Hacker News new | past | comments | ask | show | jobs | submit login

As a kid I used to take copyright protection apart on cassette based games, mostly on Z80 based computers so I could add infinite live pokes and stick a trainer on the front. I remember Elite on the ZX Spectrum (I played it mostly on the MSX, although I never got round to cracking it). The copy I had used a funky loader used in games released by Firebird.

The Firebird bleepload was interesting in that it had a small leader tone and loaded small blocks of data, checked them with (IIRC but I could be wrong) a CRC, incremented a block count and then loaded the next block. Because this was all done at the standard spectrum loading speed it actually made games take longer to load than normal, but had the supposed advantage of being able to rewind and retry a block if it didn't load successfully, or as was the case for many people, continuously fail to load a block successfully.

There were a fair few releases of Elite, I remember there being a version that used a terrible copyright protection mechanism called Lenslok (I first saw it in a game called TT Racer). Lenslok was a plastic prism that had to be calibrated to your TV each time you loaded a game. It would display two characters mangled in a way that supposedly could only be read through the prism (but you could just document the characters that came up when you had the lenslok viewer and then look them up when you didn't have one.

Using a Multiface (which was a hardware device that would jump to a special area of onboard memory with a hex editor when a special red button was pressed) and a debugger you could pull the loader apart, find the jump to the decompression/game start routine then usually step through to the code, patch the jump to lenslok out (although I preferred changing the code that checks user input to always compare to itself in case any later checks would match, some people would just jump to the successful code entry address too) and then modify the loader to patch the code or jump to the address on start.

The multiface also had the ability to dump out the contents of memory to disk as a snapshot, but it would check to see if the multiface was there afterwards as it's own form of copyright protection. This again was pretty straightforward to patch out, but felt like cheating, and if you hadn't already cracked the loader then if you wanted to dump out the loading screen you'd risk losing the bottom 512 bytes IIRC due to the menu that popped (but I might be wrong, it's been nearly 30 years since I've used one).




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: