The disk was formatted to 40T. The disk size low byte in Track 0 Sector 1 was set to &40 rather than the normal &90. This meant that the disk appeared to be 32 tracks rather than 40. *BACKUP was therefore prevented as the last 8 tracks would not be copied.

The package needed a ROM to be present, either a physical ROM or a ROM image loaded into sideways RAM. The ROM image was present on the disk in tracks 32 to 39 inclusive sectors 1 to 8 on each track. *BACKUP would copy the disk minus the ROM code. *COPY *.* would copy all the files but omit the ROM code in tracks 32 to 39. This was an effective method of preventing casual copying.

The disk protection was checked by the program INSTALL, which ran at &7800. INSTALL also extracted the ROM code from the disc and assembled the image in a buffer starting at &3800.

INSTALL firstly checked that the ROM was not already installed. If the ROM was present INSTALL terminated and returned to BASIC. INSTALL went on to check that there was a free sideways RAM slot available; if not the program reported an error and terminated. Next the disk size bytes were checked in Track 0 Sector 1. If they were not as expected (&31 and &40) INSTALL reported an error message and halted. Assuming the disk size was correct, INSTALL then copied the ROM image into the buffer in 2K chunks starting at Track 39 and ending at Track 32. The ROM code was moved from the buffer to the identified sideways RAM. Lastly code was run to initialise the ROM without needing Ctrl-Break to be pressed and control passed back to BASIC.

Once the protection method was understood, removing the protection was quite easy. Firstly the original disk was cloned using ADI2. Using the cloned disk the disk size was set to the expected values for a normally formatted 40T disk.

The INSTALL program was edited to remove the subroutine call to check the disk size bytes and re-saved onto the disk.

This edited disk now worked properly. The disk could be backed up and an SSD image created.


2018 - 2021 flaxcottage.com