How to crack MECC disks?

[Antoine Vignau <antoine.vignau@laposte.net>]

Competing in the event of the most prolific Apple II pirate, the evil LoGo received close to 150 MECC disks (both 3.5" and 5.25" ones) from a friend in Japan at the end of 2011, and cracked them all during Spring and Winter 2011.

The first question is: do 150 cracks count for one when it deals with the same company? Or do they count for 5 or 6 because it is the number of different protection schemes?
The answer is: I dunno :-)

The second question is: where are the crack info file?
The answer is: there, at http://www.brutaldeluxe.fr/crack/mecc_crack_logo_2011.pdf

The third question is: where are the files?
The answer is: probably on http://www.mecc.co/ - If they are not, let me know.

OK. Now, let's deal with the protection schemes:
1. Consider the disk format: 3.5" and 5.25" disks are protected differently.
2. Consider the OS: DOS 3.3, DOS 3.3 on a 3.5" disk and ProDOS disks are protected differently.

Let's enter the matrix:
1. A 5.25" disk under DOS 3.3
=> it is a simple change of markers. Three different series (a standard disk is D5AA96 - D5AAAD):
- AAD5AD - D596AA
- AAD596 - D5ADAA
- AAD596 - D5AAAD

2. A 5.25" disk under ProDOS
=> It is a change of markers and a check of block #8 which should generate a I/O error if read:
- Change of marker is for the epilog marker of both header and data areas: standard is DEAAEB. Here we can find 9E, 9D, 9B or 9A. It must be changed in the ProDOS file,
- The check of block #8 is performed in the MECC.SYSTEM. At offsets $100..$1FF, check for 38 (SEC) and replace with 18 (CLC)

3. A 3.5" disk under DOS 3.3
=> It is a check for a I/O error of block #8 (just like a ProDOS disk)
- The routine is mainly located at $BDEF, called in the first bytes of $BD00. If block 8 is read w/o any errors, then an infinite loop is generated (BNE *-1 or D0 FE), the crack changes the loop to BNE *1 or DO 00). Read block 4 at offset $1DF for the routine.

4. A 3.5" disk under ProDOS
=> It is a check for a I/O error of block #8
- The protection check is done in the MECC.SYSTEM and is turned off by replacing the SEC (38) opcode with a CLC (18) in three or four locations.

5. Other disks?
There are GS/OS disks (ProDOS for the Apple IIgs) or unprotected disks, those are not discussed here.

Enjoy,

LoGo
10-11/2011
now public 10/2012