Copy protection: Difference between revisions
(How it works) |
mNo edit summary |
||
| Line 5: | Line 5: | ||
The copy detection method relies on the fact that most computer CD drives/burners automatically correct disc errors thanks to the available EDC and ECC fields in CD-ROM sectors. | The copy detection method relies on the fact that most computer CD drives/burners automatically correct disc errors thanks to the available EDC and ECC fields in CD-ROM sectors. | ||
In some games, SNK intentionally added data and code with correctable errors and its (correct) checksum value in the [[CPY.TXT]] | In some games, SNK intentionally added data and code with correctable errors and its (correct) checksum value in the [[TXT_file|CPY.TXT]], BIB.TXT and ABS.TXT files. The system ROM detects the data's presence, computes the checksum of all the added data, and compares it with the good one. If they match, it means the errors were corrected (probably by a burner) and the system doesn't allow loading the game. | ||
Is error correction disabled just when loading CPY.TXT ? See disasm. | Is error correction disabled just when loading CPY.TXT ? See disasm. | ||
| Line 36: | Line 36: | ||
* 0F BA: Checksum of the error-corrected data | * 0F BA: Checksum of the error-corrected data | ||
* 4E 45 4F 2D 47 45 4F 00: "NEO-GEO", 0 | * 4E 45 4F 2D 47 45 4F 00: "NEO-GEO", 0 | ||
* 03: | * 03: Enabled checks (bit 0~2) | ||
* 02: ? | * 02: Region flag ? | ||
Todo: What is $10F782 and $10F77E ? RTS with D0=1 means fail. There would be 3 different copy protection checks ? | |||
=Patching= | =Patching= | ||
The patching tutorial commonly found online tells to replace the first two occurences of the letter "g" with "f" after the "NEO-GEO" string. | The patching tutorial commonly found online tells to replace the first two occurences of the letter "g" with "f" after the "NEO-GEO" string in CPY.TXT. | ||
This | This causes the computed checksum to be wrong (pass first check) and turns the BEQ instructions into BNE (pass second check). | ||
=Emulation= | |||
[[MAME|MESS]] "corrects" cleaned ISO files by changing only one "g" back to "f". See Read_LBA_To_Buffer() in megacdcd.c. | |||
=Game list= | =Game list= | ||
Since the NeoGeo CDZ came out in 1996, it is unclear if pre-1996 games had new masters made to use the protection or if SNK planned to use it since the beginning (makes no sense ?). | Since the NeoGeo CDZ came out in 1996, it is unclear if pre-1996 games had new masters made to use the protection or if SNK planned to use it since the beginning (makes no sense ?). | ||
Todo: How does the in-game protection work ? | |||
{|class="wikitable" | {|class="wikitable" | ||
!Title||CDZ protection||In-game | !Title||CDZ protection||In-game protection | ||
|- | |- | ||
|[[Art of Fighting 3 - The Path of the Warrior]]||Yes||Yes | |[[Art of Fighting 3 - The Path of the Warrior]]||Yes||Yes | ||
Revision as of 01:02, 10 February 2017
The NeoGeo CDZ's system ROM has a CD-ROM copy protection feature. Not all games use it.
Method
The copy detection method relies on the fact that most computer CD drives/burners automatically correct disc errors thanks to the available EDC and ECC fields in CD-ROM sectors.
In some games, SNK intentionally added data and code with correctable errors and its (correct) checksum value in the CPY.TXT, BIB.TXT and ABS.TXT files. The system ROM detects the data's presence, computes the checksum of all the added data, and compares it with the good one. If they match, it means the errors were corrected (probably by a burner) and the system doesn't allow loading the game.
Is error correction disabled just when loading CPY.TXT ? See disasm.
For example in Art of Fighting 3 - The Path of the Warrior, the following data is appended to CPY.TXT:
A header:
0F BA 4E 45 4F 2D 47 45 4F 00 03 02 ...
And valid 68k code:
clr.l d0 clr.l d1 tst.l $10F782 beq $12601C bset #0,d1 tst.l $10F77E beq $126028 bset #1,d1 cmp.b $12600A,d1 beq $126030 addq.l #1,d0 rts
- 0F BA: Checksum of the error-corrected data
- 4E 45 4F 2D 47 45 4F 00: "NEO-GEO", 0
- 03: Enabled checks (bit 0~2)
- 02: Region flag ?
Todo: What is $10F782 and $10F77E ? RTS with D0=1 means fail. There would be 3 different copy protection checks ?
Patching
The patching tutorial commonly found online tells to replace the first two occurences of the letter "g" with "f" after the "NEO-GEO" string in CPY.TXT.
This causes the computed checksum to be wrong (pass first check) and turns the BEQ instructions into BNE (pass second check).
Emulation
MESS "corrects" cleaned ISO files by changing only one "g" back to "f". See Read_LBA_To_Buffer() in megacdcd.c.
Game list
Since the NeoGeo CDZ came out in 1996, it is unclear if pre-1996 games had new masters made to use the protection or if SNK planned to use it since the beginning (makes no sense ?).
Todo: How does the in-game protection work ?
(List from [1])