Leander the cave and nostalgia

[RichAplin]

I don't wish to say I'm skeptical but... I'm skeptical about the laser hole thing. Primarily because;
a) it'd be super expensive and difficult to set up. You have to convince a disk manufacturer or a disk duplicator to have a table of extra custom equipment to process each disk. It sounds easy to do but back in the 90's, and on an industrial scale (remember a duplicator typically had rows and rows of 2x speed Trace machines running flat out with autoloaders) - adding a precision manual laser step sounds like a nice idea but would be a shitload of work (=money) to implement and the duplicator would hate you. I had enough trouble getting duplicators to run custom Amiga formats; obviously the machines could do it (they could write anything with any bitcell size) but you needed to write custom scripts to specify the format and - of course - it needed to verify it as well, and it all became a lot of hassle to get actually sorted out. Remember that few people in the business side give a fuck about your clever new copy protection, they're about selling product and not having expensive or schedule-messing issues during manufacturing.

b) Write protect; the disk drive itself enforces the write protect tab (I absolutely know this for a fact); did Leander _require_ the disk to be un-protected at all times? As I recall quite a lot of games were duped onto disks that didn't even have the slidable WP tab (saving a tiny amount of money per disk and perhaps an end-user corrupting it; obviously the duplication machines didn't care about the WP tab).

c) Long track - everyone used long tracks of course; I remember our duplicator had a single custom script someone wrote for their Trace machines that would write+verify a standard long track (track 0 side 1 of course) and that was about as interested as they ever got in fucking with something that worked. Leander obviously used this, I recall "Protec" being a standard long-track job. I imagine later on (after hw copiers like Cyclone came out) that they started checking the index alignment of the long track too.

It just seems like the laser hole thing has always been one of those "things you hear about" (I recall ppl talking about using a hole punch on 5 1/4" disks for hard errors) but basically almost never saw in practice with mass produced floppy games.

Can someone with a Leander original verify the hole story? I'm curious (and a bit skeptical)

[RichAplin]

Originally Posted by Galahad/FLT

Yeah, because no-one else before Jon thought to use indirect offsets for their protection

...

And then he does a video bragging about it, when half of the story is missing.

Yeeeahhhh but c'mon we're all firmly at a "fireside nostalgia" age now, where a good yarn well told (even with some inaccuracies) is generally welcome. :-)

[DamienD]

Originally Posted by RichAplin

I don't wish to say I'm skeptical but...

Yeah, crazy stuff...

Richard, your post was spot on (and coming from an insider / game developer)

...plus a great read

Originally Posted by RichAplin

Yeeeahhhh but c'mon we're all firmly at a "fireside nostalgia" age now, where a good yarn well told (even with some inaccuracies) is generally welcome. :-)

Sir Galahad never tells tall tales

[StingRay]

Originally Posted by RichAplin

did Leander _require_ the disk to be un-protected at all times?

Of course not. It works fine with write protected disks. He just wants to make his protection appear super special which it isn't. At all. Even though he sounds like he has invented something incredibly ingenious.

[RichAplin]

I put a bunch of work into copy protection maybe two or three times, most notably on Double Dragon 2, which still got cracked rapidly, so after that I didn't bother hiding the protection check at all, meh ;-)

[BarryB]

I have an original copy of Leander and have just checked all 3 disks and can't see any 'holes' or laser burns whatsoever on the disks! I even held each disk up to to the window and rotated the disk slowly with the shutter open and couldn't see any daylight coming through any of the 3 disks so no obvious holes in the each disks surface! What disk was it 'supposed' to be on any way as that video never said?

On a related note, I have a copy of FLAK on C64 and that DOES have physical damage to the disk, Syncr0l0k it was called, and needs to write to the disk to make sure the write fails where it was damaged to make sure it's genuine

[Mrz]

btw,
Leander is far better on the megadrive
is called "legend of galahad"
have music+soundFX at the same time, more vivid colors , better backgrounds etc

[ Show youtube player ]

[Galahad/FLT]

Originally Posted by Mrz

btw,
Leander is far better on the megadrive
is called "legend of galahad"
have music+soundFX at the same time, more vivid colors , better backgrounds etc

[ Show youtube player ]

Music still better on Amiga though, inspite of Matt Furniss' best attempts.

