Demonlord Generic EA protection remover v0.002 Welcome to another new and very useful (yeah, right) utility from Demonlord... This program will remove the EA booter protection envelope, and create an output image with the protection removed. The output image can be converted to Snatchit format, if you want to write the image back to a physical floppy disk. This disk can be both 5,25" and 3,5". This program is also a small step on the way to add support for protected images in Flopper. Since the EA disks can't be copied with programs like CopyIIPC/Snatchit/Teledisk/Anadisk, they will have to be cracked before they can be used. This program should take care of that problem, and if it doesn't, contact me (see end of document). The program also saves the about 45 minutes that it normally takes me to do this operation manually... (and maybe even more on disks with broken track 0F) Options: Source drive - Selects the drive to use to read the EA booter disk (can be either A or B). Use protected track from disk - If you answer Yes, the program will read the protected track 0F from the Source disk. If you answer No, the program will use the file EA.DAT, which contains the protected sectors saved to disk. In all the games I've come across, the protected track 0F contains the same data, so the EA.DAT file should be universal. If the protected track can't be read from source disk, or it doesn't seem correct (sector 24 is very special!), you will get the question again if you want to use the file instead. This will be the case if the disk has been copied with CopyIIPC/Teledisk. The only thing I've been able to copy these disks with is the CopyIIPC Option Board, which is a hardware card, and I don't think the normal floppy controller can write these disks... Patch output image for Flopper - Will add a few extra patches to remove Flopper hostile code from the protection envelope. (like INT killers and memory clears) Force Singlesided output - Will force the output image to be single-sided, even though the source disk may be double-sided. The One on One disk is double sided, but the game only resides on side 0, so saving both sides in this game is probably just a waste of space... If the disk only is single-sided, the program will detect this, and only save one side. Output image filename - Not too hard to guess, the filename of the output image. If no extension is specified, .IMG will be added automatically. (if output filename ends with ".", .IMG will not be added). The image will either be 200K (10 sectors/track, 1 side, 40 tracks) or 400K (10 sectors/track, 2 sides, 40 tracks). Sector 10 on side 1 will be added as an empty sector on double sided images, since they only have 9, and saving the image like that would just be a bad idea... No checks for free diskspace is made when writing image to disk, so make sure you have at least 500K free diskspace before running program! Program operation: After all questions are answered, the program will start its work. It starts by reading the bootrecord. It seems that the EA games only have 2 different kinds of bootrecords, one for games that does have DOS directory, and one for the games that doesn't. This is because the loader code is located in the FAT and DOS directory in the games without proper DOS files. (see list below) If the program can't determine the type of bootrecord used, it will try to read sector 24 from track 0F. This sector is very special. When trying to read it, INT 13 will return that 2 sectors have been read, and 1024 bytes of data will be read if the read is successful. If INT 13 returns 2 sectors read, the program will tell you to contact me... :) (this is because track 0F acts like EA booter, but it has unknown bootcode). If INT 13 returns either 1 sector read, or an error, the program will want you to make sure it really is an EA booter. If you're not sure, or don't know how to determine, contact me anyway... Once the bootrecord type is determined, the program will locate where the loader code is located on the disk. After this is done, it will read the loader code, and try to read the protected track to get the data needed to decrypt the loader. If the read to track 0F fails on any sector, you will be asked if you want to use the EA.DAT file instead. If you select No, the program will quit, since it can't find the data it needs to continue. When the loader is decrypted, the program will look up which tracks the game itself is located on. It will then read the sectors from the protected track needed to decrypt the game itself. As before, if any read fails, you'll be asked if you want to use data in EA.DAT. When the necessary sectors are loaded successfully from track 0F, the program will determine how many