ATARI SOFTWARE PROTECTION TECHNIQUES

Transcription

1

2 ATARI SOFTWARE PROTECTION TECHNIQES by George Morrison Forward by Ed Stewart (Athor of Letterman) AN ALPHA SYSTEMS PRODCT

3 SOFTWARE PROTECTION TECHNIQES DISK TILITIES (C) COPYWRITE 1983 FROM ALPHA SYSTEMS ATARI is a registered trademark of Atari, Inc. Atari Software Protections Techinqes Disk tilities is a tility package designed for se by software writers to help protect yor software from, illegal copying. The theory is described in the book (Atari Software Protection Techniqes) that is inclded in this package, bt this disk tility shold help een the beginner se some of the methods described. A men of options will atomatically appear on yor screen when the disk is loaded (with the BASIC cartridge in), or jst type RN "D:MEN" from BASIC. Each of the tilities and options contain instrctions which appear on the screen when the program is rn. For yor conenience, most of the programs are listable, and are well docmented to help yo nderstand them. I sggest yo LIST or RN each one to see the instrctions, bt type NO when asked ~f yo wish to execte the program. Also all the program listings from the book are contained on this disk. For example, Figre 4.4 from the booj{ is called "FIG44" on the disk. The following information will help yo better nderstand some of the programs on the disk Directory Hider (called H~DER on the disk) The directory Hider is sed to help preent DOS copies. It is especially sefl for men drien programs, or programs which mst epe-a files or rn other programs from the disk. The Directory Hider hides yor disk directory in a new locattonon the disk. Yor programs will atomatically se the hidden directory (becase this program changes DOS to point to it). Bt others trying to copy yor programs will see 707 free sectors. WARNING - Make a back-p of the disk yo wish to protect before rnning this program. SETSCAN - Th i s program wi 11 scan the sec tors on the di s~{ for bad or misassigned sectors. It asks for the starting and ending sectors yo wish to scan, and then displays a message for each sector. SECTLOOK - This displays the contents of a sector in character format. Jst enter the sector yo wish to read, and it will be displayed on the screen. VTOCER - This program has two parts. Option One shows yo which sectors on the disk are sed and which are free (according to the VTOC) Option Two is sed to resere space on a disk for a hidden directory. As indicated in the book, the directory shold be hidden in a certain range of sectors. If HIDER can/t find the space to hide yor directory, a message will be displayed telling yo to rn this program. Complete instrctions are displayed on the screen. BADWRITE - This program enables yo to protect yor disks with bad-sectoring. The methods sed to hae yor program check' for the bad sectors are explained in the book. This tility lets yo create bad sectors on yor disk. There are two simple ways to create a bad sector on a disk sing only standard hardware.

4 This tility will do both. Bad Sector Writer Option One reqires that yo slow down yor disk speed, bt is mch qicker than Option Two. Som~ types of disk dries cannot be slowed down enogh to wrlte bad sectors, so if yors is one of those, yo mst se Option Two. SING OPTION 1. The first step in sing Option 1 is to adjst yor drie speed down to RPMS. Before changing yor drie speed, go to option 3 - ADJST DRIVE SPEED. This option will help yo get yor speed properly adjsted. To write bad sectors adjst yor speed to aprox RPMs. Try to write the bad sectors at the slowest possible speed withot getting I/O errors. To get the best bad sectors, yor disk shold jst barely be able to write. Adjsting Yor Drie Speed To adjst yor disk drie speed, it is necessary to remoe the top coer and adjst one screw. To remoe the coer, jst pry off the for little tabs on the top of the drie with any sharp instrment. Then with a standard phillips head screwdrier, loosen the for screws (nder the tabs) that hold the coer on, and gen t 1 y 1 if t off the coer. There are- two basi c types of ATARI 810 disk dries arond. The newer dries hae a circit board across the top (see diagram DAn). The older dries hae no circit board across the top and hae a large white plastic screw in the back left corner of the drie (see diagram "B"). This large white screw can be trned by hand to adjst yor speed. It is ery sensitie so a qarter trn may be all yo need. The newer dries are a bit trickier to adjst. To find the speed adjstment, look for a small green box with a tiny siler screw on it. It is located in toward the rear and a little left of center in the drie. I t is ery sm~.,ll bt can be ~jsfed sing a micro-screwdrier. The speed adjstment on the newer drie is not ery precise. It may take as many as 8 complete reoltions to properly adjst yor speed. The next step is to write the sectors. se option 1 to do this. Jst enter the sectors yo wish to create then press retrn. After all yor bad sectors are complete, retrn to option 3 to adjst yor speed back to normal. SING OPTION 2 This method proides an alternate method of writing bad sectors. I still recommend option 1 as a faster and easier method, howeer if yor disk drie was prchased after Jan 83, or yo own a non-atari disk drie, yo may need to se option 2. To se this method, yo mst attach two long pieces of tape (fol ded oer on to themsel es) f i rml y to the top of the di sk >-'o wish to write bad sectors on (see Diagram 1). Then insert the disk in yor drie, so that the tape sticks ot when the door is closed (be sre tape is long enogh to get a grip on when the disk door is closed). Next, enter the destination disk drie nmber (the disk drie yo wish to write bad sectors on) and the sector nmber. Then be sre eerything is set and type retrn. The screen will now prompt yo to shake the tape. Yo can gently moe the tape back and forth, and alternately psh on one piece while plling on the other. The compter will beep and signal yo when the bad sector is written. Then stop plling while it rechecks the sector. Note that ntil yo Qet Qood at it, it can take 10 mintes or more to write a single bad sector. So Keep at it, and wait for the compter to signal yo that it is done. yo wish to abort the process, hit any key. If

5 DIAGRAM A 0 0 o \ 0 _' DIAGRAM ORO._." R J J I J C,O {) I r; ~ ~ / ~ '\.J.-,-. -. ;.. - ::..: _ ,. ~:,",.-,-,~,,"... ". \ - -d DIAGRAM

