Cracked games with ERROR protections

[mai]

Originally Posted by Galahad/FLT

Bumpys has a document check I think it is a few levels into the game, i'm pretty sure all versions were not 100% of that game, but as it was so shit, no-one spotted it!

I stumbled again over this game, and i must say it is really odd.
There are cracked versions by "Crack Inc".
Maybe they released the game uncracked and later a crackfix, or someone else released a crack fix.
Current Known sets:

Bumpy's Arcade Fantasy (1992)(Loriciel)cracked
Bumpy's Arcade Fantasy (1992)(Loriciel)[cr Crack Inc]uncracked
Bumpy's Arcade Fantasy (1992)(Loriciel)[cr Crack Inc][a]cracked
Bumpy's Arcade Fantasy (1992)(Loriciel)[cr Crack Inc][a2]cracked
Bumpy's Arcade Fantasy (1992)(Loriciel)[cr Crack Inc][a3]uncracked
Bumpy's Arcade Fantasy (1992)(Loriciel)[cr Crack Inc][t +1 SCX][a]cracked
Bumpy's Arcade Fantasy (1992)(Loriciel)[cr Crack Inc][t +1 SCX]uncracked

Some of this sets have also a so called "password option fix".
Password protection is before level 2.

[ComputingData]

Originally Posted by Boo Boo

Yep dlfrsilver that has done it
Ive got an on-going debate with a friend who says I could never have copied Mercs the way I said - So I guess he wins for now

You can copy Mercs with a standard Amiga drive. You just need to use the alternative cpu clock from the video port. Just go slightly faster than standard so as to not to kill anything. Because you are going faster, the bitcell size is smaller - you can fit more on a track.

That's what I did to create the protection.

Anyone looking at the disk like the greetz? lol.

[Retro1234]

I think my memory was a bit hazzy Yeah I always said Mercs was Cool game.

I remember looking at the greetz with a hex editor but cant remember what it said

Also saw the thread on TAME - Although I didnt use the Map editor I pinched the rather Nice NES style Mario Tiles - Did you Draw or Trace them?

[ComputingData]

Grabbed them from the Mario ROM image. Then messed with them in the editor. I have a load more somewhere... When I next boot up the Amiga I'll have a bit of a hunt for goodies.

[Supamax]

Originally Posted by ComputingData

You can copy Mercs with a standard Amiga drive. You just need to use the alternative cpu clock from the video port. Just go slightly faster than standard so as to not to kill anything. Because you are going faster, the bitcell size is smaller - you can fit more on a track.

Alternative cpu clock from the video port?
Interesting! How do you do it? Along with the hardware hack/modification to the video port (have you a scheme?) do you need a special software copier or can it be done with some commercial copier such as X-Copy Pro or PowerCopy Pro ?

That's what I did to create the protection.

Uuuuuuuuuuuuh!!!
Are you the author of Mercs' protection? Are you the game programmer too?

[dlfrsilver]

Yes he is actually mercs coder

[Codetapper]

Mercs has the following on the bootblock:

*** Boot block created with PutDisk by Dirty Mind! *** Hi to all those 'Hackers' out there!!! *** If you manage to hack this product, then please say 'Hi' to me on your scroll!!! - Dirty Mind of TES *** Greetings to Joanne & Joseph, S.A.E, Anarchy Automation, A-ha and anyone who can't fit in this bootblock!!! ***

[ComputingData]

On the Video port of the Amiga - at least the A500 - you can supply an alternative master system clock on one of the pins. The pin is mentioned in the hardware manuals, you will have to look it up because I've no idea where I've put mine!

You can use this clock input to speed everything (!!!) up or slow everything down. Just supply an alternative clock source (a crystal or ttl clock) on this pin at this a little faster (get a few different crystals of ever slightly increasing Mhz values) - do this until things stop working, then go back to the cystal just before that one (the stable one).

Don't leave it running too long on the clock that is too fast, you don't want to kill your Amiga.

Now because everything is running slightly faster, when you write data to the disk the bitcell size (the diameter of a bit written to the disk) is actually slightly smaller. Because of this you can fit more bits in one revolution of a disk.

