toinet
Inscrit le: 15 Juin 2007 Messages: 326 Localisation: Paris, France
|
Post� le: Mer 15 Ao� 2007, 17:56 Sujet du message: Gato (Spectrum Holobyte, 1985) |
|
|
A submarine simulation. Many hours playing with the game. My story about it is the first program I ever "played"
with the protection, making my disk not bootable I have then been obliged to put Patchman's version on my disk.
The string D4 AA 96 is still written on the shelf...
PROTECTION TYPE
On a standard Pascal disk (yes!):
- Change of header markers on even tracks: D5 AA 96 AF xx xx
- Change of header markers on odd tracks: D4 AA 96 AF xx xx
- sort-of a desynchro on reading the AF xx header markers
As it is a common Pascal disk with a simple change of headers, we will not boot trace the boot.
TIP
The same routine can read odd and even tracks as D4/2 or D5/2 = 6A in both cases. The following code is extracted
from GATO:
Code: |
LDA $C08C,X
BPL *-3
LSR
CMP #$6A
BNE wrongMarker
|
THE DESYNCHRO
I never thought we could read values <$80 from the disk. That is made possible with playing with the latency (PHA PLA)
or the timing to read two values from the disk.
Code: |
LDA $C08C,X
BPL *-3
CMP #$AF
BNE readError
PHA
PLA
LDA $C08C,X
CMP #$08
BCS notAnOriginalDisk
NOP
CLC
RTS
SEC
RTS
|
DISK COPY
We must tell our disk copier to change the header marker depending on an odd/even track reading
Launch Advanced Demuffin
Go to the monitor
- B942: 18
- B954: 4A C9 6A D0 EF
- Press Ctrl-Y
Copy the entire disk
REMOVE THE PROTECTION
Launch my favorite disk editor
Set the interleaving to Pascal (0 2 4 6 8 A C E 1 3 5 7 9 B D F)
Change boot1 marker and desynchro value:
- T0/S2/47: AF => DE
- T0/S2/52: A5 => 00 (we shall never find a $08, so BCS to the next byte)
Change boot2 marker and desynchro value:
- T0/SF/71: AF => DE
- T0/SF/7C: 03 => 00 (we shall never find a $08, so BCS to the next byte)
Your backup copy is now available,
Toinet |
|