Assorted Cracks 1 Wings of Fury, VCR Companion, CrossWord Magic 4.0, Tetris, RoboCop, Ikari Warriors Plus Dream Zone Great Western Shootout Task Force Hard Ball From: Michael Kelsey Wings of Fury, VCR Companion, CrossWord Magic 4.0, Tetris, RoboCop, Ikari Warriors, etc. etc. I have a solution. It took many days to come across this one. First, you need Copy II+ 6.5 or later, or the equivalent of a Bit Copier with a Nibble Editor and then some patience. Also, it is much easier if you have a Sector Editor with a string or hex search mode. If you don't have a sector editor then skip this step. If you do, go to the mode to patch the sector editor. Change all the YES's to NO's. Copy II+ will overlook any checksum errors this way. Next, start from track $00, sector $00 and scan for these bytes: AC 00 AC 00 In short this consists of periods and control-@'s. Write down the track of the occurrence. If you get a "string not found" error than this method won't work. Next, go into the Bit Copier and set it to edit mode. For those of you who have Copy II+ press "/" when right before the copy process begins. Type in "0B" and then "02" and . By the way, only copy that track where the occurrence is found. Once the drive light stop spinning on the original drive type "f" (I think that is the command) and enter: E7E7E7 If you see this pattern repeated many times than you have found the copy- protection. Starting from the first E7 (and including) count skip over six of them and press "C" when on the seventh. Now type the following: AF F3 FC EE E7 FC EE E7 FC EE EE FC Press "Q" to quit the editor mode and continuing with Copy II+ like normal. DO NOT COPY ONTO YOUR ORIGINAL!!!!! That is a very unwise thing to do especially if the program doesn't use exactly this protection scheme. Now, (if you like) got to you sector editor and read from that Track and Sector that you wrote down earlier. If your Custom Patch settings have not been changed then read that spot. No error should occur unless a disk drive copied poorly. Now, go back to the PATCH screen and change it to DOS 3.3 PATCHED. Escape back to the sector editor (the place with all the numbers and characters) and write the sector to you BACKUP disk. Reboot, you are done. This works with many Broderbund, Epyx, and other programs where Roland Gustaffson implemented his floppy drive routine. If you have questions, comments, send them to mkelsey@eecs.wsu.edu Background behind the unprotection scheme: ------------------------------------------ After picking apart the protection scheme I found the bytes that were being used to protect the disk: EE E7 FC EE E7 FC EE EE FC These bytes can be shifted around and even changed to suit the purpose of the author. Thus, this protection scheme is flexible and changes from program to program. The Hex bytes above have almost become a standard. When sychronizing to the disk the floppy drive uses sync FF's. These bytes have a binary construction of so: 1111111100 1111111100 1111111100 sync FF sync FF sync FF The copy protection searches for the E7 bytes on the drive. Once it finds a few it begins to read the copy protection. There is one limitation to the Disk II Floppy drives. Zero bits (any more than two consecutively) are considered invalid. Thus, raw bytes on the disk cannot start with zero bits. This protection scheme is implemented because those zero bits, without special hardware, cannot be read by conventional drives reliably. Specific programs like Essential Data Duplicator 4.9 have the capability to control the write process of the conventional floppy drive. This also works. But not everybody has EDD 4.9, but most have Copy II+. Any way, here is the raw bit structure of the Copy Protection 11100111 11100111 11100111 11100111 11100111 11100111 E7 E7 E7 E7 E7 E7 Well by adding those zero bits, the bits that the drive can't read once sychronized, the manufacturer is able to "fool" the floppy drive. By using the AF F3 FC combination the