Date   : Mon, 28 Apr 2003 20:05:45 +0100
From   : "bill.carr" <bill.carr@...>
Subject: Re: BBC Micro Games Copy Protection

> One of my favourite protection systems was Exile's.

10*LOAD !BOOT
20?&1F28=&60
30REPEAT
40CALL&1F10
50PRINT ?&1F2C
60IF ?&1F13=&28 THEN PROCchange
70IF ?&1F13=&29 THEN PROCchange2
80UNTIL ?&1F13=0
90?&1FDC=&4C
100?&1FDD=&00
110?&1FDE=&1B
120P%=&1B00
130[LDA#&4C
140STA&7890
141LDA#&4F
142STA&7891
150JMP&7800
160]
170CALL&1F2C
180END
190DEFPROCchange
200PRINT "CHANGE ONE"
210?&1F28=&C9
220?&1F2A=&60
230ENDPROC
240DEFPROCchange2
250PRINT "CHANGE TWO"
260?&1F28=&60
270?&1F2A=&D0
280ENDPROC

Found this on a disc that I recently squirted across to my PC.  A little bit
rough, but did the job.
The lines 30 - 80 loop and procedures get through the self-modifying fine.
90 - 110 changes the JMP address to a bit of my code.
The assembler at 130 - 160 changes the CH."!B" to LO."!B"
When finished, you're left with a blank screen but at BASIC.
MODE 7 and *MEDIT (Enigma Disc Imager) at &E00 + &F00 and you have the
virtual catalogue!

> The 8271 controller didn't actually seem capable
> of writing a track of this format, which is why not even backup programs
> were able to copy it.

Disc Duplicator III managed it using the third of three options.  I remember
it saying something like this shouldn't be needed because no disc would ever
use the protection (other than Disc Duplicator III,  of course).  I think
that *SEDIT (Enigma again) could access the sectors with the data on.

In an Impact games newsletter, they had a picture of a man sat by a burnt
out disc drive saying "Now that's what I call disc protection" about Exile,
after it was revealed that it hadn't worked on some machines.  This may have
been deliberate, as at the time they were pushing Zenon as being better in
some ways to Exile.  According to Cheat It Again Joe 4, there are 3
different versions of protection for the Exile disc, so presumably there
were some problems before Superior finally decided on a decent but
compatible protection scheme.