6 WARRANTY ALPHA SYSTEMS warrants to the original consmer/prchaser that this program disk (not inclding the compter programs) shall be free of any defects in material or workmanship for a period of 60 days from the date of prchase. If a the disk "fails to load dring this 60 day warranty period, Alpha Systems will repair or replace the disk at Alpha Systems option, proided the disk and proof of prchase is deliered or mailed, postage prepaid, to Alpha Systems. This warranty shall not apply if the disk (1) has be~n missed or shows signs of excessie wear, (2) has been damaged by playback eqipment, or (3) if the prchaser cases or permits the disk to be sericed or modified by anyone other than Alpha Systems. Any applicable implied warranties, inclding warranties of merchantabillty and fitness are hereby limited to 60 days from the date of prchase. Conseqential or incidental damages reslting from a breach of any applicable express or implied warranties are hereby exclded. NOTICE As with most compter software, all Alpha Systems compter programs are distribted on an Has is" basis withot warranty of any Kind. The entire risk as to the qality and performance of sch program.s is wi th the prchaser. Shol d the porgrams proe -~ ~~:~;t"-,o-t"frtrtr pf~,~~~" ff\~~~it~~.. ~pt,~, ~~ manfactrer, distrlbli't'br-, orretart~... as~mestilil,e enre cost of all necessary sericing or repair. Alpha Systems shall hae no liability or responsibility to a prchaser, cstomer, or any other person or entity with respect to any liability, loss or damage cased or alleged to be cased directly or indirectly by compter programs sold throgh Alpha Systems. This incldes bt is not limited to any interrption of serice, loss of bsiness or anticipatory profits or conseqential damages reslting from the se or operation of sch compter programs. The proisions of the foregoing warranty are sbject to the laws of the state in which th disk is prchased. Sch laws may broaden the warranty protection aailable to the prchaser of the disk.

7 ATARI SOFTWARE PROfECTION TECHNIQES by George Morrison Forward by Ed Stewart {Athor of Letterman} AN ALPHA SYSTEMS PRODCT

8 Atari, Atari 400 Compter, Atari 410 Program Recorder, Atari 800 Compter, Atari 810 Disk Drie are all trademarks of Atari, Inc. Apple is a trademark of Apple, Inc. IBM-PC is a trademark of IBM, Inc. (c) Copyright 1983 by Alpha Systems, Stow, Ohio, Printing 116 batch 2, Jan 1985 All rights resered. No part of this book may be reprodced by any means withot permission in writing from Alpha Systems. Printed in the nited States of America Coer design by Richard M. Morrison V

9 FORE WARD The need for software athors to protect their property from theft is increasing. The nathorized dplication" of compter programs has become sch a widespread actiity as to threaten the ery existence of the element that has helped to poplarize the home compter most, namely the independent software entreprene"r. The phenomenal growth of the compter market has opened p ast new horizons of possibility for both the creator and the thief. It is therefore important for programmers to hae at their disposal all of the aailable techniqes to inhibit a potential pirate. This book proides the fel" necessary to make an informed decision on what protection schemes wold be most appropriate to employ and as sch fills a oid in the literatre. It may be arged that disclosre of this information will only encorage piracy. I do not agree with this argment for two reasons. First, an adanced pirate is already aware of the contents of this book and wold not benefit in the least from a reiew of it. Secondly, the wold-be pirate does not hae the technical acmen to break the protection techniqes sggested herein. This book is therefore a alable asset to yo, the software athor, in identifying the strong points and shortcomings of the arios methods a ailable today. I fond this book to be well wcitten and athoritatie in its approach to the i

10 problem. I feel that most readers will find it both informatie and helpfl in their endeaor to protect their inestment. Ed Stewart, April, 1983 Honeybear Software V ~- ii

11 ACKNOWLEDGEMENTS Alpha Systems wold like to thank John Liang for the encoragement to market the book. Ed Stewart (the athor of letterman) for his technical help. Helen Proiialeck for doing all the little things that helped to get the book written. Richard and Ethel Morrison for their help in making this book a reality. iii

12 PREFACE This book is written with the aerage software writer in mind. Most of the software protection techniqes presented here can be sed by anyone with een a small amont of experience with Atari compters. Some topics coered do reqire a good amont of expertise to really nderstand, so small programs are inclded in the book. Some sample programs that make the techniqes easy to se are on the optional software disk. Be sre to se the glossary in the back of the book, since some technical terms are needed to describe the protection processes. Also, it is adised that yo read the chapters in order so that yo can gain a working knowledge before reaching the difficlt sections. " / i

13 TABLE OF CONTENTS Foreward.. i Acknowledgements iii Preface i Chapter 1: INTRODCTION TO SOFTWARE PROTECTION '.. 1 What is Software Protection? The Concentration of the Book. Pros and Cons of Software Protection Problems of Piracy Need for Back-.ps The Responsibility of the Vendor Totally ncopyable Software? Chapter 2: GENERAL PROTECTION OF PROGRAMS WRITTEN IN BASIC 6 Disabling the Break Key Disabling the System Reset Key -. Preenting an Error Break Preenting a LOAD and SAVE Combination Protecting Against LIST Special Cases Chapter 3: CASSETTE PROTECTION... 12

14 Chapter 4: GENERAL DISK PROTECTION. 15 An ATORN.SYS File Preenting DOS Copies Disk Directories VTOCs Hiding Disk Directories and VTOCs ", Chapter 5: BAD SECTORING 28 What is a Bad Sector? How Bad Sectors Protect Software Creating Bad Sectors Conclsion Chapter 6: HIDING PROTECTION CODE., 38 Breaking Code by Hand Hiding Protection Codes Self Modifying Code Layering Yor Protection Wild Goose Chases Conclsion Chapter 7: MISASSIGNED SECTORS. What are Misassigned Sectors? How Misassigned Sectors Protect Software Creating Mis.assigned Sectors How Pirates CopY.Misassigned Sectors Protecting Misassigned Sectors 46 i