[Mrz]

Originally Posted by Galahad/FLT

Music still better on Amiga

yep we agree
the perfect game should be the megadrive version using the Amiga music

[Galahad/FLT]

Originally Posted by RichAplin

I don't wish to say I'm skeptical but... I'm skeptical about the laser hole thing. Primarily because;
a) it'd be super expensive and difficult to set up. You have to convince a disk manufacturer or a disk duplicator to have a table of extra custom equipment to process each disk. It sounds easy to do but back in the 90's, and on an industrial scale (remember a duplicator typically had rows and rows of 2x speed Trace machines running flat out with autoloaders) - adding a precision manual laser step sounds like a nice idea but would be a shitload of work (=money) to implement and the duplicator would hate you. I had enough trouble getting duplicators to run custom Amiga formats; obviously the machines could do it (they could write anything with any bitcell size) but you needed to write custom scripts to specify the format and - of course - it needed to verify it as well, and it all became a lot of hassle to get actually sorted out. Remember that few people in the business side give a fuck about your clever new copy protection, they're about selling product and not having expensive or schedule-messing issues during manufacturing.

b) Write protect; the disk drive itself enforces the write protect tab (I absolutely know this for a fact); did Leander _require_ the disk to be un-protected at all times? As I recall quite a lot of games were duped onto disks that didn't even have the slidable WP tab (saving a tiny amount of money per disk and perhaps an end-user corrupting it; obviously the duplication machines didn't care about the WP tab).

c) Long track - everyone used long tracks of course; I remember our duplicator had a single custom script someone wrote for their Trace machines that would write+verify a standard long track (track 0 side 1 of course) and that was about as interested as they ever got in fucking with something that worked. Leander obviously used this, I recall "Protec" being a standard long-track job. I imagine later on (after hw copiers like Cyclone came out) that they started checking the index alignment of the long track too.

It just seems like the laser hole thing has always been one of those "things you hear about" (I recall ppl talking about using a hole punch on 5 1/4" disks for hard errors) but basically almost never saw in practice with mass produced floppy games.

Can someone with a Leander original verify the hole story? I'm curious (and a bit skeptical)

I just treat this whole laser thing as an interesting idea Jon Burton had, but he neglected to say that he didn't actually implement it.

No disrespect to Jon, but the disk system for Leander isn't even his ffs, it was written by DMA Design and is 100% the same system that they used on Lemmings, so anyone that built an imager for Lemmings, has a ready made imager to remove the MFM track format for Leander as well.

Whilst he's clearly a competent coder, I don't think that extended to low level stuff like floppy drives, or he would have written his own loader and format.

[Galahad/FLT]

Originally Posted by RichAplin

I put a bunch of work into copy protection maybe two or three times, most notably on Double Dragon 2, which still got cracked rapidly, so after that I didn't bother hiding the protection check at all, meh ;-)

Twice

Shinobi and Double Dragon 2, I don't recall any nasty surprises over anything else you did on Amiga.

I recently documented the efforts of the Robocop 3 dongle protection, you'll be pleased to know that it was 5% of the effort you put into Double Dragon 2

[Galahad/FLT]

Originally Posted by RichAplin

Yeeeahhhh but c'mon we're all firmly at a "fireside nostalgia" age now, where a good yarn well told (even with some inaccuracies) is generally welcome. :-)

Yeah, just so long as there are no irritants like me in the background suggesting otherwise

[rsn8887]

What was the point of such a sneaky copy protection? I'd say all it does is make players think that the game has a bug and not buy it. At least the game should somehow tell you that this is a copy protection and not a real bug.

I think Turrican also had sneaky protection like this. I just thought the game was broken or too hard for me. It sure didn't make me try to buy it for the off-chance that a new platform would appear in the retail version. I mean, who on earth would think in this way?

[Galahad/FLT]

Originally Posted by rsn8887

What was the point of such a sneaky copy protection? I'd say all it does is make players think that the game has a bug and not buy it. At least the game should somehow tell you that this is a copy protection and not a real bug.

I think Turrican also had sneaky protection like this. I just thought the game was broken or too hard for me. It sure didn't make me try to buy it for the off-chance that a new platform would appear in the retail version. I mean, who on earth would think in this way?

Thats the nature of copy protection, how far do you go, or how subtle do you make it?

Plenty of other games where people would have been wondering if it was them or the copy protection not removed properly.

The problem is, if you simply make the Amiga crash, then theres no doubt protection still exists.

