About the author. I’m Colin Xiao — an independent reverse engineer, mostly working solo on contract jobs. I dig into compiled code of every kind, including but not limited to: Android and iOS apps, x86/x64/ARM native binaries, packers and obfuscators, DRM and license checks, network protocols and APIs, crypto and signature algorithms, malware, game binaries, and embedded/IoT firmware. I also handle large-scale data collection and vulnerability research. If you have any project in mind, I’d be glad to take it on — whatever it is, as long as it’s within my wheelhouse. Just reach out. You can reach me on X at @colinxiao_lab or on Telegram at https://t.me/ColinXiao666.

This research is published for educational and defensive purposes. The target sample is anonymized throughout.

---

Reconstructing the CCED 4.0 Encrypted Disk: 1991 Copy Protection, Reverse-Engineered

Today’s story is one only the 60s and 70s generation really remember — but a hero’s glory shouldn’t be quietly buried in history. It should be written down, to be told to the next generation slowly. This is about CCED, and about Zhu Chongjun.

Zhu Chongjun was one of the young software experts who started working on computer application software in China in the 1980s — widely recognized as one of the “Three Jun of Zhongguancun” and one of the “Five Outstanding Chinese Programmers.” His most famous work is CCED, the Chinese character-and-table editor.

In the winter of 1987, while doing a work-study job as a master’s student at Tsinghua University, Zhu noticed that people at the company struggled to make tables in the Chinese-localized WordStar — drawing table lines meant typing each location code one at a time. That gave him an idea: a program that could edit text and build tables quickly. A week later a BASIC interpreter that did exactly that was born — the prototype of CCED. It handled ordinary text editing, auto-generated regular tables from row/column counts, and let users draw and erase lines to edit them. The users loved it, and kept asking for more: table lines that wouldn’t shift when text was added or removed, columns that could be widened or squeezed at will. Zhu delivered every one. He also noticed the tables were mostly financial statements, with people hand-tallying data on a calculator while making the table. So he quietly added one more feature: write a formula, press a key, and a batch of table data gets computed.

Word got around; units across the country contacted Tsinghua wanting the program and willing to pay. On users’ advice, Zhu compiled it into a standalone .EXE. The first customer — the mechanics department of Tianjin University — paid 450 yuan for the usage rights. “Knowledge + labor” produced value; a poor student saw his first glimmer of escape from hardship. Before long, Lenovo (then Legend) picked up the software for distribution, and over its three-year run it ranked first in sales among all software. Seeing BASIC’s limits, Zhu taught himself C and rewrote the program, adding features along the way, releasing CCED 4.0 at the end of 1991. CCED 5.0 followed in March 1994 (tightly integrated with WPS), 6.0 in May 1998, and the Windows-based CCED 2000 in May 1999 brought the product to full maturity.

Now to the point: how to reproduce the CCED 4.0 encrypted disk. Finding the original encrypted disk — or even the original installer — is nearly impossible now. But by luck I came across one copy, and my analysis confirmed it’s original — at least the disk-verification process is authentic.

Tracing the verification

Copy all the files into the CCED directory and run CCED /INST to verify the disk:

Summon Soft-ICE with a hotkey and set BPINT 13; back in the program press A to run the verification:

The first break is at disk reset:

Reset done, preparing to read sector 2801. Before the read, check the INT 1E table — 0:525 holds 2, meaning a normal sector, so the read should return AH=0:

After the read we manually set AH=0 and keep tracing. Now the data-area verification begins:

It checks a 10-byte string — Mr. Zhu’s first “I Iove you” to everyone:

After that first condition passes, it checks several more data spots:

320h — that value will be used again later. This sector’s data is verified. Now it prepares to read sector 09. Set 0:525 to 4 — this should be a CRC sector, returning AH=10:

Set the return value to 10:

Now see how the data is verified:

It sums from 320+0D23 to 7FF+0D23 (ES:BX is the base of the data read from disk):

Then checks whether the accumulated value is 8DFC:

Verification passes:

Reconstruct all the data and write it back to disk — the same verification passes. The CCED 4.0 encrypted disk is reproduced.

It’s hard to believe this is home-grown encryption from a 1991 product. In an era of scarce information and locked-down references, Mr. Zhu’s verification process already showed the outlines of cryptography, and he had designed a disk fingerprint that ordinary means couldn’t copy, with compatibility spanning countless platforms. Compared to Zhou Hui’s Lock95 and Lei Jun’s BitLock — which appeared four years later — it holds its own.

The 1990s were an age of individual heroes, with famous programmers shining bright, like the generals of the Three Kingdoms. I was lucky to live through it, and lucky to have witnessed it.

---

Colin Xiao — I take on contract reverse-engineering work, and writeups like this are how I show what I can do. If you need help with anything in this space — including but not limited to the areas I cover above — I’m available. No project is too big or too small — if it’s reverse engineering and I can do it, I’ll take it. DM me on X (@colinxiao_lab) or Telegram (@ColinXiao666).

Get in touch