15 Chapter 8: ROM AND EPROM CARl'RIDGES 56 ROM Copy Techniqe I ~ Protecting Against Techniqe I ROM Copy Techniqe II ~ Preenting ROM Copy Techniqe II ~ Chapter 9: HARDWARE DATA-KEYS 61 ~ How Data-~eys Protect Programs Bilding Data-Keys "~ Copying Data-Key Protected Software Preenting the Data-Key Copy Techniqes ~ Conclsions ~ Chapter 10: LEGAL PROTECTION TECHNIQES 67 Patents Copyrights T"rade Secrets Conclsion Chapter 11: COERCIVE PROTECTION TECHNIQES 74 Serial Nmbered Software Protection Throgh Intimidation Self-Destrcting Code Freeware Selling nprotected Software Chapter 12: RECOMMENDED METHODS OF PROTECTION 81 ti Chapter 13: THE FTRE OF SOFTWARE PROTECTION AND PIRACY 85 ii

16 ~ Appendix A. 89 -, Glossary..'. 92 " G - V -, - - ' iii V,,~ V

17 CHAPTER 1 INTRODCTION TO SOFTWARE PROTECTION Talk abot bootleg record albms. tapes and moies has been increasing for seeral years. Copyright infringements by people who tape teleision programs has also been a growing problem. One fast growing area that hasn I t seen mch media coerage is software copying. It is estimated that there are two illegal copies of Visicalc (a poplar spread sheet program) distribted for each one legally prchased. With the growing problem of software piracy. more people are writing abot ways to preent it. Sorces that try to deal with the topic seem to focs only on legal protection techniqes. They mention copyrighting or patents. bt sally neglect to. say that these methods hae not been effectie in stopping or een slowing down the problem. The reason for the failre of legal protection is the type of people who are pirating software. While record piraters may be big operators taking in millions. most software pirating is done. by indiidals. Catching them is almost impossible. let alone trying to legally prosecte each one. WHAT IS SOFfWARE PROTECTION? Software protection refers to techniqes which discorage or preent people from making copies. The techniqes sed can -1-

18 take many different forms. The software prodcers can threaten legal prosection of pirates; make a moral plea against copying; gie idle threats; make software physically difficlt to copy; or attempt to bypass the problem throgh the se of new marketing or distribtion methods. The goal of software protection shold be to maximize the retrn on the inestment of the prodcers, not preent piracy at any cost. If the protection method preents the prodct from being broght to the market at a reasonable price or makes the prodct too difficlt or tedios to se, then. the prodcers hae oerlooked this goal. There are people so, obsessed with protecting their software that it preents them from selling their programs. Keep the goal of maximizing the retrn on yor inestment in mind when considering any software protection method. THE CONCENfRATION OF THE BOOK This book is written to help software prodcers deal with the problems of piracy. Legal protection and ways to discorage copying are dealt with in a good amont of detail, bt the primary focs of the book is on methods that make copying physically more difficlt. As mentioned aboe, the majority of copying is done by indiidals who make copies for a few of their friends. Sch people are not worried abot the police coming to their door with search warrants, and the scope of the problem shows that pleading with -2-

19 ~ them not to copy, has little effect on the ast majority of software pirates. ~ Protecting software shold be like a bank protecting its money. To be effectie, ~ software protection mst try to physically preent piraters from being able to steal Ii the software. Legal and coersie techniqes may discorage some, bt I feel the best Ii protection makes copying so difficlt that only a few people hae enogh expertise to Ii copy it, and is so time consming and tedios that those expert pirates gie p Ii before breaking the protection codes. The majority of this book deals with methods to Ii achiee these goals. Ii THE PROS AND CONS OF SOFfWARE PROTECfION fhe problems of piracy. Eery bootleg ~ program made depries the prod<;:ers. of some of their earnings. Some programs can ti take months or years to write, so it is only natral that the writer wishes to get ~ financial rewards for his efforts. The problem of piracy is so bad that many Ii times the person receies an illegal copy of a program before he has een seen ads for ti the prodct. Loosely knit national software trading rings are making the bootleg Ii software a aila ble een in the most remote areas. Obiosly, something mst be done Ii abot software copying, bt for a moment, consider the other side to the problem. ti fhe need for backps. nfortnately, software is a fragile and olatile prodct. -3-

20 Software can be destroyed by heat, hmidity, wear, magnetic fields, falty reading. deices or een dirt. Jst toching the exposed srface of a disk can destroy it. Most compter owners hae learned that the only reasonably sre way to presere yor software is to make backps. Many people hae come to rely on their software for balancing checkbooks and keeping their phone lists, etc., and wold hae serios problems shold their software fail to work. In fact, many bsinesses hae come to rely so heaily on their software that they cold not fnction withot it. nfortna tely, well protected software is intentionally ery difficlt to back p. On one hand we hae the need to protect manfactrers from pirates and on the other, the need for the ser to be able to back p his software. The responsibility of the endor. Althogh backing p game software is obiosly not as important as home filing or bsiness software, all software shold hae proisions for backps. Some of the techniqes that will be discssed later are well sited to deal with the back p problem, bt at the ery least, it is the res.ponsibility of the endor to proide qick and inexpensie back p serice by mail. This can be as simple as an offer to replace malfnctioning software by mail for a small handling charge. Keep in mind that proiding for backps remoes one of the reasons for people to spend their time breaking software protection and may prodce good will toward yor prodct and company. -4-

