Alice Averlong🏳️⚧️oh hello copy protection, fancy meeting you here
oh hey that's fun. this game has two layers of copy protection! if I hack the "check weird sector" code to always return 0 (for found-it), it tells me "Diskette/version out of phase"
they call the copy protection on two different sectors, and throw the out-of-phase error if they give the same result, I think
so you can't just overwrite check_copyprotection_sector with return 0
oh god they overwrite the DOS interrupt 1E in the middle, to make DOS think it's a different kind of floppy disk.
okay I now know HOW to crack the game, I just gotta write the x86 assembly.
normal people don't do this. normal people don't write 16bit DOS assembly in 2025.
I have 37 bytes. this won't be hard
and... it doesn't work.
tertiary copy protection?
tertiary copy protection?
I think they might be depending on the value of the weird sector elsewhere. like they're loading it SOMEWHERE, maybe they overwrite some code?
I need a comparative DOS CPU tracer.
Like, load two copies of the same EXE, and run until the execution diverges
THEY CHECKSUM THE FIRST 16KB OF EXECUTABLE RAM?
I patched the EXE to have the right value, but then they checksum it, and now the value is wrong!
insert pop-team-epic "you are motherfucker" here
they checksum memory MORE THAN ONCE!?
I patched out the checksumming and I think I've got it.
okay, so, the copy protection:
1. It checks for a sector that should not exist: Track 38, sector 113.
It's on a single-sided double density floppy (160kb), so there's supposed to be 8 sectors per track. But as we saw in this post:https://digipres.club/@foone/115011910054706753
this disk DOES have a sector 113.
Foone🏳️⚧️ (@[email protected])
Attached: 1 image oh hello copy protection, fancy meeting you here
so step one to bypassing the copy protection is hack that function to return "yes the sector exists".
EXCEPT THAT WON'T WORK. For two reasons. The first I'll get to later. The second is that the actual value of that sector matters, it gets read into memory and the bytes at 0x7-0x8 are checked later.
so I make sure those 2 bytes in memory are set. Easy!
the next phase of copy protection checks another sector: track 39, sector #25.
Another sector that doesn't exist, but it does, and it's 128 bytes long, and... they're doing evil things to DOS to make this readable. They switch the DOS format in memory, reset the disk IO system, and try to successfully read a 128byte sector. Somehow, apparently, this works?
I think there's another layer of protection that I bypassed on accident
trying to figure out this possible third layer of protection before I continue.
today's scores- emulators crashed:
1. DOSBOX: 2 times
2. MartyPC 1 time
3. 86Box: 0 times
ity [unit X-69] - VIOLENT FUCK@foone what about PCBox
@ity haven't used it. I've already got 86box and I don't know if PCBox does anything different that'd really help me with what I'm emulating
@foone ah, fair nuff :3