb 2005 01:16 GMT
> > Yes, and I think I'll be sending a message to Adobe about this.  I own
> > After Effects Std, I downloaded the trial to see if I wanted to upgrade
[quoted text clipped - 14 lines]
> For indesign (I don't remember the exact version, but I think it was a
> 2.0), I'm pretty sure the list is exhaustive.

I looked in my Console log and noticed that it was looking for other
sound files during the install, in my case Temple.aiff, which doesn't
exist, and a few others I can't remember.

I downloaded and installed the InDesign demo (although I already own
InDesign) and here are the files it installed that are part of the demo
control:

Modified Files:
/Library/Application Support/Adobe/Adobe Registration Database
/System/Library/Sounds/Submarine.aiff

New Files or Folders:
/Library/Application Support/Privilege/

(These are all invisible)
/Library/Preferences/QuickTime D9087F
/iNode48856617
/.DRM_Home
/.DRM_etc

Regardless of what files, folder or permissions the demo modifies or
creates, the demo control software that Aladdin creates is so easy to
circumvent it's not even funny.  Adobe would be better off creating
trial-only serial numbers that expire.  The download date could be
encoded into the serial number which is provided at download time.  That
would be better than modifying sound files, creating hidden files with
deceptive names or messing up permissions.

I know I've seen quite a few posts about the iNodeXXX files, it makes
many people worry about disk corruption:

<http://groups-beta.google.com/groups?q=inode+group%3Acomp.sys.mac.*>

The naming of these files are the same as actual orphaned inode files.
All I know is I'm never downloading a demo that uses Aladdin's software,
their programmers are idiots.

> An easy (Something easier may be possible) way to find all modified files
> is to use the fs_usage command and search the result for every suspect
> file access (The fs_usage must be run as root while installing and on
> first launch).

I use the File Buddy snapshot feature to take before and after install
snapshots.  Then you can use the "compare snapshot" and it will output
lists of deleted, modified, and new files.  If you take a snapshot of
your entire drive you can find everything the installer touches. You can
also create a snapshot after you run the demo.

Looking at fs_usage I think File Buddy does a better job.  Not only do
you get the list of files but you can modify or delete them right from
the list window.

Brian Hughes

Signature

If you *really* need to e-mail me, send it to:
usenet at hughesvideo dot com

Brian Hughes - 09 Feb 2005 08:27 GMT
> >I can confirm this same thing with the Adobe After Effects tryout.
>
[quoted text clipped - 10 lines]
> of an obstacle for anyone wishing to "extend" their trial license.  And, as
> I posted earlier, the opportunity to demo the software is wonderful.

Actually, it is easy to defeat the trial license, once you know how, in
such a way that the license never expires.  You just have to figure out
what files the DRM software creates and/or modifies.  Then you can make
a few changes and the trial never needs to end. (The only drawback is it
takes about 60 seconds to launch AE) I know how to defeat it for the AE
installer but I won't detail it here nor do I condone it.

So, not only does the software solution that Adobe is using, created by
Aladdin, modify system files it isn't authorized to modify, the scheme
is so lame it borders on that amateur.  I hate to think that Adobe paid
Aladdin for this demo control software.

I noticed that when I run the installer, I have to authorize twice; once
for the installer, the other for the demo control application.  At that  
point you are giving it authority to add and modify system files. If you
delete or fix those files later, the software will still modify them
again. All without authorization, even if you fix the permissions!

Like I said in another post, this is malware and shouldn't even be
allowed on any computer where you are concerned with security. This
isn't about Adobe or its software, this is about the software created by
Aladdin <http://www.aladdin.com> that Adobe uses to control the demo
period.

Brian Hughes

Signature

If you *really* need to e-mail me, send it to:
usenet at hughesvideo dot com

 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.