21 TO"fALLY NCOPYABLE SOFTWARE? Can any program be made totally ncopyable? This qestion gets a qalified no. For most practical prposes, any software.can be pirated. No matter how complex the protection techniqe, there are people who can break it. Any protection techniqe inented by man can be broken by man. Let s say for a moment that trly ndplicatable software is inented at some point in the ftre. If it is trly ncopyable, then een the manfactrer cannot copy it for distribtion prposes. As yo can see, trly ncopyable code is not good nless yo only wish to sell that one copy. fhe trick to protecting software is not to make it completely ncopyable, bt to make it difficlt enogh to discorage all bt the most adanced and persistent wold-be pirates. I hate to qalify my original statement, bt I can think of one case where software dplication is almost impossible. The case that comes to mind is the software aailable only on an information serice like fhe Sorce or Compsere. This is software which yo neer get possession of becase yor responses are transmitted to the compter which contains the software. Chis may be fine for adentre type gclmes, bt for the real time arcade graphics type games, it is irtally nsable. Presently the cost is high and the response slow, bt maybe the ftre will show some hope for this method. -5-

22 CHAPTER 2 GENERAL PROfECTION OF PROGRAMS WRITTEN IN BASIC Protecting programs written in BASIC reqires seeral protection techniqes. In the following chapters, the specifics of dealing with tape and disk software are coered, howeer, certain protection is needed no matter how BASIC programs are stored. The real problem protecting BASIC code is the SAVE command. Protecting against the SAVE is probably more difficlt than at first yo wold expect. This is becase there are many different ways of stopping a programs exection and then saing it ia a SAVE"D :program" or SAVE"C:" command. The topics that one mst nderstand to stop this possibility are: 1. Disabling the break key 2. Disabling the system reset key 3. Preenting an error break 4. Preenting LOAD and SAVE com- binations 5. Special cases where control mst be gien to the program ser. All these problems come p with BASIC programs becase once loaded ihto memory, they are ery simple to sae to disk or tape if the program ser is gien the opportnity. The trick is not to gie them the chance. In other words, yor program mst not lose control of the compter

23 DISABLING THE BREAK KEY Hitting the break key stops the exection of a program withot clearing memory. fhis allows simple saing of the program. To disable the break key ta kes only two pokes.fhey are: POKE 16,112 POKE 53774,112 Technically, yo. are changing the POKEY interrpt ector bt sffice it to say that these pokes will disable the break key. It is important to note that these pokes mst be repeated after each GRAPHICS command. fhis is becase the GRAPHICS command refreshes those memory locations. Other commands can clear these locations also. To be on the safe s ide, it is good to repeat these pokes seeral times throghot the program. Since the break key is sometimes hit accidentally. these pokes are a good idea een in nprotected BASIC programs. DISABLING fhe SYSTEM RESET KEY The system reset key is similar to the ~ break key in that it stops exection withot clearing the program from memory. There ~ are two simple ways to disable this key. The first is: POKE 580, 1 This POKE cases what is called a cold ~ start. In other words, if system reset is pressed after this POKE, the system will ~ -~

24 restart itself in the same way it wold if yo trned the compter off and then back on again, and all program memory is cleared. Another way to disable the system reset key is: POKE 9,255 This will case the system to lock p (keys won't work) if system reset is pressed. Either of these two methods is acceptable for disabling the system reset key, howeer, the first is preferable for disk based software becase it will case the disk to reboot. PREVENTING AN ERROR BREAK As yo probably know, when an error is encontered in a BASIC program, exection is stopped and an error message is displayed. This proides anyone the opportnity to sae yor program. Of corse, a well written program shold not hae errors in it, bt often nsal inpt can case them. For example, if the program asks for a n mber bt the person enters a letter, it may case an error. Also, nsal circmstances may arise that were not foreseen by the programmer. To help preent these types of breaks, the BASIC command TRAP can be sed. For those not familiar with this, it cases the program togo to a specifi~d line nmber if an error is encontered. A complete explan- -8-

25 ation is in yor BASIC manal. It shold be noted that once a TRAP is sed, another TRAP statement mst be issed if yo want to contine s topping errors. PREVENTING A LOAD AND SAVE COMBINATION If yor program reqires the ser to "LOAD" it or to "RN" it, it is more difficlt to protect. This procedre gies the ser the opportnity to sae it before it is rn. One good way to preent this is by haing an atomatically booting disk or cassette. The details of this method will be presented in the sections on disk and cassette protection, bt essentially an atoboot system cases yor program to rn atomatically when the system is started. PROTECfING AGAINSf LIST I~ fhere are seeral ways to preent someone from being able to LIST yor program. The one I feel is best cases the compter to lock p if a LIST (or any ther command) is gien with yor program loaded in memory. Be sre to hae a bac k p before sing this procedre so yo will ha e a listable ersion to work with shold yo decide to pdate yor program. To se this procedre, jst insert this line as the last line in yor program: POKE PEEK(l38)+256*PEEK039)+2,O: SAVE "D: program": NEW -9-

26 For disk sage, change where it says "program" to the name yo wish to sae yor program as. For cassettes, change the SAVE to a SAVE "C:". Type GOTO to sae the protected ersion to the disk. This procedre changes the crrent statement pointer to 0 and will allow yor program to rn normally een thogh it cannot be V listed. SPECIAL CASES At times, it is necessary or desirable to let the ser hae control of the compter and LIST or MODIFY yor program. Een in these cases, it is still possible to protect yor programs from copying. The trick here is to make yor program need some conditions preset before it will rn. One way to do this is to hae yor atoboot procedre point to a small initialization program that will then load yor program. An example wold be to hae this initialization program roke a small machine langage sbrotine into memory and then rn yor main program. For those not familiar with assembly langage, here is a simple example that can be sed: POKE : POKE 1681,96 \-...J fhis assembly langage roline will j~t clear the s tack and retrn to yor program when called with a statement "like this: -10-

