PC Floppy Disk Games Copy Protection

[Great Hierophant]

Floppy disk based PC Games went through two phases of disk-based copy protection:

1. PC Booter - These games came first and did not require DOS to boot or run. DOS cannot read these disks and cannot copy virtually any of them. No known PC Booter required more than 2 360K disks or 1 720K disk.

2. DOS Key Disk - These games require DOS to function, but only work on their original floppies or require the original be inserted into the drive before running off a copy or from the hard drive (if the latter was allowed).

My question is will software based copying tools, such as Teledisk and CopyIIPC & Snatchit, be sufficient to make duplicates of the games and images that can later turned into protected disks? Or will a hardware based solution, such as an Option Board, really be required?

I know that if I were trying to copy business-based software, an Option Board probably would be necessary, as those software packages were more expensive and in many cases probably had stronger protection methods than games.

 

[mbbrutman]

All copy protection works by planting an error on the diskette that a normal operating system or floppy controller can not easily deal with or reproduce.

CopyIIPC makes a duplicate of a protected disk. It does not remove the copy protection. Snatchit is an addon designed by hackers (in the truest sense of the word) that allows you to make a diskette image of a copy protected diskette, something which CopyIIPC was not designed to do.

An Option Board is designed to make copies and images. The Option Board is able to deal with a wider variety of copy protection schemes, but not all all of them. One of the schemes that it does not work with is schemes that use holes in the diskette media burned by lasers. For that kind of copy protection you need the version of the Option Board that can be programmed to 'simulate' the location of the hole.

Business software is not necessarily harder to crack. Remember, even though it was more expensive the market was much smaller. Accolade sold a lot of copies of their games at $40 per unit ...

 

[Raven]

I've downloaded PC Booters that used Teledisk images, so yes that will work. I've also got plain IMA files of them, so things like rawrite will likely be able to copy them fine. Anything that makes an image just does it bitwise, so it will work. The only reason DOS can't do it is that it does it filesystem-wise and not bitwise.

Bitwise copiers won't work on some copy protections, though.

 

[Chuck(G)]

There are some tools such as CopyWrite that will simply modify the code on the disk itself. One tack is to pre-load a hook for INT 13 that creates a false error indication when the sector with the laser hole in it is supposed to come by. So even if the game tries to overwrite the sector and then read it to make sure that the hole is still here, it can't tell.

One of the shiftier copy protection schemes that I recall was used on Harvard Presentation Graphics. You could make a perfect sector-for-sector copy that conformed in every respect to the original, right down to sector ordering and the thing still wouldn't work. What Harvard did was to place the letters "HPGC" or some such in the gap between the first and second sectors and then use a Read Track command to retrieve it.

You needed something like a CopyIIPC option board to duplicate that one.

 

[fs5500]

Hi.

To copy Copy Protected Disk from original, Copy II PC option board is needed.
But to run any copy protected disk without crack, you can dump many of copy protected disk with ANADIS 2.0x / FDA 6.1 / CPDREAD / Teledisk 2.1X.
Of course, these can't be duplicated CPD correctly.
But if you dump CPD, it can be run on emulator.
Unofficial emulator supports copy protect disk image. (.ANA only)

Does anyone have copy protected disk games?

 

[Chuck(G)]

A Copy II PC OB won't copy all games. There are some games that involve physical changes to a disk (e.g. laser hole burned) that the Option Board can't handle. Fortunately, the code for many games can be hacked, so the game runs with no copy protection.

Many people forget the Copy II PC was a product by itself without the board. In many cases, it reverts to hacking the code.

 

[fs5500]

>A Copy II PC OB won't copy all games. There are some games that involve physical changes to a disk (e.g. laser hole burned) that the
>Option Board can't handle. Fortunately, the code for many games can be hacked, so the game runs with no copy protection.

I heard about it.
That is so called copy protection with hardware method. (Laser Hole / Hard Lock / etc.)
I want to know which game is copy protected with hardware method.
I tested many of copy protected games with TC 5.4 option board.

