Re: Copy Protection of PET cassettes - Flash Attack.

From: Daniel Kahlin <tlr_at_stacken.kth.se>
Date: Tue, 10 Aug 2010 21:05:19 +0200 (CEST)
Message-ID: <Pine.LNX.4.62.1008102044400.17598@yxa.extundo.com>
On Tue, 10 Aug 2010, Daniel Kahlin wrote:

>
> On Tue, 10 Aug 2010, Anders Carlsson wrote:
>
>> Daniel Kahlin wrote:
>> 
>>> Anyway a quick analysis shows that the game loads $027A-$2000. The first 
>>> chunk at $027A looks like a cassette header indicating a file "FLASH 
>>> ATTACK" $03FD-$2000
>> 
>> Bill Degnan wrote:
>> 
>>> Yes.  Now try to save this to cassette using the TIM prompt using standard 
>>> procedure.  Something prevents dumping the memory to tape.
>> 
>> While I haven't studied the PET memory map recently, isn't $03FD part of 
>> the cassette buffer? If so, perhaps the computer rebuilds that part of 
>> memory when you save in a normal way, and you lose whatever was there.
>
> From what I can tell it isn't part of the cassette buffer.  Judging from the 
> flash attack file there is space for two cassette buffers.
> One from $027A-$0339 and one from $033A to $03F9.
> Though, the layout in the flash attack file could be a decoy.
>
> I'm leaning towards that there might be a different low limit for tape
> saving on the PET.  IIRC this limit is $0300 on the C64 and VIC20.
>
> Will check in vice when I get home tonight.

Ok.  This supposedly works:
(on a two tape BASIC 4.0 box)

LOAD"FLASH ATTACK",8
SYS1024
S"FLASH ATTACK",02,027A,2000

I can't test because only one tape port is emulated in vice.
Note that this is shown in the petfaq section "WHAT ARE THE COMMANDS FOR 
THE M/L MONITOR?": http://www.zimmers.net/cbmpics/cbm/PETx/petfaq.html

It seems the crucial sections are:
$03FE=$9D & $03FF=$DA, and that the tape header in buffer 1 is correct 
but $02AB-$0339 are $00. (the default is $20)

:027A  01 FD 03 00 20 46 4C 41   .... FLA
:0282  53 48 20 41 54 54 41 43   SH ATTAC
:028A  4B 00 00 00 00 00 00 00   K.......
:0292  00 00 00 00 00 00 00 00   ........
...

I assume this is checked within the virtual machine to make it a bit more 
complicated. ;)

Btw, there is some residual source code at $0A68-$0B8D...

/Daniel

       Message was sent through the cbm-hackers mailing list
Received on 2010-08-10 20:00:03

Archive generated by hypermail 2.2.0.