27 X=SR ( 1680) This call can be pt in arios locations throghot yor main program. These are sed to make yor compter lock p shold it try to rn withot haing POKED the sbrotine into place. In other words, yo can let yor program ser copy and modify yor main program, bt it will not work withot rnning yor initialization program which is protected. Yo may point ot that the. person can jst remoe these statements and then the program will rn correctly. This is tre, bt hopeflly they will think the statement seres some prpose other than jst protection and not jst remoe it. One way to preent the program ser from being able to remoe it. is to make the sbrotine perform some alid fnction needed by yor program. Then, the program will not rn (with or withot statemenls) if yor initialization program is not rn ~ first. -11-

28 CHAPTER 3 CASSETTE PROTECTION fhere are major problems with techniq es sed to protect cassettes. 1 n fact, many companies hae stopped releasing cassette based software becase of this. Varios methods are aailable that make cassettes harder to copy, bt none offer protection against a copy system called "Adio Dping". Adio dping is a techniqe sed by large scale software prodcers to dplicate their tapes. It is also sed by software pirates. Adio dping is done by directly recording one cassette from the other sing two high qality cassette recorders. A cord is rn from the otpt (or earphone) jack of one recorder to the inpt (sally ax in) of the other, and the cassette is copied with all filters and noise redction systems trned off. This yields a working copy of the cassette. This software protection problem arises from the fact that standard cassettes are sed for software. With all the high qality stereo systems arond, almost eeryone can get access to a cassette recorder good enogh to dplicate tapes sed for software. Althogh the se of this method by pirates, stops the software manfactrer from preenting copying altogether, certain techniqes are aailable which at least help protect the program against simple BASIC copies and tape to disk copies. They can a Iso help preent others from trying to -12-

29 market yor programs with only minor r) modifications and a different name. First, the methods discssed in the ~ preios chapter on general BASIC protection shold be employed on cassettes r) sing BASIC. One simple way to protect a program against the LOAD and SAVE r) combination is to make yor program nlistable. The techniqe presented earlier r) to preent the list command (see chapter 2) also protects against a simple sae (') command. In this case, yo mst instrct the prchaser (in the docmentation) to (') type; r) RN "C:" r) A load wold not work becase on\..e the program is loaded, the protection wold r) preent a rn command from working. This techniqe also helps preent a pirate from r) transferring the tape program to disk or modifying the program for resale. r) Machine langage programs offer different protection problems. Seeral r) companies market programs which transfer machine langage programs from tape to r) disk. Fortnately, these programs are not effectie a t copying mltistage loads. A r) mlti-stage load program is one which loads in seeral parts. The program ses r) the standard boot procedre to load a rotine, which then loads the rest of the r) pl"ogram, or the program can be broken into seeral segments that load each other in r) trn. The se of these mlti-stage loads is ery effectie against standard tape to -13-

30 tape and tape to disk tilities. Only the first segment of a mlti-stage program is copied by these tilities becase they se the boot info from the beginning of the tape. As stated earlier, these techniqes can make copying or modifying cassette programs harder, bt they are ineffectie aga inst adio dplicating systems. Some companies deal with this problem by prodcing two ersions of their programs. One scaled down ersion on cassette, and a higher qality ersion on disk. This encorages disk owners to by the disk ersion rather than jst copying the cassette. The manfactrers also cont on the fact that cassette owners a re less likely to be familiar with copy techniqes. Cassette based programs do offer a wider market than disks and are mch easier to prodce than cartridges. Howeer, from a software protection standpoint, cassette based programs hae serios problems. The final decision on the se of cassettes shold be made only after examining yor objecties for yor program careflly. -14-

31 CHAPTER 4 GENERAL DISK PROTECTION This chapter will coer disk protection in general. If the programs yo wish to protect are in BASIC, then the techniqes presented here shold be sed in combination with those presented in Chapter 2. The methods presented here are the first step to disk protection. The chapters on bad sectors, misassigned sectors, and hiding protection code, deal with more adanced forms of disk 'protection. ArORN. SYS File If yor program reqires the ser to LOAD it before rnning (in BASIC or assembled, it can sally be copied ery easily. A good way arond this is with the se of an AfORN.SYS file or an atoboot disk. The name ATORN.SYS has special meaning to DOS. When a file with that name is on a disk, it will be loaded atomatically when the compter is trned on (with the disk drie on, of corse). sing an ATORN.SYS file is ery easy for assembler programmers. Any machine langage program can be set p with a "RN AT ADDRESS" (DOS option K) and renamed to ATORN.SYS. Then it will rn atomatically when the disk is booted. Another option for assembler programmers is creating an atoboot disk. This is a disk that carries the information to load yor program in the boot sectors (sectors 1 and -15-

32 2). See Atari fechnical ser's Notes for complete details on this method. Creating an ATORN.SYS file is mch more difficlt for a BASIC programmer, since the file has to be a machine langage program. Figre 4.1 shows a simple BASIC program that will create an ATORN.SYS file for yo. When the program is rn, it will create a file called ArORN.SYS that will atomatically rn yor BASIC program for yo. The BASIC program mst be named "FI RSTPGM" for it to work. Also, the disk mst hae DOS.SYS on it. Besides helping to protect yor V program, an ATORN disk has another adantage. It is mch easier for beginners to se since it loads and rns yor program atomatically. Preenting DOS Copies The protection methods presented p to now are sfficient to preent copies from BASIC. This section focses on preenting DOS copies. From the Atari DOS men, the ser..:an dplicate a file (option 0), copy a file (option C) or dplicate a disk (option J). Preenting these types of copies reqires a knowledge of directories and VTOC's. Disk Directories: The disk directory is probably the most heaily sed part of the disk. Wheneer a file is accessed (loaded, deleted, read, copied, etc.) DOS ses the directory. The directory contains the names, locations and lengths of all files on -16-