[Rotareneg]

Dungeon Master had a similarly passive-aggressive protection where it checked a fuzzy bit on the disk and if it failed to validate one of the possible results would be your whole party suddenly dying without warning while playing: http://dmweb.free.fr/?q=node/210

[Galahad/FLT]

I took the time to look at Puggsy on the Megadrive, because this is another Travellers Tales game which Jon Burton had protection input into.

The copy protection is designed to check whether or not there is a copier attached to the Megadrive. Sounds complicated? Not remotely.

And the code to do all this is woefully implemented, the only reason anyone got caught out by it is because other than country code checks which were usually removed with utils that automated the process, no-one had done anything like this before, but it just means downloading a cracked rom image again, hardly a biggie.

Anyway, after a few levels, you get this screen pop-up:



And this is where the copy protection fails instantly. You would have thought Jon Burton would have obfuscated or really hidden the code that displays this text, but alas, its depressingly easy to find.

Loading up the Puggsy ROM image at address 0 on an Amiga, the Megadrive ROM is now located in the correct memory address where it would be on a real Megadrive.

So obviously we're looking for that text, so searching for the word "allowed" reveals it at address $4b997.

Scrolling backward, we find the first part of the message is "OK", which is at address $4b96b.

Lets do a search for that address. It yields nothing, so lets subtract 1 from that address, because the text routine could be writing a space before the text starts proper.

Searching for $4b96a reveals a hit at $4b774, $4b770 is the top of that particular routine, and its clearly the routine to display that text.

So doing a search for anything that points to $4b770 is next.

$4b552 is the address that comes up.

Looking at the code around that shows us we are in our first protection routine, and well...... its a bit shit!

lea $1fcfeb,a0
lea $3039(a0),a0
move.w #$4231,(a0)
cmp.w #$4231,(a0)
bne not_copier
move.w #$1234,(a0)
cmp.w #$1234,(a0)
bne not_copier

Its locating a big address into A0, and then adding $3039 to A0, which equals $200024. This is beyond the range of the Puggsy cartridge, on a real Megadrive with no copier, it will try and write to that address, but when it checks for $4231 or $1234, they won't be there as the memory doesn't exist.

If a copier is present, obviously a copier needs as much ram as the largest Megadrive game to ensure any game can be loaded, and that routine will be able to write to that memory address.

I assume Jon writes two different values down in the same routine is for the possibility that the RAM on the copier device is a little slower access which means that by the time the CMP instruction comes around, its possible that the check happens before the value is actually written to copier RAM.

Now obviously Jon isn't going to use the same memory address with the same offset each time, but he is going to make a massive mistake anyway.

Checking out the code at $4b534, the opcode for the LEA $1fcfeb,a0 is:

$41F9, and we know that Jon uses these big values, so if we include the top of the memory address he uses, lets see.

Searching for $41f9001f leads us to three hits:

$526, $29966, $4b534 are what is returned, and sure enough, Jon at least had the idea to change the different memory addresses and offsets, but the routine is critically flawed.


Changing $526 to BRA $54e cracks the first check
Changing $29966 to BRA $299a0 cracks the second check
Changing $4b534 to BRA $4b560 cracks the third and final check

This "copy protection" took me 5 minutes to neutralise.... 1 minute of that was loading the ROM image into memory.

I wouldn't go making a video on this one Jon.......

[DamienD]

Hahahahaha

Like the details / comedy you added into your post Sir Galahad... good read and indisputable analysis / facts from an Amiga legend, worldwide!!!

[WayneK]

The copy-protection was implemented about as well as the text that pops up was implemented... :P

"thats all the the levels"... and "your allowed" (YOU'RE... it's the difference between "your shit" and "you are shit").

Having said that, the font in Pugsy is excellent

[AmigaRob]

Even if the write tab was not an issue, I would have thought a copy protection system that relied on a hole in the disk causing a faulty track would also have been particularly easy to get around by looking at XCopy to see which track was damaged during a copy attempt, and then forcing the Amiga to repeatedly write to the track while removing the disk. The track would be completely knackered.

[Galahad/FLT]

Originally Posted by WayneK

The copy-protection was implemented about as well as the text that pops up was implemented... :P

"thats all the the levels"... and "your allowed" (YOU'RE... it's the difference between "your shit" and "you are shit").

Having said that, the font in Pugsy is excellent

I'm assuming the same font has made a guest appearance in an intro of yours?