Newsgroups: comp.sys.apple2
Path: news.weeg.uiowa.edu!news.uiowa.edu!hobbes.physics.uiowa.edu!math.ohio-state.edu!howland.reston.ans.net!spool.mu.edu!news.clark.edu!netnews.nwnet.net!serval!eecs.wsu.edu!mkelsey
From: mkelsey@eecs.wsu.edu (Michael Kelsey)
Subject: Prince of Persia Copy Protection
Message-ID: <1993Nov18.054207.19109@serval.net.wsu.edu>
Sender: mkelsey@eecs.wsu.edu (Michael Kelsey - EECS (Cpts499))
Organization: I lack organization!
Date: Thu, 18 Nov 93 05:42:07 GMT
Lines: 50

       

I seriously question this comment made in a post from 
>mspaeth@magnus.acs.ohio-state.edu (Wayne Gretzky)

:Incidentally, if you have a GS, there is a crack floating around where the
:entire game is moved to a 3.5" disk rather than a double sided 5.25" with
:Broderbund's quarter tracking protection.  Acquring this without buying the
:game would of course be illegal tho...

I don't question the availability for a crack, but, I do question Br0derbund's
usage of a quarter track in Prince of Persia.  I, too, received the program as a
gift (I still fell that it kills IBM P.O.P.(not 2) w/o a SoundBlaster) and I
immediately set out to make my legal backup.  At least in version 1.0 (press
CTRL-V during game play to check) there _IS NO_ quarter-track.  You can tell
quarter-tracks with true Apple Disk II drives.  You can hear a slight tick
instead of the chkkkkk....chkkkk....chkkkk normally heard when accessing
track-to-track.  I know this for a fact since this is how I detected the quarter
track in AirHeart at 1B.25!  In version 1.1 of P.O.P. there is the standard
Br0derbund 'A5 96 BF' header and pitfully-easy-to-crack bitslip protection.
Avoid the bit-slip routine by searching track #$00 on the boot side for E7 E7 E7.
I used Copy II+ (yes, a legal copy!) for any backing up.  Using a nibble editor
replace the seventh occurrence of the E7 pattern with AF F3 FC EE E7 FC EE E7 FC
EE EE FC.  This routine will cooperate with //c's and IIgs' unlike the PARM in
Copy II+ Plus designed to backup CrossWord Magic (backups won't boot except on 
//e's because of machine specific timings).  Anyway .. .. .. that is the copy
protection which exists on Prince of Persia.  This same scheme occurs on Tetris
from Spectrum Holobyte and Wings of Fury.  Epyx also used the bit-slip timing in
RoboCop, Ikari Warriors, California Games, World Games, Sub Battle Sim...
etc...Br0derbund used it on Carmen Sandiego's (not W.I.T.W), Type!, and Animate.
It was more fun to purchase the software just to crack it!

Let me know if stand corrected about Prince of Persia's copy-protection.

Michael Kelsey
mkelsey@eecs.wsu.edu

P.S.  I have the originals to Serpentine, Shamus, and The Official SEGA Frogger. 
It is quite obvious how Serpentine is protected, but, why does it reboot with an
'L' on my enhanced //e -- is this some ROM checksum test?  Also, does anyone have
a f@#$@'ing clue how to backup Shamus.  I literally spent months hacking at my
original and finally resorted to letting the program load into memory, pressing
CTRL-CA-RESET and feathering the RESET key until the RESET vector got invalidat-
ed, hit CTRL-RESET and then saved the ROM image as a DOS 3.3 file.  I did the same
with SEGA Frogger (which is protected with SpiraDisc - maybe spiral tracks?), but,
I would like to have exact duplicates of my originals -- any clues?  Shamus has
me stumped.  I've tried .25,.5, and .75 tracks, sychronization, nibble count,
and many others.  My Copy II+ and some older versions I have borrowed don't have 
entries for any of these.  Help!