33 FIGRE REM )1)1 THI S PROGRAM CREATES AN ATORN.SYS FILE, WHICH WILL ATCI1ATICALLY 28 REM )1)1 RN PROGRAM - D I F I RSTPGH- WHEN DISK IS LOADED 38 OPEN.4,S,8,-D:ATORN.SYS- 48 FOR J=1 TO READ A;PT.4,A 68 NEXT J 78 CLOSE.4 S8 DATA 255,255,8,6,138,6,162,8,189,26,3,281,69,248,5 98 DATA 232,232,232,288,244,232,142,18 5,6,189,26,3,133,285, DATA 187,157,26,3,232,189,26,3,133,286,169,6,157,26,3 118 DATA 168,8,162,16,177,285,153~187, 6,288,282,288,247,169, DATA 141,111,6,169,6,141,112,6,169,15,141,186,6,96, DATA 186,6,248,9,185,123,6,286,186,6,168,1,96,138, DATA 174,185,6,165,285,157,26,3,23 2,165,286,157,26,3, DATA 178,169,155,168,1,96,8,8,8,8, 8,8,8,8,8 168 DATA 8,8,8,8,8,76,8,8,8,34,77,71,8 8,84, DATA 82,73,78,58,68,34,32,78,85,82,255,255,226,2, DATA 2,8,6-17-

34 the disk. The directory is loaded in the ap- proximate center of the disk, in sectors 361 throgh 368, inclsie. It is created when the disk is formatted with DOS. A machine langage program can do away with the directory all together if it is atobootir:lg and doesn't need to access files. In general thogh, the directory is a reqired part of the disk. Figre 4.2 shows how the directory is stored on the disk. This diagram is inclded for adanced sers bt its nderstanding is not reqired. VTOC' s: VTOC stands for "olme table of contents" and is sed to keep track of which sectors on a disk are fll and which are free. Wheneer a file is added or deleted from the directory, the VTOC is pdated to show which sectors are now sed or free. The VTOC is stored on sector 360 and its layot is shown in diagram 4.3. nderstanding this diagram is not reqired bt is inclded as an aid for adanced sers. Hiding Disk Directories and VTOC' s Hiding disk directories is a ery effectie techniqe for stopping noice copiers. It is ery widely sed and will preent simple DOS copies. To be most effectie in BASIC, this techniqe shold be combined with stopping program breaks, system resets and other methods d"iscssed in Chapter 2. This method is especially good for programs which atomatically rn -18-

35 FIGRE 4.2 A DIRECTORY SECTOR LAYOT Director Entry o : F : CNT: SSN: FILE NAME : EXT : Starting sector nmber Two Bytes Points to first sector of a f i Ie Cont - Two bytes The nmber of sectors in the file Flag - One byte- $81 -File opened for otpt $82 -File created by DOS $88 -Entry neer sed $28 -File locv.ed $48 -File in se $88 -File deleted FIGRE 4.3 VTOC SECTOR LAYOT (Sector 369) $168 Hex BYTES Type Code (9=00S 2.9> Total nmber of sectors Nmber of nsed sectors Resered nsed Each bit in this area represents a spacific sector (8=sed,l=nsed) -19-

36 other programs, and programs where the ser may need to access specific listings or files. After it is sed, a normal directory listing will show 707 free sectors (or whateer yo want it to show), bt yor programs can still se the hidden directory as they please. Also, some files can be pt in the hidden directory and the real directory, letting the ser access certain files bt not others. The optional program disk has a program that will hide yor directory atomdtically for yo. If yo did not prchase this disk, bt wold like to, see the back of the book for ordering informa tion. The rotines to search for yor file in the directory are part of DOS and are loaded when yo trn on yor compter. A method I deeloped to hide yor directory inoles altering part of DOS to point to a new directory in a different location. A warning shold be gien at this point: BEFORE SING THIS (OR ANY OTHER PROTECTION METHOD), BE SRE YO HAVE MADE A BACK-P. The back-p seres two prposes. First, the nprotected back-p gies yo the means to change yor program in the ftre (to modify it or jst fix bgs, etc.). Secondly, the back-p is needed in case yo accidentally damage or destroy yor disk dring the protection process. Hiding the directory inoles fie steps. They are: 1. Back p yor completed disk. 2. Copy the directory to a new location. 3. Alter DOS to point to yor new directory. -20-

37 4. Write the altered DOS files to yor disk. 5. Destroy or change the old dir::!ctory, VTOC and DP.SYS file..~ Step 1: Back p yor completed disk. Before yo protect yor disk, yo shold hae it finished and complete becase once protected, it will be hard to modify. Also, be sre to keep an nprotected back-p for the reasons mentioned aboe. One reqirement of this techniqe is that yo hae the DOS files on the disk. If they are not there now, se DOS option H to write them. Step 2: Copy the directory to a new location. It was stated earlier that the directory ri des a t sec tors Normally, DOS looks to these sectors to access files. ['0 hide the directory, we will copy the directory to a new location ~ then later delete (or jst alter) the old directory to trick a normal DOS. In other words, yor program can se yor hidden directory as sal, een thogh the real directory shows the disk to be different or empty. ['0 moe the directory reqires a sector moer. Figre 4.4 contains a basic program that can moe a sector of da ta from one location on the disk to another. In this case, we will moe the eight sectors (which make p the directory) to a new location. "fo keep this protection method simp Ie, yo mst stay within certain restrictions. In this case, yo can moe yor directory to anywhere between sector 255 and 510 (the -21-

