Re: Alkemstone.... cracked (and another funny coincidence)

[Hot Rod <hotrod.apple2@gmail.com>]

On Saturday, August 4, 2012 2:40:32 AM UTC-5, Antoine Vignau wrote:
> 
> 
> Yep, that's right! Elite uses such a protection scheme.
> 
> 
> 
> The crack technote is @ http://www.hackzapple.com/phpBB2/viewtopic.php?t=110
> 
> My disk image is @ http://www.brutaldeluxe.fr/crack/
> 
> 
> 
> I've encountered another version of DOS 3.3 Protected, I need to find the app again,
> 
> antoine

It sure sounds like it could be.  In looking through the crack notes for Elite, I'm curious if Elite had the extra nibbles on the protected sectors too?  When I tried just changing the marker value to use on the protected sectors of the first disk I found with this (Rings of Saturn), I could only get the sectors to read by ignoring errors. But the result was that the data would be 'off' by a byte( an extra byte was present).  I had to use the original RWTS, with the custom data marker third value set, since that code consumes an extra byte following the read of the third marker value before reading the data normally.

Did Elite have this logic?
...
B8AF-   BD 8C C0    LDA   $C08C,X
B8B2-   10 FB       BPL   $38AF
B8B4-   C5 31       CMP   $31
B8B6-   D0 E7       BNE   $389F
B8B8-   49 AD       EOR   #$AD
B8BA-   F0 0B       BEQ   $38C7 <-- if a regular marker of AD, skip ahead
B8BC-   D0 00       BNE   $38BE <-- when the non-AD value is used,
B8BE-   BC 8C C0    LDY   $C08C,X <-- read another nibble
B8C1-   10 FB       BPL   $38BE
B8C3-   B9 00 BB    LDA   $BB00,Y <-- look up from translate table instead
B8C6-   2C A9 00    BIT   $00A9 <-- this becomes LDA #$00 on the skip
B8C9-   A0 56       LDY   #$56
B8CB-   88          DEY
B8CC-   84 26       STY   $26
B8CE-   BC 8C C0    LDY   $C08C,X
B8D1-   10 FB       BPL   $38CE
B8D3-   59 00 BB    EOR   $BB00,Y
...

It's quite possible there are variations of the scheme.  

]HR