★ APPLICATIONS ★ COURS DE BIDOUILLAGE ★ PROTECTION : SWEET 6K THE STS COPYMOD ★ |
| Wacci - Sweet6k | Applications Cours De Bidouillage |
Speedlock Associates said it'd take a £10,000 duplicating machine to copy their 6k protection. STS's Rob Scott and Richard Wilson discovered how to do it for under a fiver... One system, devised around 1988, was the so-called 8k Speedlock. This ingenious protection system was devised by David Looker and his then partner in crime Dave Aubrey-Jones. It relied on a simple but fiendish fact which was that although a CPC could happily read sector sizes of &1800 bytes (6k to you and me), it couldn't actually write them because the end of the track actually overwrites the beginning (due to the motor and ready circuitry on the CPC motherboard). Cunning, eh? A small elite group of hackers had been working on the 8k problem for some years, such as Jason Brooks, Colin Harris, Kevin McCaughy and HE Haxwell. Despite their combined talents, no one could devise a program to copy the disk. We even resorted to wiring up a 3" drive to an Amiga to copy them - hardly a satisfactory arrangement. The breakthrough The first breakthrough came in 1992 when I wrote to Speedlock Associates and assumed the role of a large software publisher wishing to protect his games. They kindly sent me a disk with 8k protection on it and a brief letter explain-ing what it was and why it worked. The subject was then laid to rest for a number of years until a chance meeting with Richard Wilson, author of ParaDOS and programmer extraordinaire. While discussing various program-ming projects I brought up the subject of the 8k discs, my conversations with Speedlock, and what I had already dis-covered about the 8k system. After a few collective days'thought and exper-iment, the first 8k copymod was born. Truly archaic, it used a single pole double throw switch which you activated when you wanted to copy an 8k disc. Since the copymod simply relies on a very basic switching principle, it was only a matter of time before we discov-ered a chip suitable for providing fully automatic operation for the copymod. How does it work? The copymod works by altering the cir-cuitry that switches the motor on and off. In effect, it actually stops the disk drive from overwriting the track header by slamming on the brakes (so to speak) as soon as the drive become ready. What could be simpler? The following article appeared in CPC Challenge disczine – the challenge being staying awake until you'd finished reading it. As it appears to be so accurate and as the author has bla-tantly copied our mod, we are copying his article! At this point we'd like to extend our thanks to Kevin Thacker for publishing details on how to do a copymod when we did one free of charge for him and specifically asked him not to tell anyone how to do it! Thanks mate. (I think 1 may recall that name from somewhere -Philip) This describes how to build a modification to make your FDC able to copy disk protections that use the 8k sectors. These sectors are identified by their sector IDs. There is usually only one of 6. It is perfectly simple to read the data and format the track, but when data is written, it overwrites the GAP and sec-tor ID information and so corrupts the data on the track. It has been found that the disc drive motor remains rotating even after the motor has been switched off with an OUT command, and so extra data is written in this time. To work correctly, this hardware modification needs a software copier which already knows of the modification. One such program is Xexor by STS. (Odd that! – Rob) If you have a good knowledge of programming the FDC, then you can write a copier yourself. In order for the FDC to format the track, you specify a sector size of &05, and 1 sector per track. In the execution phase of the format command you transfer the following data: track number You will find that this has formatted the track. (Interestingly enough, if you try to use a sector size of &06, the track becomes "unformatted" due to the header and GAP information becoming overwritten - which is where some of the old disc copiers fell down with 8k protection. – Rob) In the execution phase of the write data command, which outputs the sec-tor data, you force out &1802 bytes (the extra 2 bytes are needed otherwise the FDC will not write the last word), and then perform the OUT command to stop the motor. Now, the FDC will think an error has occurred, and it will halt the execution phase immediately (so it will not write out the final gap information), and then start the result phase. The mod: CPC6128 This modification has been done on a CPC6128 only. The modification may not work on a CPC Plus or a DDI-1 interface. (Now if the author had discov-ered the mod through his own initiative, as we did, then he would be able to modify a Plus to utilise the Mod. In