234 lines
8.6 KiB
Plaintext
234 lines
8.6 KiB
Plaintext
|
Assorted Cracks 1
|
||
|
|
|
||
|
|
Wings of Fury, VCR Companion, CrossWord Magic 4.0,
|
||
|
|
Tetris, RoboCop, Ikari Warriors
|
||
|
|
|
||
|
|
Plus
|
||
|
|
|
||
|
|
Dream Zone
|
||
|
|
Great Western Shootout
|
||
|
|
Task Force
|
||
|
|
Hard Ball
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
From: Michael Kelsey
|
||
|
|
|
||
|
|
Wings of Fury, VCR Companion, CrossWord Magic 4.0, Tetris, RoboCop, Ikari
|
||
|
|
Warriors, etc. etc. I have a solution. It took many days to come across this
|
||
|
|
one.
|
||
|
|
First, you need Copy II+ 6.5 or later, or the equivalent of a Bit Copier with
|
||
|
|
a Nibble Editor and then some patience. Also, it is much easier if you have a
|
||
|
|
Sector Editor with a string or hex search mode.
|
||
|
|
|
||
|
|
If you don't have a sector editor then skip this step. If you do, go to the
|
||
|
|
mode to patch the sector editor. Change all the YES's to NO's. Copy II+ will
|
||
|
|
overlook any checksum errors this way. Next, start from track $00, sector $00
|
||
|
|
and scan for these bytes:
|
||
|
|
|
||
|
|
AC 00 AC 00
|
||
|
|
|
||
|
|
In short this consists of periods and control-@'s. Write down the track of the
|
||
|
|
occurrence. If you get a "string not found" error than this method won't work.
|
||
|
|
Next, go into the Bit Copier and set it to edit mode. For those of you who
|
||
|
|
have Copy II+ press "/" when right before the copy process begins. Type in "0B"
|
||
|
|
and <RETURN> then "02" and <RETURN>. By the way, only copy that track where the
|
||
|
|
occurrence is found. Once the drive light stop spinning on the original drive
|
||
|
|
type "f" (I think that is the command) and enter:
|
||
|
|
|
||
|
|
E7E7E7
|
||
|
|
|
||
|
|
If you see this pattern repeated many times than you have found the copy-
|
||
|
|
protection. Starting from the first E7 (and including) count skip over six
|
||
|
|
of them and press "C" when on the seventh. Now type the following:
|
||
|
|
|
||
|
|
AF F3 FC EE E7 FC EE E7 FC EE EE FC <RETURN>
|
||
|
|
|
||
|
|
Press "Q" to quit the editor mode and continuing with Copy II+ like normal.
|
||
|
|
DO NOT COPY ONTO YOUR ORIGINAL!!!!! That is a very unwise thing to do
|
||
|
|
especially if the program doesn't use exactly this protection scheme.
|
||
|
|
|
||
|
|
Now, (if you like) got to you sector editor and read from that Track and Sector
|
||
|
|
that you wrote down earlier. If your Custom Patch settings have not been changed
|
||
|
|
then read that spot. No error should occur unless a disk drive copied poorly.
|
||
|
|
Now, go back to the PATCH screen and change it to DOS 3.3 PATCHED. Escape back
|
||
|
|
to the sector editor (the place with all the numbers and characters) and write
|
||
|
|
the sector to you BACKUP disk.
|
||
|
|
|
||
|
|
Reboot, you are done. This works with many Broderbund, Epyx, and other programs
|
||
|
|
where Roland Gustaffson implemented his floppy drive routine.
|
||
|
|
|
||
|
|
If you have questions, comments, send them to mkelsey@eecs.wsu.edu
|
||
|
|
|
||
|
|
Background behind the unprotection scheme:
|
||
|
|
------------------------------------------
|
||
|
|
|
||
|
|
After picking apart the protection scheme I found the bytes that were being used
|
||
|
|
to protect the disk:
|
||
|
|
|
||
|
|
EE E7 FC EE E7 FC EE EE FC
|
||
|
|
|
||
|
|
These bytes can be shifted around and even changed to suit the purpose of the
|
||
|
|
author. Thus, this protection scheme is flexible and changes from program to
|
||
|
|
program. The Hex bytes above have almost become a standard.
