SUPERIOR SOFTWARE DISC PROTECTION --------------------------------- TO PRINT A MEMORY ADDRESS, type : > PRINT ~?&[address], EG. PRINT ~?&41B for file length (version ONE). or use *DISS or *MEDIT (Enigma Disk Imager) ---------- Version ONE - "Sector Read Fault" text appears in code Used 1988, 1989 [filename] 000400 000400 0000D9 START EXECUTE LENGTH Quest 1988 The Last Ninja 1988 Barbarian 1988 Barbarian II 1989 Predator 1989 >From all of the examples above, the program is loaded at 000400. To start with, *LOAD [filename] At memory address &41B is the number of sectors which the program will read to gather the protected file code. EG. contents of &41B = &28 THEN the file length will be &2800. At memory address &49A and &49B is the execute address (reversed) when all of the code is loaded from the disc. EG. contents of &49A = &03, &49B = &11 THEN the execute address of the code is &1103. At memory address &4BF and &4C0 is the start address (reversed) to start loading the code from the disc. EG. contents of &4BF = &00, &4C0 = &11 THEN the start address of the code is &1100. ---- To stop the code from executing the protected file code, type : > ?&499 = &60 (return from subroutine) then to run the loader type : > CALL&400 This stops the program and returns the user to BASIC. >From here the data from the original, protected file can be saved to a blank disc (NOT the original) EG. from the above examples the file would be saved [filename] 001100 001103 002800 START EXECUTE LENGTH to achieve this type *SAVE [filename] 1100+2800 1103 ---------- Version TWO Used 1989 onwards [filename] FF0400 FF0400 0000D9 Superior Soccer 1989 Ballistix 1989 Ricochet 1989 Play It Again Sam 16 1991 Pipemania & Vertigo FF0900 FF0900 0000D9 Hostages FF0400 FF0400 0000D9 Perplexity FF1100 FF1100 0000D9 The above games load the protected file loader at different addresses, but the offset is always the same, EG. 448 = 948 = 1148, 48 from the start address. To start with, *LOAD [filename] At memory address &408 is the number of sectors which the program will read to gather the protected file code. EG. contents of &408 = &15 THEN the file length will be &1500. At memory address &448 and &449 is the execute address (reversed) when all of the code is loaded from the disc. EG. contents of &448 = &00, &449 = &20 THEN the execute address of the code is &2000. At memory address &45D and &45E is the start address (reversed) to start loading the code from the disc. EG. contents of &45D = &00, &45E = &15 THEN the start address of the code is &1500. ---- To stop the code from executing the protected file code, type : > ?&447 = &60 (return from subroutine) then to run the loader type : > CALL&400 This stops the program and returns the user to BASIC. >From here the data from the original, protected file can be saved to a blank disc (NOT the original) EG. from the above examples the file would be saved [filename] 001500 002000 001500 START EXECUTE LENGTH to achieve this type *SAVE [filename] 1500+1500 2000 ---------- Both of the files work in a similar way. Once the one file has been recovered from the disc and saved, the game can be copied freely. COPY all of the other files to a blank disc and the game should work. Examples of games you may have : THE LAST NINJA -------------- Protected file = NINJA3 (version ONE) Original file info NINJA3 000400 000400 0000D9 > *LOAD NINJA3 Information in loader file &41B = &1C (length) &49A = &09 (execute &49B = &23 address - reversed) &4BF = &00 (start &4C0 = &11 address - reversed) > ?&499=&60 > CALL &400 > *SAVE NINJA3 001100+1C00 2309 De-Protected file info NINJA3 001100 002309 001C00 RICOCHET -------- Protected file = RICODE (version TWO) Original file info RICODE FF0400 FF0400 0000D9 > *LOAD RICODE Information in loader file &408 = &53 (length) &448 = &36 (execute &449 = &19 address - reversed) &45D = &03 (start &45E = &11 address - reversed) > ?&447 = &60 > CALL &400 > *SAVE RICODE 001103+5300 1936 De-Protected file info RICODE 001103 001936 005300