I actually could have written all the tracks long (with an even longer track type) reliably with reliable reads on all the Amigas I tried - this included the boot track. But the Trace duplication equipment didn't like it...

With that length, the Trace equipment was able to write the format and verify it - the reason why the who disk didn't use the extended tracks in the end is because someone thought it was risky going out of the official spec of the drives too much for the whole disk.

What I was going to do in the end was put slightly extended tracks on the whole disk, and one big one. The main check would check the big one. Then there would be other random checks after level 3 for some info hidden on one of the other hidded long tracks.

The good news is that I went off work for a week or so at the end of Mercs and someone decided to take the disks to be mastered early! They took the wrong (not final!) ST disks and the Amiga disks before I had implemented my plan! lol.

I wrote a command line utility called PutDisk that allowed me to create the disks. On the game side it was in the bootloader and the game used Trap commands to 'talk' to it. That's why someone on this board saw trap commands in a disassembly and wrongfully assumed that there was no special Amiga coding in Mercs and that it was just a straight ST conversion. Someone else who obviously hadn't seen the game agreed with him. lol. Anyhow, with putdisk I could write any type of track I wanted, even ones with 'random' bits where I specified.

Side note: To create random bits on a disk is quite easy, just make the clock and data (in mfm encoding) BOTH zero for a little while in the middle of a well formed track. When this happens the circuitry in the drive (the PLL) lowers it's spec for what is a 1 and raises what is a 0 this happens quickly until it finds 'noise' - the noise is the random bit. Dead easy and almost impossible to detect unless you read each track more than once when copying. Wasn't allowed to use that type of protection either.

Anyhow... Despite what most people say about Tiertex, it was really great because a lot of amazing programers and graphic artists passed though it - sharing information and technical tricks that influenced Amiga and ST games in companies they moved too. You also had a good challenge - make an arcade conversion of a top arcade game on two different computers in half a year - can you do it?

It's a shame that they had such tight deadlines - When a game comes out in the Arcades, you only have about 6 - 9 months to get it out before people lose interest. In that time you have to map out the entire game, create the graphics, music and sound, get a feel for the game and program it - We never had any graphics or help from Capcom or anyone - everything had to be reversed. When you work 9-5, it's not much time to get it done properly.

Dirty Mind was my handle - so was Cat! on other stuff...

[Supamax]

Wow!
Thanks, very interesting!

[ComputingData]

lol - I see your head is now spinning!

[Supamax]

Originally Posted by ComputingData

I wrote a command line utility called PutDisk that allowed me to create the disks. [...]
Anyhow, with putdisk I could write any type of track I wanted, even ones with 'random' bits where I specified.

It would be nice to put our hands on your utility .
Perhaps with a nice GUI...
I bet Denis (dlfrsilver) would be enthusiastic!

[StingRay]

Originally Posted by Supamax

I bet Denis (dlfrsilver) would be enthusiastic!

Now guess who's the one which ComputingData referred to here:

Originally Posted by ComputingData

That's why someone on this board saw trap commands in a disassembly and wrongfully assumed that there was no special Amiga coding in Mercs and that it was just a straight ST conversion.

I remember that I had a long discussion with him on IRC about that very topic, telling him that the code is actually quite ok and that trap instructions are no proof that is an ST port.

[ComputingData]

lol.

The Trap system, like LineA and LineF are pretty useful for an independent sub-system (like a disk loader). I wouldn't use them for something time sensitive like a game loop.

[Supamax]

Originally Posted by StingRay

Now guess who's the one which ComputingData referred to here

I didn't know... Oops!!

[modrobert]

Did anyone with the original Powercopy (dlfrsilver?) and dongle try dumping the parallel port data using a cheap logic analyzer or similar (non-intrusive) method while copying?

Since the dongle includes some logic, dumping that traffic should make it a lot easier to crack the software.

[dlfrsilver]

The software was brilliantly cracked by stingray lately !

[modrobert]

Great, missed that.