|
||
|
|
|
||
|
|
When sychronizing to the disk the floppy drive uses sync FF's. These bytes have
|
||
|
|
a binary construction of so:
|
||
|
|
|
||
|
|
1111111100 1111111100 1111111100
|
||
|
|
|
||
|
|
sync FF sync FF sync FF
|
||
|
|
|
||
|
|
The copy protection searches for the E7 bytes on the drive. Once it finds a few
|
||
|
|
it begins to read the copy protection. There is one limitation to the Disk II
|
||
|
|
Floppy drives. Zero bits (any more than two consecutively) are considered
|
||
|
|
invalid. Thus, raw bytes on the disk cannot start with zero bits. This
|
||
|
|
protection scheme is implemented because those zero bits, without special
|
||
|
|
hardware, cannot be read by conventional drives reliably. Specific programs
|
||
|
|
like Essential Data Duplicator 4.9 have the capability to control the write
|
||
|
|
process of the conventional floppy drive. This also works. But not everybody
|
||
|
|
has EDD 4.9, but most have Copy II+.
|
||
|
|
|
||
|
|
Any way, here is the raw bit structure of the Copy Protection
|
||
|
|
|
||
|
|
11100111 11100111 11100111 11100111 11100111 11100111
|
||
|
|
E7 E7 E7 E7 E7 E7
|
||
|
|
|
||
|
|
Well by adding those zero bits, the bits that the drive can't read once
|
||
|
|
sychronized, the manufacturer is able to "fool" the floppy drive.
|
||
|
|
|
||
|
|
By using the AF F3 FC combination the floppy drive is forced to sychronize onto
|
||
|
|
the normal disk data and then reads like normal DOS or ProDOS.
|
||
|
|
The Copy Protection scheme jumps midway into a bit stream to catch the necessary
|
||
|
|
data. Thus, by adding one or two zero bits to the E7 byte patterns you can
|
||
|
|
obtain the EE E7 FC EE E7 FC EE EE FC data pattern.
|
||
|
|
|
||
|
|
For example:
|
||
|
|
|
||
|
|
Data read by a conventinal copier including the zero bits.
|
||
|
|
/ E7 \**/ E7 \/ E7 \*/ E7 \**/ E7 \/ E7 \*/ E7 \*/ E7 \
|
||
|
|
11101110011100111001111110011101110011100111001111110011101110011101110011111100
|
||
|
|
\ EE / \ E7 / \ FC /\ EE / \ E7 / \ FC /\ EE / \ EE /\ FC /
|
||
|
|
|
||
|
|
AF F3 FC
|
||
|
|
10101111 11110011 11111100
|
||
|
|
\ FF / \ FF /
|
||
|
|
Seeing as I didn't mention this earlier, the copy protection scheme jumps in
|
||
|
|
midway into the seventh E7 byte. I placed 1010 to make the byte noticeable to
|
||
|
|
other people and to be a filler space. At the fifth bit the drive will read the
|
||
|
|
last four bits of the AF byte and the first four bits of the F3 and get an FF
|
||
|
|
byte. The next to zero bits in F3 act to sychronize the drive. Next, the drive
|
||
|
|
skips over the invalid zero bits and then takes the last two bits of the F3 byte
|
||
|
|
and then gets the first six bits of the FC byte. This, once again, fills the
|
||
|
|
eight bit data register and the last two zero bits force the drive to sychronize.
|
||
|
|
I tried many methods of implementing this program. The first four zero bits
|
||
|
|
1010 in the AF byte were needed simply because the IIgs and //c have a different
|
||
|
|
drive circuitry than an Apple IIe. With any more or any less bytes the copy
|
||
|
|
protection scheme on the original would just fail. So, if you come across
|
||
|
|
another method that generic copiers can duplicate (like this scheme) please let
|
||
|
|
me know.
|
||
|
|
|
||
|
|
Understand that the "/ nn \" for the top, and the "\ nn /" for the bottom
|
||
|
|
includes the bit that the slash is above or below, respectively. The top
|
||
|
|
demonstrates the original's data stream with the zero bits below the "*". The
|
||
|
|
bottom line illustrates how to obtain the special data from those extra undetect-
|
||
|
|
able zero bits. Hope this hasn't been too confusing. If you need help or would
|
||
|
|
like more information I can be E-mailed at:
|
||
|
|
|
||
|
|
|
||
|
|
Michael Kelsey
|
||
|
|
mkelsey@eecs.wsu.edu
|
||
|
|
|
||
|
|
Note: if enough people ask for me write a program do this automatically then I
|
||
|
|
will go ahead and write one up.