fact the Plus modification article appears immediately after this one. – Rob) What you need A CPC6128 (obviously) What you do Open up your CPC6128, undoing all the screws on the underside. Remove the keyboard lead into the main board. Take the 74LS32 and bend all the pins so that the chip lies flat on a table. Find another LS chip on the CPC motherboard, and align the chip so that the notch at the end is the same end as the notch on the LS chip. Now, solder the GND pin onto the GND pin of the chip on the PCB, and the +5V pin onto the +5V pin on the chip on the motherboard. Locate the Ready pin of the 2nd drive connector and solder a wire from the pad to the pin labelled "Ready" on the diagram below. Locate the Motor pin of the 2nd drive connector and solder a wire from the pad to the pin labelled "Motor on" on the diagram below. Locate pin 15 of the IC203, and cut the solder track running from this pin to the 2nd drive connector The procedure is then complete. Put your CPC together, and connect the keyboard. Turn it on, and insert a disk. If the disk is catalogued correctly, then the procedure has been successful, but if it reports"Drive A: disc missing" then open it up and check the wiring. The mod: 6128 Plus Rob here again. It should be stressed that if you are in any way wary of per-forming this sort of procedure, then don't. If you screw up your CPC, don't come blubbing to us! Also I'm crap at doing diagrams so we have included just the one to help you locate the relevant components on the motherboard. The procedure is very simple so the text should more than adequately descibe how it's done. Special software is required to utilise this mod. At the time of writing, Xexor and a custom STS utility are the only programs that make use of this mod. You will need 1 74LS32 chip (`copymod chip') 3 short lengths of wire 1 soldering iron and solder 1 Philips/Pozi screwdriver How to do it Remove all the screws from the Plus casing, undo the clips securing the case and dismantle unit. Disconnect the power and LED connectors from the board and make sure the unit is facing towards you as normal. Find pin 9 on 1C7 (7414) and cut the track going to it on the computer PCB. This is the drive READY output line. The easiest way to do this is to use a fine pair of cutters and cut the leg where it goes onto the PCB. The idea is to have enough of the leg remaining after cutting to solder a wire from our copymod chip to. Take the copymod chip and snap off all the pins except for 1,2,3,7 and 14. "Piggyback" the copymod chip onto 1C7, noting the correct polarity – i.e. the notch at the top of the copy-mod chip will match the notch at the top of 1C7 – and solder pins 7 and 14 onto the corresponding pins on 1C7. This provides the 5v power required by the mod chip. With the keyboard facing you, locate the 2nd disk drive connector at the back of the machine. Solder a wire from pin 1 of copy-mod chip to the 17th (motor on) contact from the left of the 2nd disk drive connector port. Solder a wire from pin 2 of copy-mod chip to the 8th (ready) contact from the left of the 2nd disk drive connector port. Reassemble machine, and test that the drive works, and that when a disk is ejected that you get "disc missing" errors. This indicates that the copy-mod is working ok. And that's all there is to it, really! CHECK YOUR DIAGRAM Dear Richard, Concerning the STS Copymod article in issue 111, the IC's are shown the wrong way around. From the drawing it looks as though the wire link should go to pin 5 of IC203, whereas (as the text says) it must go to pin 15. Also, the unused inputs of the copymod chip (the 74LS32) shouldn't really be left unconnected, they should be taken to one of the power rails. The easiest way to do this is to carefully bend the unused inputs (pins 4, 5, 9, 10 ,12 and 13) back flat across the top of the chip, then solder a length of wire to these pins (thus joining them together) and then to either pin 7 or 14 (it doesn't matter which). This is really only a matter of good practice (basically, it just prevents the unused gates from oscillating) but we might as well do it properly, eh? If I get Xexor, will the copymod allow me to convert my own programs from the normal Data format to the 6K per sector format, and if so, do I need any additional software to get them to run? Also in issue 111, I had an advert for my new Freescape game "The Bomb Room", but, in his infinite wisdom, Philip (I presume) didn't include Derby in the address. So, if anyone wants a copy, my address is: 11 Colwell Drive, Brookside, Alvaston, Derby DE24 OUP Cheque/PO payable to M.J. Bela. The 3" disc version is £6.99, and the 3.5" disc version is £6.49. Or, you can send your own 3" disc for £5.99. Overseas please add £1.00. Finally, I would agree with the "ten issues per year" brigade, it's only fair to have a break occasionally, isn't it?
|