38 FIGRE 4_4 18 REM JOE ROTINE TO MOVE A SECTOR FR(Jot ll'ie LOCAT I ~ TO ANOTHER 28 REM JOE SET P C 10 CALL JOE 38 FOR 1=1536 TO 1548:READ X:POKE I,X: NEXT I 48 DATA 184,32,83,228,96 58 DIM A$( 128),B$( 1) 68 REM ~~ SET DRIVE ~~ 78 DRIVE=I:POKE 769,DRIVE 88 REM ~~ SET COMMANDS ~~ 98 RREAD=82:WWRITE=87:POKE 778,RREAD ~ 188 REM ~~ GET SECTOR NMBERS ~~ 118? " FR(Jot SECTORD;:INPT FRHSEC 126? :? " TO SECTOR";:INPT TOSEC 138 POKE 778,FRHSEC-(INT(FRHSEC/256)~2 ~ 56):POKE 779,INT(FRHSEC/256) 148 REM ~~ SET ADDRESS TO STORE READ ~ ~ 158 ADRA=ADR(A$) :POKE 772,ADRA-(INT(AD RA/256)~256):POKE 773,INT(ADRA/256) 168 REM 178 REM ~~ EXECTE CALL-CIO ROTINE ~~ 188? "HIT RETRN TO READ SECTOR.. ;FRM ~ SEC: INPT 8$ 198 Z=SR ( 1536) REM ~~ SET WRITE SECTOR ~~ 218 POKE 778,TOSEC-(INT(TOSEC/256)*256 ) :POKE 779,INT(TOSEC/256) 228? "HIT RETRN TO WRITE SECTOR It ;TO SEC: INPT 8$ 238 POKE 778,WWRITE ~ 248 Z=SR( 1536) -22- ~

39 reason for this will be explained lated. Where yo moe yor directory in this range is not important, bt it mst be to nsed sectors. Figre 4.5 contains a program that will tell yo if the sector is free. For the sake of simplicity, let's say yo decide to moe yor directory to sector 501 throgh 508. To do this, yo wold rn the sector moer (figre 4.4) and moe sector 361 to 501. Then, rn again and moe 362 to 502, etc. ntil yo reach 368 to 508. Yo are then ready for step 3. Step 3: Alter DOS to point to yor new directory. Changing DOS is ery easy if yo know what to do. In this case, we will change DOS to point to or new ditectory with jst one POKE. Since DOS is stored in memory, we can change it by changing these memory locations. To case DOS to look a t or hidden directory. we will POK E location 4226 with a new ale. It normally contains 105. and this tells DOS to look to sector 361 for the directory. To compte the new ale to POKE into this location, jst se t hi s form la : New POKE ale = (hidden directory sector nmber - 361) In or example we moed the directory to start in sector 501, so or new ale to POKE wold eqal 245 (= ( )). -23-

40 FIGRE REM ~~ ROTINE TO CHECK IF SECTOR IS SED ~~ 28 REM 38 REM ~ NOTE; TO CLEAR NSED SECTORS 48 REM ~ START WITH FORMATTED DISK 58 REM ~ AND COpy YOR FILES TO IT 68 FOR 1=1536 TO 1548:READ X:POKE I,X: NEXT I 78 DATA 184,32,83,228,96 88 DIM A$(128),9$(128) 98 REM ~~ CLEAR STRINGS ~~ 188 A$( 1, 1>=CHR$(8):A$( 128, 128)=A$:A$( 2,128)=A$ 118 8$(1,1)=- -:8$(128,128)=8$:8$(2,12 8)=9$ 128 DRIVE=I:POKE 769,DRIVE 138 RREAD=82:POKE 778,RREAD 148? :? - WHAT SECTOR-;:INPT SECN 158 POKE 778,SECN-(INT(SECNV256)~256) : POKE 779,INT(SECNV256) 168 ADRA=ADR(8$):POKE 772,ADRA-(INT(AO RA/256)~256):POKE 773,INT(ADRA/256) 178 Z=SR( 1536) 188 IF A$=BS THEN? - SECTOR IS FREED: GOTO ? -SECTOR IS FLL-:GOTO

41 So yo wold se this statement to change DOS to point to or hidden directory: POK E 4226, 245 fhe reason why we can only moe the directory to a certain range of ales, is becase of this POKE. rhe minimm ale yo can POKE is 0 and the maximm is 255, that is why or directory has to be hidden within these 256 sectors. Step 4: Write altered DOS files to disk. In order to ma ke the modification to DOS permanent, we mst rewrite the DOS files. To do this, jst type DOS and press retrn. if yor direct.ory was moed properly, the DOS men shold appear. if the men does not appear, go back to step 2 and try aga in. For those who made it to DOS, type H (write DOS files). fhis will write yor modified DOS to the disk, so yor programs can find the hidden directory. Step 5: Destroy or change old directory, roc and DP.SYS file. Now comes the time to brn or bridges behind s. First trn yor compter off and then back on iind thoroghly test yor programs. rhey now se the hidden directory. Next, we will delete or alter the old directory, roc find DP.SYS files. if yo are not familiar with the D P. SYS file, this file is c rea ted when yo write DOS files, and mst be deleted in order to protect yor programs. The D P.SYS is sed to load t he DOS me n. The -25-

42 DOS men cold point a pirate directly to yor hidden directory. 'fo delete it, load the DOS men from another disk, then retrn yor disk to the drie. se option D to delete the DP.SYS file.. Next, let's get rid of the old (real) dire:tory' so others won't be a ble to find yor programs. The easiest way to protect it is to delete it. Once again, se the sector moer (figre 4.4). This time, copy sector 720 (or a ny blank sector> to sectors This will delete the old directory. Adanced sers may wish to jst delete certain files and leae others intact so that yor sers cold list or copy them. To de this', yo wold need to nderstand and modify the old directory. Figre 4.2 shold be a big help in dcing thi.s. Keep in mind that the directory is not sed by yor programs, yor programs se only the hidden directory. The final step is to change yor roc. l'he V foc is sed when a DOS command J (dplica te disk) is issed. This command copies all sectors which the V'fOC shows to be fll. Fortnately, there is a ery simp Ie way to make the VTOC say 707 free sectors (a blank disk). Again, we need or sector moer (figre 4.4). fhe trick is to copy the V'fOC from a blank, formatted disk onto or disk's VTOC. The V'fOC is stored in sector 360, so jst insert a blank formatted disk in the drie and tell the sector moer to moe sector 360 to sector 360. fhen read sector 360 from yor blank disk, and switch disks to write it to yor- program disk. Now yor disk is comp lete. I recommend -26-