|
||
|
|
|
||
|
|
|
||
|
|
___________________________________________
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
From: jnichol@tso.cin.ix.net (Jim Nichol)
|
||
|
|
|
||
|
|
Dream Zone:
|
||
|
|
|
||
|
|
Change 22 DB C4 00 to AF DB C4 00 at all 4 of the following locations on Disk 1:
|
||
|
|
|
||
|
|
Block $1B7, Byte $A9
|
||
|
|
Block $1B7, Byte $DF
|
||
|
|
Block $1BC, Byte $F6
|
||
|
|
Block $1BC, Byte $12C
|
||
|
|
|
||
|
|
This supposedly is a HD compatible patch.
|
||
|
|
|
||
|
|
|
||
|
|
***************
|
||
|
|
Great Western Shootout:
|
||
|
|
|
||
|
|
Block Byte From To
|
||
|
|
----- ---- ---- ---
|
||
|
|
$593 12B 20 00 BF 80 3A 09 2C 00 BF EA EA EA
|
||
|
|
$596 01B B0 1D EA EA
|
||
|
|
$596 02C D9 00 14 D0 08 B9 00 14 EA EA
|
||
|
|
|
||
|
|
***************
|
||
|
|
Tower of Myraglen:
|
||
|
|
|
||
|
|
Block $40F, Byte $72, change $22 CB 1B 00 to EA EA EA EA
|
||
|
|
|
||
|
|
|
||
|
|
***************
|
||
|
|
Task Force:
|
||
|
|
|
||
|
|
To make a deprotected copy of Task Force, you must enter a little program
|
||
|
|
to read the block into memory, then save the data to disk, etc.
|
||
|
|
|
||
|
|
1. Make a copy of both disks
|
||
|
|
2. Get into BASIC and BLOAD TF.READ.B63F,A$1000
|
||
|
|
3. Insert your ORIGINAL Task Force Disk 1.
|
||
|
|
4. Type the following:
|
||
|
|
CALL-151
|
||
|
|
1000G
|
||
|
|
(insert temp storage disk)
|
||
|
|
BSAVE TF.BLOCK.63F,A$1800,L$200
|
||
|
|
5. Insert your COPY of Task Force Disk 1, and do the following:
|
||
|
|
BLOAD STARTUP.SYSTEM,A$2000,TSYS
|
||
|
|
2026:A9 00 0E
|
||
|
|
2034:4C 43 0A
|
||
|
|
20C9:5C 88 41 02
|
||
|
|
2243:A9 FF 01 A2 00
|
||
|
|
2248:14 A0 00 98 54 02 00 4B
|
||
|
|
2250:AB 18 4C 37 08
|
||
|
|
EA<2255.2290Z
|
||
|
|
2291:18
|
||
|
|
(insert disk with TF.BLOCK.63F)
|
||
|
|
BLOAD TF.BLOCK.63F,A$2C00
|
||
|
|
(reinsert the copy of Task Foce Disk 1)
|
||
|
|
BSAVE STARTUP.SYSTEM,A$2000,TSYS,L$E00
|
||
|
|
|
||
|
|
I have a further handwritten note that says:
|
||
|
|
|
||
|
|
"The memory-clearing routine for Battle Chess is needed to make Task Force
|
||
|
|
work on a hard disk with 6.0.1, etc."
|
||
|
|
|
||
|
|
|
||
|
|
***************
|
||
|
|
Hard Ball:
|
||
|
|
|
||
|
|
Block Byte Change to
|
||
|
|
----- ---- ---------
|
||
|
|
31D 009 2C 5D 6B 24
|
||
|
|
31D 014 2C 5D 6B 24
|
||
|
|
31E 054 60
|
||
|
|
321 1A3 08 60
|
||
|
|
329 07D 60
|
||
|
|
32C 1EE 18 60
|
||
|
|
32F 0FF 18 60
|
||
|
|
335 1DE 60
|
||
|
|
339 067 60
|
||
|
|
33D 109 04
|
||
|
|
|
||
|
|
This supposedly is hard disk compatible.
|
||
|
|
|
||
|
|
Jim
|
||
|
|
|