Date   : Mon, 28 Apr 2003 20:36:37 +0100
From   : Graham <bbc@...>
Subject: Re: BBC Micro Games Copy Protection

At 15:54 28/04/2003 +0100, you wrote:
>[BBC games protection]
>
>I can't think of any more at the moment.  Anyone else with good hacking
>memories?

I always remember Superior games as they used very simple calls to load
files directly from the disc rather than a *LOAD or whatever.  I remember
getting a game for my birthday on disc which I promptly backed up for
everyday use in about 3 minutes!  

For disassembly Exmon II was hard to beat.

Exile was another good one.  Although I remember getting it onto another
disc easily enough (Exmon to the rescue), my time with the BBC was almost
at an end (Archimedes calling) and I didnt remove the Novella part since I
had the manual anyway, although I'd be interested in hearing how it was done.

I remember a package of discs called DDD-Suite, which consisted of 3
packages much in the same vein as Office which had only two files on the
disc, this was 
!boot and Main (from memory).  This then used a custom loader to execute
the files.  I remember that one because there was a routine in it to check
whether it could write to the disc, if it could it erased the first two
tracks and then the catalogue would only have DISC and ERASED as the files!

I do recall hearing about Starquake's protection being based on eor'd VIA
timer driven code (something like 100 loops?), but never saw the game to
see how it worked.

Acornsoft games were always fun, the self-modifying code sometimes
presented a challenge but once you knew how to get past one, the rest were
fundamentally the same.

>One of my favourite protection systems was Exile's.  [snip]
>Examining it closer showed there to be a !Boot file which was
>hidden by setting bit 7 of its directory character - an undocumented
>feature of the DFS I never knew about.  *VERIFY/*BACKUP believed it to only
>have 1 track!  

Track 0 Sector 0 bits 7 and 8 control the size of the disc (IIRC), so it
was common practice to set this to 00 02.  As Verify/Backup used this to
indicate the size of the disc, it would only do the first track, which had
nothing in it except a short boot programme.

Surely the easiest known "hack" was the tape "locked?" message?  I still
remember not believing how easy that was.  :-)

Did anyone ever get round the protection that the Replay system used?  Each
system used a different key, so games saved on one Replay couldn't be used
on another.

Thats about all I can recall just now.  

Graham