Re: Copy Protection Scheme Question

["Jplcsch" <jplcsch@wanadoo.fr>]

Hi Bryan
An easy way is the front door technique to obtain and trace the boot.
It's the better way and it work WITH ANY SCHEME OF PROTECTION
first you go under monitor
CALL-151
you have the star as prompt
*
good ! second you move ROM CODE to RAM with this command (don't type the
star)
*9600<C600.C700M
if you disassemble the code in 9600 with the command L you could see the
assembly language
*9600L
etc etc
at end of this code in $96F6 the two last line are a BCC $96D3 and just
after a JMP $801
you can change the $801 with $FF65 (just for return monitor, you'll
understand below)
with this command
*96F8:4C 65 FF
you could change only le address at 96F9 but it's for a better understanding
after insert the protect disk in you drive 1 on slot 6
tyep the command
*9600G
the disk spin and load the sector 0 in $801. MAGIC! you have the first code
to load the next
disassemble the code and so on you trace all code to load the program.
With some scheme you must save piece by piece, write software to load some
part etc, It's an addict job!
It's easy to explain but some schemas are very hard (Sundog for example) or
very funny (LADY TUT use bad opcode of 6502.. and don't work on all machine
! but the cracked version is better)
 just a detail to stop the drive type C0E8
Have a nice day
Jean Pierre

"Bryan Parkoff" <nospam@nospam.com> wrote in message
news:l99wb.24530$do1.12694@twister.austin.rr.com...
>     Is it possible to read 16 sectors in track 0 before it is loaded into
> memory for nibble analyzer?  If it is true, I would be able to convert
from
> 4-4 encoding and 6-2 encoding into normal 256 bytes before I will
> disassemble 256 bytes each sector.  Disassembler gives me some ideas how
> copy protection scheme is built in its own routines.  It would be possible
> to disable routines after they use to identify header address and data
> address.
>     I get the information from track 0 before I can be able to read track
1
> through 22 by using nibble analyzer and do disassemble to see the assembly
> code.  Capture assembly code and move into a file for startup.
>     It looks like that all copy protection disks do not have DOS that does
> not contain files inside.  It is an example of spiral disc.  Will nibble
> analyzer show spiral information before I can capture 4-4 encoding and 6-2
> encoding and then convert them into normal 256 bytes.  Is it the way how
it
> works?
>     I have seen that some hackers use Apple II which do not have AutoStart
> feature can be able to boot copy protection disk before assembly code is
> loaded into memory.  They hit RESET.  RESET returns to BASIC or Assembly
> prompt.  They copy assembly code from the memory to other memory location.
> They boot DOS 3.3 and copy assembly code from memory into files.  Is it
the
> way how it works?
>     Is there a special software that allows to capture nibble that
probably
> contains $55FF bytes into the file?  I am curious if you know where I can
> obtain -- Capture Nibble.  Thanks...
>
> Bryan Parkoff
>
>
> -- 
> Bryan Parkoff
>
>