Here is the my list with Copy Protected Games.

007 Licence To Kill (1989 / Domark) / 5.25" 2D X 3EA (Disk 1 / Disk 2 / Disk 3)
Airborne Ranger (1988 / Microprose) / 5.25" 2D X 1EA (Disk 1)
Arkanoid (1988 / Taito) / 5.25" 2D X 1EA (Disk 1)
Arkanoid II Revenge Of DoH (1989 / Taito) / 5.25" 2D X 1EA (Disk 1)
F-15 Strike Eagle II (1989 / Microprose) / 5.25" 2D X 2EA (Disk 1)
F-19 Stealth Fighter (1988 / Microprose) / 5.25" 2D X 3EA (Disk 1)
Gauntlet (1988 / Mindscape) / 5.25" 2D X 1EA (Disk 1)
Guerrilla War (1988 / Data East) / 5.25" 2D X 2EA (Disk 1 / Booter)
Gunship (1988 / Microprose) / 5/25" 2D X 2EA (Disk 1)
Heavy Barrel (1989 / Data East) / 5.25" 2D X 2EA (Disk 1))
Horror Zombies From The Crypt (1991 / Millennium) / 5.25" 2D X 3EA (Disk 1)
Ikari Warriors (1988 / Data East) / 5.25" 2D X 1EA (Disk 1 / Booter)
Lemmings (1991 / Psygnosis) / 5.25" 2D X 3EA (Disk 1)
M1 Tank Platoon (1989 / Microprose) / 5.25" 2D X 3EA (Disk 1)
Operation Wolf (1989 / Taito) / 5.25" 2D X 2EA (Disk 1)
Platoon (1988 / Data East) / 5.25" 2D X 2EA (Disk 1)
Rambo III (1990 / Taito) / 5.25" 2D X 2EA (Disk 1)
Revenge Of Defender (1989 / EPYX) / 5.25" 2D X 3EA (Disk 1)
Robocop (1989 / Data East) / 5.25" 2D X 4EA (Disk 1 / Disk 4)
Renegade (1989 / Taito) / 5.25" 2D X 2EA (Disk 1)
Sky Shark (1989 / Taito) / 5.25" 2D X 2EA (Disk 1)
Stunt Track Racer (1989 / Microplay) / 5.25" 2D X 2EA (Disk 1)
Super Hang-On (1989 / Data East) / 5.25" 2D X 1EA (Disk 1)
Sword Of The Samurai (1989 / Microprose) / 5.25" 2D X 3EA (Disk 1)
Thexder (1987 / Game Arts) / 5.25" 2D X 2EA (Disk 1)
Victory Road (1988 / Data East) / 5.25" 2D X 1EA (Disk 1 / Booter)

But the following games are not copied correctly with TC 5.4 older than 1990.

Gauntlet
Horror Zombied From The Crype
Lemmings

I have two kinds of TC option board. (1989 / 1990 version)

I've dumped all my Copy Protected Games with FDA / ANADISK including hidden sector with BAD CRC.
It works well with unofficial PC related emulator beta version (non released) without crack copy protection mode.
That means if any user can dump copy protected game with FDA / ANADISK, user don't have to crack this to run on emulator.
(None of official PC emulator support Copy Protected Track / Sector yet.)
But to run on real old PC, it must be cracked or copied with CP2 PC option board.

 

[Chuck(G)]

That means if any user can dump copy protected game with FDA / ANADISK, use don't have to crack this to run on emulator.

For what it's worth, I don't think you've even begun to seen the range of copy protection used on floppies. (I think I can claim to know something about the operation of Anadisk.)

 

[Maverick1978]

For what it's worth, I don't think you've even begun to seen the range of copy protection used on floppies. (I think I can claim to know something about the operation of Anadisk.)