sectors should be decrypted, and then decrypts the game. If the initial code is recognized, the game's name will be shown. All games listed below will be identified and the game's name will be shown. If you have a game that is not identified, please contact me (see below). When this is done, the program will start to create an output image. First it will patch the bootrecord, and then the loader code to make sure the game works without the protected track (among other things...). It will also patch image for Flopper, if you've selected for the program to do so. After that, the program will read the remaining tracks to make a complete image. Please note that track 0F will read a lot slower than the other tracks but that is just because of its weirdness... (tracks already read will not be re-read, so the program will skip these tracks, as they already are in memory...) That is it... But note that this program only removes the "standard" EA protection envelope, and not any additional protections that may exist. One on One, for example, has another protection that is checked either when the intro times out or/and when selecting Color/Mono. This protection, and others like it will NOT be removed by this program. They either have to be removed by you, or by sending the output image to me... If you selected to patch for Flopper, the output image should be ready to run unless the game has additional protections, or other weird stuff that will kill Flopper... "Known" games that use EA protection: Games with DOS files: (loader code normally located in sector 9,0A on tracks 10-13) Mind Mirror Murder on the Zinderneuf Music Construction Set Pinball Construction Set These disks all have sectors marked as bad by DOS. The sectors marked bad are where the loader code is located, and the entire side 1 (on PCS, at least)... Games without files: (loader code normally located in sectors 2-8 on track 0) Archon Boulder Dash 1+2 Hard Hat Mack Julius Erwing and Larry Bird Go One-on-One Seven Cities of Gold Not supported EA game(s): Marble Madness (it has a protection that probably was a predecessor to the protection that this program removes. The disk has the same layout as the "later" games, but it doesn't use the data in the sectors on the protected track, it only checks for their presence. It also had entirely different bootrecord and loader, so no support will be added for it. In all other EA booters, the bootrecord and loader code are practically identical. The only thing that differs is the number of tracks to read, number of sectors to decrypt and the checksum of the loader code.) Error messages: Drive not ready - The source drive is not ready. Insert disk, close door and try again. EA.DAT has illegal filesize - EA.DAT file was found, but it doesn't have the correct filesize. The file should be 4864 bytes long, and contain the raw contents of the sectors needed to decrypt loader, and the processed contents of the sectors needed to decrypt the game. Error creating image file - There was an error creating the output image file. Maybe you specified an illegal filename? Error opening EA.DAT - The file EA.DAT was not found, and you've either chosen to use this file instead of protected track, or the protected track was broken. This file is not required to run the program, if track 0F is fully working on source floppy disk. Error reading bootrecord/loader code/game data - There was an error reading one sector on the source disk. This is a fatal error, so if one occurs, the program will automatically quit. Error reading protected sectors - One or more sectors from track 0F couldn't be read properly, or didn't return the correct error. You will be asked if you want to use data in EA.DAT instead. Not enough memory free to complete operation - The program requires 70K of free memory after load, to run. This memory is used as buffers to load different parts of the disk. For the interested: Disk layout and other technical info: The "standard" EA booter disk has 10 sectors/track on side 0, numbered 6, 1, 7, 2, 8, 3, 9, 4, 10, 5. Track 0F contains 96 "sectors", numbered 1, 31h, 2, 32h, 3, 33h... and so on up to 30h, 60h... Since there's no way to store 96 512 byte sectors on a single track, the only thing on this track are the sector headers, which is also what is read when reading a sector from the track... If the disk is double-sided, side 1 will have 9 sectors, numbered 1-9 on all tracks. If the game has DOS files, it also has a lot of sectors marked as bad by DOS. These are the sectors that contains the loader & game code. In the Construction Set "games", the rest of the disk space is available, to be able to save the stuff you create in them. Pinball Construction Set also has entire side 