JumpStart/Reader Rabbit Disk Bypass

The company I work for has a program where we take old computers and load them with Windows XP and various educational games to send to schools in other countries. They aren't top-of-the-line workstations, but it's enough for basic computer literacy, as well as any lessons taught by the educational software.

Low-budget education endeavors tend to lead to sketchy and unorthodox solutions, so I felt it would be a good idea to document the various problems we rant into and the solutions we used to get around them. Maybe one day someone else will find them useful.

Investigation ~ Opening

The two main pieces of software that we ran into issues with were JumpStart and Reader Rabbit. Both of these series use a common form of DRM used by many educational games of that era: they won't launch without the install disk being inserted into the CD drive. Even if we did purchase enough copies for this to be feasible across thousands of computers, it would still be inconvenient to have to swap disks every time a student wanted to play a different game.

In order to properly break something, you first need to understand how it works. If you've never heard of Procmon, it's a tool that can be used to analyze programs by tracking what files they try to access and what subprocesses they try to launch. Using Procmon, we can figure out how exactly the disk check is implemented across the various programs.

I've created an ISO image with the installers for JumpStart and Reader Rabbit, mounted it in an XP environment using Virtual CloneDrive, and installed them.

JumpStart Kindergarten seems to have no issues being installed this way. As long as our ISO is mounted, it runs without any issues, and Procmon shows it grabbing files off of out mounted ISO. It's even smart enough to detect that the install was launched outside of the root of the drive.

Procmon results for JumpStart Kindergarten

Reader Rabbit's Preschool is perfectly happy running entirely off of the ISO; the only useful thing the installer seems to do is create a shortcut to point at the executable on the ISO.

Properties for the Reader Rabbit's Preschool Start Menu shortcut

Reader Rabbit's 1st Grade is a bit of a different animal. Even with the ISO mounted, it doesn't seem to want to launch the game.

CD error for Reader Rabbit's 1st Grade

Procmon shows that it seems to expect the install files to exist on the root of the drive. Unlike JumpStart, which tracks the full installer path, Reader Rabbit seems to only keep track of which drive the install was initiated from.

Procmon results for Reader Rabbit's 1st Grade

Investigation ~ Middle

Obviously, these programs must be storing information about where the CD files are somehow, and while we can easily cheese JumpStart's check by installing it from an external drive (originally, we split the hard drive into a C: and D: partition, and used the D: to hold the install files; later we switched the the Virtual CloneDrive method), that isn't going to cut it for Reader Rabbit. We'll have to figure out exactly how it's storing the path to the CD and point it in the right direction.

First thought is the registry, which ultimately turned up nothing. While Reader Rabbit does create registry keys on install, no relevant data is actually stored there.

Staring mindlessly into the abyss tends to occasionally lead to good ideas, and in this case it helped me notice an RRF.INI file among the Reader Rabbit install files.

Contents of RRF.INI

Presumably the purpose of this file it to inform the installer of where the files it needs to actually install the game are. This gave me a thought: what if there's another .ini file on the hard drive with the rest of Reader Rabbit's files?

Sure enough, it's there and pointing to the same path that we saw in our Procmon capture. We can update this to point at the correct path on our mounted ISO, which fixes our Reader Rabbit issue.

JumpStart also stores some file paths in its own .ini file, which will be relevant in the next section.

Investigation ~ Core

So, if we can edit this file to point at the ISO, is there anything stopping us from arbitrarily pointing the CDDrive key to anything we want? To test, I copied all of the installers off of the ISO and onto the C: drive. Reader Rabbit includes software from Preschool to 2nd grade, and JumpStart from Preschool to 4th grade, so we'll try installing all of these and seeing what happens.

Reader Rabbit

JumpStart

I don't know that anyone else will ever have a reason to do what I've done here, but if so, hopefully this points you in the right direction.

#windows #educational #readerrabbit #jumpstart

Discuss...