floppy drive is forced to sychronize onto the normal disk data and then reads like normal DOS or ProDOS. The Copy Protection scheme jumps midway into a bit stream to catch the necessary data. Thus, by adding one or two zero bits to the E7 byte patterns you can obtain the EE E7 FC EE E7 FC EE EE FC data pattern. For example: Data read by a conventinal copier including the zero bits. / E7 \**/ E7 \/ E7 \*/ E7 \**/ E7 \/ E7 \*/ E7 \*/ E7 \ 11101110011100111001111110011101110011100111001111110011101110011101110011111100 \ EE / \ E7 / \ FC /\ EE / \ E7 / \ FC /\ EE / \ EE /\ FC / AF F3 FC 10101111 11110011 11111100 \ FF / \ FF / Seeing as I didn't mention this earlier, the copy protection scheme jumps in midway into the seventh E7 byte. I placed 1010 to make the byte noticeable to other people and to be a filler space. At the fifth bit the drive will read the last four bits of the AF byte and the first four bits of the F3 and get an FF byte. The next to zero bits in F3 act to sychronize the drive. Next, the drive skips over the invalid zero bits and then takes the last two bits of the F3 byte and then gets the first six bits of the FC byte. This, once again, fills the eight bit data register and the last two zero bits force the drive to sychronize. I tried many methods of implementing this program. The first four zero bits 1010 in the AF byte were needed simply because the IIgs and //c have a different drive circuitry than an Apple IIe. With any more or any less bytes the copy protection scheme on the original would just fail. So, if you come across another method that generic copiers can duplicate (like this scheme) please let me know. Understand that the "/ nn \" for the top, and the "\ nn /" for the bottom includes the bit that the slash is above or below, respectively. The top demonstrates the original's data stream with the zero bits below the "*". The bottom line illustrates how to obtain the special data from those extra undetect- able zero bits. Hope this hasn't been too confusing. If you need help or would like more information I can be E-mailed at: Michael Kelsey mkelsey@eecs.wsu.edu Note: if enough people ask for me write a program do this automatically then I will go ahead and write one up. ___________________________________________ From: jnichol@tso.cin.ix.net (Jim Nichol) Dream Zone: Change 22 DB C4 00 to AF DB C4 00 at all 4 of the following locations on Disk 1: Block $1B7, Byte $A9 Block $1B7, Byte $DF Block $1BC, Byte $F6 Block $1BC, Byte $12C This supposedly is a HD compatible patch. *************** Great Western Shootout: Block Byte From To ----- ---- ---- --- $593 12B 20 00 BF 80 3A 09 2C 00 BF EA EA EA $596 01B B0 1D EA EA $596 02C D9 00 14 D0 08 B9 00 14 EA EA *************** Tower of Myraglen: Block $40F, Byte $72, change $22 CB 1B 00 to EA EA EA EA *************** Task Force: To make a deprotected copy of Task Force, you must enter a little program to read the block into memory, then save the data to disk, etc. 1. Make a copy of both disks 2. Get into BASIC and BLOAD TF.READ.B63F,A$1000 3. Insert your ORIGINAL Task Force Disk 1. 4. Type the following: CALL-151 1000G (insert temp storage disk) BSAVE TF.BLOCK.63F,A$1800,L$200 5. Insert your COPY of Task Force Disk 1, and do the following: BLOAD STARTUP.SYSTEM,A$2000,TSYS 2026:A9 00 0E 2034:4C 43 0A 20C9:5C 88 41 02 2243:A9 FF 01 A2 00 2248:14 A0 00 98 54 02 00 4B 2250:AB 18 4C 37 08 EA<2255.2290Z 2291:18 (insert disk with TF.BLOCK.63F) BLOAD TF.BLOCK.63F,A$2C00 (reinsert the copy of Task Foce Disk 1) BSAVE STARTUP.SYSTEM,A$2000,TSYS,L$E00 I have a further handwritten note that says: "The memory-clearing routine for Battle Chess is needed to make Task Force work on a hard disk with 6.0.1, etc." *************** Hard Ball: Block Byte Change to ----- ---- --------- 31D 009 2C 5D 6B 24 31D 014 2C 5D 6B 24 31E 054 60 321 1A3 08 60 329 07D 60 32C 1EE 18 60 32F 0FF 18 60 335 1DE 60 339 067 60 33D 109 04 This supposedly is hard disk compatible. Jim