1 of the disk marked as bad, since the disk is single sided. The bootrecord and loader code is filled with niceties that will kill Flopper, and make debugging a bit harder. Part 1: Boot record operation The bootrecord sets up INT 1E at 0:80 (effective way to kill INT 20+), set up SS:SP, set CGA video mode and start loading the EA logo from sector 9 on track 0. It will read sector 9-0A from this track, and then proceed to read tracks 1, 2 and 3. This data is read directly into CGA memory at B800:0, so the image will be shown as it's loaded. After this, the loader is loaded from disk (into memory starting at 0:F000). The loader is read from different sectors, depending on whether or not the game has DOS files on the disk. Then the decryption data is loaded from track 0F, sectors 0F, 0D, 0B, 09, 07, 05 and 03. These sectors are used to decrypt the loader using an XOR loop. After decryption is done, it will jump to the loader. The bootsector is only patched to not read from protected track, and not to decrypt anything, since the program saves decrypted loader in image file. Part 2: Loader operation This is where most of the stuff happens. The loader starts by setting a number of Interrupts to "original" values. These are probably values used in 100% compatible PC BIOS. INTs that are restored are: 0, 1, 3, 4, 5. It will then set INT 18 (ROM BASIC) and 1B (Ctrl-C check) to INT 19 (bootstrap loader). It moves a routine to clear the memory at 0:F000-0:FFFF, to wipe out all traces of the loader, to memory at 50:EA. Then it overwrites the first byte of Interrupts 0-1D with an IRET instruction. This is just to kill all interrupts that have been hooked, since these INTs are in BIOS if the game is booted properly. A little hacker protection... It continues to do a checksum on the bootrecord. I'm not sure if this value is ever checked, but I still insert the value it's supposed to become... It then hooks INT 3, and then runs it. The new INT 3 will check the checksum of the loader code. This IS checked later, and if incorrect, the game will reboot instantly (after load) using INT 19. Then it clears certain areas in memory (segments 1000-1C00, 2000-B000, C000-F000). After that it actually starts to load the encrypted game code. After this is done, it loads the protected sectors to use to decrypt the game with. If any read errors occur here, or the wrong errors occur, it will jump to EA:50, which is not a good thing! The sectors loaded are: 24, 0B, 1D, 17, 5F, 42, 57, 58, 1B, 4A, 46, 11, 03 and 41. All sectors above 40 are expected to have CRC errors... When it has loaded all protected sectors it runs an advanced calculation to figure out a value to use to modify the protected sectors. Luckily for me, this value is always 7CE0. Then it decrypts the actual game. When that is done, it does a new checksum, this time on the decrypted game data. Incorrect checksum results in a reboot. Before jumping to 50:EA, it sets 0:84 (originally INT 21 vector), to 9, since the game has moved the INT 1E table to 0:80, this value is the number of sectors per track byte. Part 3: Memory cleanup When the loader is done, it jumps to 50:EA. This is where the loader moved a little piece of code that will clear first the memory area at 0:F000-0:FFFF and then clear 50:EA-50:FF. It will then automatically continue at 50:100 where the game was loaded. The game will (or should) start. If you want to debug the actual game code (after de-protection), there's an easy way to get to the real game's start (in SoftIce). Enter SoftIce (and insert disk in A:, have BIOS check floppy, and boot A: first) bpint 10 ax=4 (trap the setting of CGA videomode) boot (boot the game, SoftIce will break somewhere around 0:7C5C, depending on which bootrecord the game has...) bc * (clear all breakpoints) p ret (let the game load loader code) g 50:100 (proceed to 50:100, which is where the game will be loaded) ... and that's it. The loader code is wiped from memory before this. Use g 50:EA (instead of g 50:100) if you want to look at loader code, which is located at 0:F000. (you can get to the game code like described above with protection intact, except you have to use command "i3here off", to turn off checks for INT 3 breakpoints. It's not much use, though, since both the loader code and the game code will still be encrypted on disk...) Final words: If you should find a game that isn't listed above (under header "Known games that use EA protection"), or if the program tells you to, please contact me. If you have a game that the program doesn't recognize (either doesn't recognize bootcode/loader or the game itself) or doesn't unprotect properly, please contact me, and something will be done about it... e-mail: demonlord@swipnet.se