Chuck, I don't think he realizes that you're the guy that created Anadisk and Teledisk

 

[MikeS]

Chuck, I don't think he realizes that you're the guy that created Anadisk and Teledisk

Ssshhh!
;-)

 

[Great Hierophant]

A Copy II PC OB won't copy all games. There are some games that involve physical changes to a disk (e.g. laser hole burned) that the Option Board can't handle. Fortunately, the code for many games can be hacked, so the game runs with no copy protection.

Can anyone identify a game that uses these methods? It should be easy enough to spot from a physical inspection of the disk(s).

 

[fs5500]

Here is information of Copy Protected Track / Sector for any Microprose's games. (5.25" 2D media)


(Track 38 / Side 0)

38 0 0 38 0 1 8192 250000 MFM CRC-DATA
38 0 1 38 0 2 512 250000 MFM
38 0 2 38 0 3 512 250000 MFM
38 0 3 38 0 4 1024 250000 MFM CRC-DATA
38 0 4 38 0 5 512 250000 MFM
38 0 5 38 0 6 512 250000 MFM
38 0 6 38 0 7 512 250000 MFM
38 0 7 38 0 8 512 250000 MFM
38 0 8 38 0 9 512 250000 MFM


(Track 39 / Side 0)

39 0 0 39 0 1 8192 250000 MFM CRC-DATA
39 0 1 39 0 2 512 250000 MFM
39 0 2 39 0 3 512 250000 MFM
39 0 3 39 0 4 1024 250000 MFM CRC-DATA
39 0 4 39 0 5 512 250000 MFM
39 0 5 39 0 6 512 250000 MFM
39 0 6 39 0 7 512 250000 MFM
39 0 7 39 0 8 512 250000 MFM
39 0 8 39 0 9 512 250000 MFM


This type of Copy Protection is adaped on the following games from 1988 - 1989


Airborne Ranger
Dr. Doom's Revenge
F-15 Strike Eagle II
F-19 Stealth Fighter
M1 Tank Platoon
Red Storm Rising
Rick Dangerous
Savage
Stunt Track Racer
Sword Of The Samurai

I dumped all copy protected track / sectors by ANADISK / FDA.
It works on unofficial emulator (beta version) without any cracked file.
(Emulator implements the non standard track / sector / CRC with copy protected floppy image method.
You don't have to crack any files no more.)
Unofficial (non released) emulator supports copy protected (non standard) track / sector perfectly.
I expect to release this officially.

 

[fs5500]

Can anyone identify a game that uses these methods? It should be easy enough to spot from a physical inspection of the disk(s).

Hmm, I can't find this copy protection method (laser hole burned) on game software.
I have over 30 kinds of Copy Protected PC booter/DOS games. (Except 1 game, all of the games are from USA.)
If you want, I can show the information of Copy Protected Track / Sector.
In my opinion, one of the difficult method of copy protection is weak bit method except laser hole implement.
For example, Gauntlet is copy protected with weak bit method on track 0
This is unusual.
It reads Track 0 / Side 0 / Sector 0 4 times.
Then compares the first 16 bytes of each sector read.
If bytes 12-15 are *the same* each time, the disk is rejected.
This is written by weak bit method I think.
It can be copied with Trans Copy Option Board only.
(Old Copy II PC option board can't be copied correctly.)

 

[fs5500]

Good News.
Many of copy protected games can be dumped by Teledisk 2.1X on MS-DOS with new PC.
PCE/IBM-PC emulator supports non-standard copy protected track/sector (int13/int19).
Teledisk format (*.td0) can be read on new PCE. (td0 must not be compressed format.)
To dump copy protected disks, you must run teledisk on real MS-DOS mode. (Not on Windows)
(5.25" floppy needs too)

 

[Chuck(G)]

Not all copy-protection schemes introduce errors. In particular, I'm thinking of Harvard Graphics (back in the days of 360K 5.25' floppies). You can use DISKCOPY and it will report no errors. A quick scan with another utility will show no added or mis-numbered sectors. It looks perfectly normal.

But copies won't work--not even TeleDisk copies.

