[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Translation of Cracking Lesson 19, was Re: Toy Shop for Apple II available and a long story
Here are sections 6, 7, and 8.
===============================================================================
6. Supplementary Problems : A fake track number and boot verification
===============================================================================
a) A FAKE TRACK NUMBER
--------------------------
It is possible, because Gustaffson did it, to place a track numbered 16 in
place of track 17, isn't it? A number is just a number.
Necessary to read it is, 1/ to know where the drive head is
2/ move it to the desired track
3/ read the track with the number that it has
(which is different from the track number where the drive head is)
But don't let me add more to this topic, since R. Gustaf' has stopped
manipulating the number of tracks. It will not be useful for you in the
future. At least until he decides to do it again, in which case I would
return to this lesson as soon as possible!
To know more about this topic, refer to lesson 17.2 on the protection of -
among others - Ultima 5. The same thing was used with the sector numbers of
a standard ProDOS disk. Impressive!
b) ORIGINAL DISK VERIFICATION UPON BOOT
---------------------------------
I have never worked with a true, original Br0derbund disk in my drive, in
fact, I have always made copies of taiwan, among others, which boot just
like the original, but which I suspect have already been a bit tampered
with.
Someone told me about a boot verification of the original-original
Br0derbund programs where it was necessary to take off from an echo+ copy in
order for them to boot. But I cannot tell you, my goodness! (but likely
nothing too bad!)
Pray that you will always receive, as I did, original copies, if not, we
will talk about it. (I would like to inform you, but not right now!)
===============================================================================
7. The End of the End : Adapting GOGSMITH to the many new Br0derbund
programs
===============================================================================
To let gogsmith defeat any original disk from Br0derbund, allowing for now
the copier to be independent of the original (to boot the copier, that is
another story), one must modify many parameters in the copier relating to
this original.
1) The map of the sides
------------------------
The copier can copy sides "A" or "B" (one can easily modify the source to
make the "C" key show "D" if the parameters are not the same on all of the
sides), and make a table of "1618" corresponding to side A. On side A of
Wings of Fury, for example, the first two tracks are in 16 sectors, tracks
$02-22 are in 18 sectors, and finally, because the copier had some space,
there is a track $23 in 16 sectors. The "map" of side A is therefore
parameterized as follows in the copier:
MAP_A HEX 161618181818181818181818181818181818
HEX 181818181818181818181818181818181816
HEX 00
The 00 delimits the end of the disk. It also indicates the number of tracks
for it, or the corresponding sides for a given map. For side B which has
only $22 tracks of 18 sectors, if I understand, one has the following map:
MAP_B HEX 181818181818181818181818181818181818
181818181818181818181818181818181800
We must modify this map of tracks for each of the sides, depending on the
format of each track of the original. For this, in order to define for an
original which tracks are in 16 or 18 sectors, it is enough to try a
locksmith copy of the original. (Hit "1" then return at the locksmith 6.0
menu, then place your original in drive 1, to read only and not try to
write). Next, note all of the copiable tracks, and those which are not. So
you noted that the fast, copiable tracks for locksmith are in 16 sectors,
and the uncopyable tracks are in 18 sectors. Afterward it is up to you, as
we have seen, to put these results in the gogsmith source. (pray for a new
version)
The ideal would be to add a possible copier configuration before the copy,
as with locksmith 6.0 and its possibility to modify any address. (refer to
lesson 6 or to "doc on the rocks #16" for more details). But one is always
too lazy...
2) The "header" which can vary.. yay! yay!
------------------------------------------
The header which can vary, you remember? I spoke about it before when I was
dissecting the 18 sector format with a nibble editor. The format, I will
remind you, is the following:
D5 9D tt ss cc AA FF FF hh
(tt = track, ss = sector, cc = checksum, hh = header).
Depending on the original, the hh headers can vary. And prevent reading! It
is as if under DOS 3.3 (refer to lesson 6) I placed a D4 AA EB in place of
DE AA EB, or again another valid nibble value then AA EB. Incompatibility
when reading is assured, therefore no copy. We must also parameterize this
factor, not in the copier, but in the rwts18 itself that loads in $4E00.
This header is located in $4E8E for the write18 routine.
This header is located in $5001 for the read.18 routine.
Two solutions, then: modify rwts18 before resaving it on the disk, but this
is not advisable because it would be necessary to have 15 rwts for 15
originals, or again add to the source code a couple of LDA STA to modify
these address for a given original, before the reading and writing of 18
sectors.
Here again, a copier for configurable addresses would make a disaster.
To place the copier when booting a copy of a protected disk, you must refer
to accolade boot 1.00. It is too complicated to be explained here, because I
have enough to make an entire lesson : the godfather's products 12.
===============================================================================
8. History of a few of the latest programs protected by Br0derbund
===============================================================================
(This chart remains to be completed..)
Airheart 18 sectors - variable Header D4
Toy Shop 18 sectors - variable Header ..
Carmen USA 18 sectors - variable Header ..
Wings of Fury 18 sectors - variable Header 96
--
]DF$
Mac GUI Vault - A source for retro Apple II and
Macintosh computing.
http://macgui.com/vault/