PAVIC

This seems to be a generic protection method for PAVIC Publications.

The disks were 40T or 80T. 80T titles were not formatted for tracks 40 to 79 inclusive. The protection relied on one track being formatted with less than the normal number of sectors on a track, for example track 16 having only 4 sectors or track 6 having a single sector formatted. This unusually formatted track returned Data Field CRC errors for all the sectors on the track. Tracks after the unusually formatted track all had their sector IDs with the high bit set. The disk size bytes were adjusted so that the disk size reported only the normally formatted tracks.

*BACKUP would only back up the normal sectors and *COPY *.* would not copy the data hidden in the sectors where the sector IDs had their high bit set.

!BOOT was a machine code program, part of which was encrypted. When it ran it checked that the unusually formatted track existed, crashing if it did not. The program then decrypted itself before running the decrypted section, which loaded two sectors into &7000, some of which was downloaded to &3100. The downloaded code placed the value &3C into location &380 before *RUN DFS was executed.

DFS checked for the unusually formatted track, crashing if it were not found and then loaded a proprietary catalogue from track 39 and used this catalogue to load and/or run the required programs; BASIC programs were loaded at the right PAGE, DFS executing *BASIC and placing OLD|MRUN|M into the keyboard buffer before returning to BASIC.

DEFEATING
Once the protection mechanism was understood, DFS could be modified. !BOOT was not really needed. The code ?&380=&3C:*RUN DFS would execute the title just as well. !BOOT was changed to be an EXECutable file with those contents.

DFS was modified to bypass checking for the unusually formatted track by changing the execute address to &1138 from &110C. It was also modified so that instances of ORA #&80, which set the high bit for sector IDs, were changed to ORA #&00, which left the IDs unchanged.

A short BASIC program was written to clone the original disk by reading sectors from the original disk and writing them to a newly formatted disk, unsetting the high bit of the sector IDs where necessary and omitting the unusually formatted track. The modified !BOOT and the modified DFS were written to the copied disk. The boot option was set to execute using *OPT 4 3. The disc size was adjusted to the correct value for the format

The disk would now *VERIFY and could be archived as a SSD image and worked correctly. The image will only work under DFS emulation.

 

2018 - 2021 flaxcottage.com