What Harvard Graphics did was to insert a few characters ("HGC", ISTR) in the inter-sector gap. A "read track" with an incorrect sector length code was used to read the track and verify that the "watermark" was there. Very clever--I discovered the secret only after disassembling HG.

 

[Shadow Lord]

A Copy II PC OB won't copy all games. There are some games that involve physical changes to a disk (e.g. laser hole burned) that the Option Board can't handle. Fortunately, the code for many games can be hacked, so the game runs with no copy protection.

Wasn't that the whole point of the Enhanced Deluxe OB? It had a programmable memory that could be set to reproduce the errors/burn holes on the disk?

Speaking of the OB does anyone know if the original (not Deluxe) OB works w/ HD FDD? Not necessarily to copy but if I have 1.2 and 360KB drive in the same computer and I had the OB in between the FDC and the FDDs will it cause any problems? I'd only use the OB board w/ the 360KB drive. TIA!

 

[per]

Wasn't that the whole point of the Enhanced Deluxe OB? It had a programmable memory that could be set to reproduce the errors/burn holes on the disk?

The enhanced OB is actually just a regular deluxe OB with an aditional microcontroller (CPU/ROM/RAM/IO implemention). You can tell the microcontroller where the holes are by using an utility and a previous scan, or you can let it scan the disk itself. When reads and writes from/to these holes occur, the microcontroller takes over the interfaces and deliver random data (on reads).

The actual format of TC images is quite basic. Data seems to start at offset 0x00004000h, and the kind of data is just regular MFM data in the case with PC disks. It would be quite easy to extract the data from them; all that needs to be done is to decode it, and be able to recognize track identifiers and syncmarks, etc...

 

[Chuck(G)]

Wasn't that the whole point of the Enhanced Deluxe OB? It had a programmable memory that could be set to reproduce the errors/burn holes on the disk?

Ever notice that some games require write to be enabled on the floppy? That's because the code that checks for the laser-burned hole attempts to write over the hole, then read it back. If it doesn't get an error, the software concludes that you've got a fake. The DOB won't help you there.

The way around this one was to patch the program or install code that hooks INT 13H and simulates the error.

Floppy copy-protection schemes were a game of cat-and-mouse. Some outfit would figure out a new scheme, then someone would come up with a way to get around it. Same idea with dongles.

 

[Shadow Lord]

The enhanced OB is actually just a regular deluxe OB with an aditional microcontroller (CPU/ROM/RAM/IO implemention). You can tell the microcontroller where the holes are by using an utility and a previous scan, or you can let it scan the disk itself. When reads and writes from/to these holes occur, the microcontroller takes over the interfaces and deliver random data (on reads).

Ever notice that some games require write to be enabled on the floppy? That's because the code that checks for the laser-burned hole attempts to write over the hole, then read it back. If it doesn't get an error, the software concludes that you've got a fake. The DOB won't help you there.

Right, but the EOB did exactly this (as I understand it):

Whenever the copy protected application tests for the original diskette
and tries to read from (or write to) the physically damaged sector, the
EOB emulates the very exact behaviour of a physically damaged media at the
exact place where the burn-hole was, thus confusing the application to think
that the original diskette is present inside the drive.

 

[per]

Right, but the EOB did exactly this (as I understand it):

Whenever the copy protected application tests for the original diskette
and tries to read from (or write to) the physically damaged sector, the
EOB emulates the very exact behaviour of a physically damaged media at the
exact place where the burn-hole was, thus confusing the application to think
that the original diskette is present inside the drive.

That's the end result of it.

However, you should be a bit carefull scanning a disk if you got the card. The only way to test for holes is to actually write to the media and then read back. If a DD disk which is not using this protection scheme is tested, the disk will have been rewritten, and if the drive used is a little out of alginemt, or you use a HD drive, you will get a quite unreliable original disk.

Disks which uses this protection scheme sometimes have "Don't writeprotect this floppy" written on it.

---

BTW, I have now completed a routine which decodes MFM. The next step now will be to write some routines which phrases TransCopy images and output binary images.