Protected cassette images / ideas for file format

Page 2/2
1 |

By Louthrax

Prophet (2435)

Louthrax's picture

13-05-2016, 00:36

Anybody knows if images of these games have been made? Would these work on .CAS format ?

By ~mk~

Champion (312)

~mk~'s picture

13-05-2016, 01:34

The Red-Point games? Yes but only as wav.
Cas format can't handle them AFAIK.
I tried with TAPE2CAS and it recognizes them as Spectrum-format turbo blocks but breaks soon after that.

By Louthrax

Prophet (2435)

Louthrax's picture

13-05-2016, 01:41

Interesting, I'd be curious to have a look at these. Is there a place to download some of these wav files ?

By ~mk~

Champion (312)

~mk~'s picture

13-05-2016, 02:46

I'll get in touch with you.

By Manuel

Ascended (19053)

Manuel's picture

13-05-2016, 22:06

Please also contact me.

By Manuel

Ascended (19053)

Manuel's picture

15-05-2016, 14:33

I had never seen the Red Point and RealTime cracks before, so I made some videos that show them:
Red Point: https://www.youtube.com/watch?v=RbRB8p2Y0vY
RealTime: https://www.youtube.com/watch?v=cM5AIsPTNOM

Quite impressive and interesting if you ask me!

By saccopharynx

Master (173)

saccopharynx's picture

21-07-2016, 10:09

I missed all the fun!!!

Anyway, I'll let you know a bit more about the protection implemented by Red Point. Video games were all ripped to BIN files and subsequently edited so that a game could be loaded using a sequence of BLOADs. Then, the “bloadable” BIN files were the source to create ITM files using Intermega (a copy tool developed for Spectrum and later adapted to MSX by his author, Beto JAS).

I decoded the ITM format many years ago: http://ricardonarvaja.info/WEB/OTROS/TUTES%20SACCOPHARYNX/m002.html, so I currently don't remember many details, but in general, an ITM file could pack several BIN files as long as it didn't exceed 53KB or 64KB approximately, depending on the Intermega version. That limitation existed because the files had to be loaded in conventional MSX RAM in order to copy games.

The Intermega was used at two stages. Firstly, to pack all the binaries into one pre-ITM file, which was then compressed and encrypted using an external program which additionally added a loader. Secondly, to copy ITM-formatted games on cassette tapes and floppy disks. Since ITM files were merely BIN files that had been compressed and encrypted, the loader was naturally necessary to read, unpack, decrypt and to load the protected games. The latest versions of Intermega added the loader automatically during the copy process.

Considering the time when the protection was developed, it was quite advanced as included very painful characteristics:

  1. The loader was "mostly" encrypted. It was necessary to bypass between 10 and 20 decryption cycles, each one actually designed to decrypt the next one. At the end of the last cycle, the loader was fully decrypted in memory and ready to read ITM files which contained the START, END, and EXECUTION addresses (encrypted as well) of the BIN blocks.
  2. ITM files on tape had no headers, so a simple BLOAD"CAS:",R command could not be used to load anything. That command was only used to initiate the loader which would continue with the rest of the tape, but since the loader was strongly encrypted, and there were no emulators for debugging, nobody was able to pirate Red Point's pirated games. Only when the Intermega was stolen by a dishonest employee, the first tools to break the protection appeared.
  3. ITM files on floppy disks could not be accessed by any effortless means. The FAT and DIRECTORY were encrypted and relocated to the last tracks and a boot program (in the boot sector) was used to initiate all the loading process. There was no directory entry that pointed to the ITM loader. It was accessed and loaded by reading specific sector numbers, and then decrypted.
  4. Floppy disks were protected using non-standard numbering of sectors (e.g. 1,10,3,4,5,6,7,8,9) on track #0 or #1 (I don’t remember now). The existence of that format was verified before loading a game using a very nasty trick: The hook at #F27F. That address is invoked while reading a sector via the DiskROM PHYDIO, I mean #4010. However, since the protection added its own code at #F27F, reading for example sector #1 (which was not suspicious at all), was used to masquerade the reading of sector #10 on track #0. In a few words, #4010 was invoked to read sector #1, but since this routine calls #F27F before reading the requested sector, it was possible to surreptitiously change the sector number. Years ago, I also wrote a bit about this disk protection: http://ricardonarvaja.info/WEB/OTROS/TUTES%20SACCOPHARYNX/m0...

Since I no longer own MSX computers, it took me several years to test all those protections again. Thanks to Manuel and Wouter who made of OpenMSX a fantastic emulator by implementing DMK and a very precise tape emulation on WAV, I was finally able to unveil all the secrets which I could not discover in the late 80's (I didn't have enough knowledge but there weren't powerful tools either).

Another important feature is that games on tape could be recorded and loaded at 1900 bauds, as an alternative balance between the very slow 1200 and the fast (but very risky) 2400 bauds. For experimental purposes, I have created some "protected" WAVs of several large games using Intermega under OpenMSX, such as Aleste, Aleste Gaiden, Andorogynus, GaryuuouKing, Rastan Saga, and Nemesis 3. Everything worked smoothly as it should be, although I then finally pressed F9 to accelerate and complete the game recording/loading which, on the contrary, in some cases takes between 20 and 30 minutes approximately :-) I still have them if someone is interested.

Cheers,
S

PS.: Realtime's protection is the same protection implemented by Beto JAS as a Red Point partner. Realtime just used a former version of Intermega (without the downcount clock) and changed the splash screen.

By Manuel

Ascended (19053)

Manuel's picture

21-07-2016, 23:23

I'd be interested in a few more if I don't have them already Smile

By manolito74

Paragon (1274)

manolito74's picture

30-11-2016, 23:15

@louthrax, could you please share a ".Wav" of the Game "GP World" by Turbo Soft?

Thanks a lot! ;-)

Page 2/2
1 |