43 r-"\ that yo thoroghly test it again. Now boot p another disk in yor drie and go to r-"\ DOS. Then insert yor protected disk into the drie and type A (display disk r-"\ directory). Srprise! Yor disk says there are no files and 707 free sectors. bt it fi still rns yor programs perfectly. -27-

44 CHAP fer 5 BAD SECTOR ING WHAT IS A BAD SECTOR? A bad sector is a term often sed by software prodcers trying to protect their software and by pirates. A. bad sector is basically a sector on a disk which cannot be read accrately by the disk drie. This can be an nformatted sector, a sector that was written with a misaligned disk, a sector that was partially oerlaid (sally cased by incorrect disk speed) or a sector that was physically or magnetically damaged. 1 will go into these frther, bt first, let me deal with the most common misconception abot bad sectors and creating bad sectors. The most often asked qestion abot bad sectors is, "Can't yo jst store bad or random da ta in a sector to create a bad sector?" The answer is, "No", since the da ta on a disk is stored as binary 0' s and l's, any pattern of them i3 alid and can be read by a disk as long as they are properly placed. In other '.'ltords, it makes no difference to the disk drie what data is stored in a sector. If it c an be read accra tely, it is considered to be a good sector. Another common misconception deals with creating bad sectors. People nderstand that an nformatted sector is bad (this is correct), and say that they can jst format the sectors they want to be -28-

45 good, and leae the others nformatted (to be bad sectors). nfortnately, this cannot be done with the standard ATARI disk drie. The standard ATARI disk drie accepts only for commands. They are: READ SECTOR, WRITE SECTOR, CHECK SfATS and FORMA f DISK. Becase the drie has its own 6507 microprocessor, it controls the actal fnctions inoled with the for commands. The details of how to perform these fnctions is stored on a ROM chip in the disk drie. When a format disk command is sent to the drie, it takes oer arid formats the entire disk. Een trnin.~ off the compter will not affect the forma Hi ng. Abot the on ly way not to format the entire disk with an nmodified drie is to trn off the disk droie dring the formatting process. l'his is difficlt to control, bt is sometimes ~ffectie in creating bad sectors. 1I0W BAD SECrORS PROl'ECr SOFfWAI~E Most ATARI sers aloe aware that bad sectors are sed to preent the copying of disks, bt wonder how they achiee this. A little history of protection techniqes w.old help clear this p. For a long time, hidden directories and other disk protection methods explained earlier were the only methods aailable (and for that matter, needed) to preent disk piracy. As sector copiers began to be readily aailable, it became ob ios that some new method of copy protection was needed. It was known that the sector copier wold dplicate all -29-

46 readable data on a disk (at that time), so the problem became how to stop a copy from rnning. It was reasoned that the program had to hae some way of telling if it resided on the original disk or a copy. The original disk had to hae some characteristic that cold distingish it from a copy. Bad sectors fit the bi 11 perfectly. The original disk cold hae a bad sector that cold be checked by the program. In other words, the program wold be able to tell if it resided on the original disk by checking for the bad sector. The program wold rn as sal if the bad sector was fond, bt.if it didn't find the bad sector, it wold know that it was on a copy disk and take some appropriate action (e. g. lock p the compter, attempt to format the dis k, e.tc.). CREA fing BAD SECfORS For a medim to large scale software prodcer, the best way to create bad sectors is to prchase cstom hardware or special modifications for the 810 disk drie (See appendix "A" for a list of companies). For small scale software prodcers, there are seeral ways to create bad sectors withot special hardware. Also, one shold know of the techniqes presented below becase they are sometimes sed by software pirates to create bad sectors. Once a bad sector is created on the original disk. most disk dplicating companies can -30-

47 make batches of them easily (see appendix "A") which saes the small software company from haing to recreate the bad sectors on all their disks to be distribted. As mentioned earlier, there is no way to create bad sectors with the standard 810 disk drie from software alone, howeer, there are some special techniqes that can be sed. One ery good method is to se other small compters to write bad sectors and tracks. Some compters like the APPLE and I BM-PC allow yo to format single sectors and tracks. l'heir formats are not compatible with AfAR [' s, ths reslting in bad sectors. Howeer, this techniqe is not effectie if precise control of the bad sectqrs is needed, and yo mst hae access to and knowledge of the other compters to se this method. Another method is to physically damage the disk. I hae seen this techniqe sed sccessflly, bt it has major drawbacks. Basically, yo map ot the disk, and sing a pin or other sharp object, physically damage the sectors that shold be bad. Needless to say, hitting the right sector is ery difficlt. and permanent damage to the disk mst be done. A ery similar techniqe is to magnetically damage sectors on the disk sing a powerfl magnet or a picoelectric deice. This saes the disk from permanent damage. bt it is een harder to place the bad sectors precisely where yo want them. -31-

48 Another techniqe sometimes sed is to alter the read/write head alignment on yor disk drie. This techniqe works bt I strongly' warn against sing it becase readjsting yor alignment properly reqires an oscilloscope, and a disk with improper alignment is sally incompatible with a properly aligned disk drie. Finally, there are two techniqes which are effectie and relatiely easy to se to create bad sectors. The first techniqe inoles attaching a piece of tape to yor disk jacket so that when the disk is inserted in the drie, the tape sticks ot the door. Essentially, yo shake the tape (which is a ttached to yor disk coer) while a program is continally writing and reading the sector yo wish to destroy. This techniqe works bt can take as long as 10 mintes to write a single bad sector. The other techniqe inoles adjsting the speed of yor disk drie. This method is fast and ery precise. It enables yo to write as many bad sectors as yo wish withot doin ermanent damage to yor disk. Yor dne mst be slowed to approximately 220 RPMs (so yo can jst barely write a sector withot an error). Then, yo hae the disk write the sector yo wish to destroy. When yor drie is adjsted back to normal speed, those sectors will be read as bad sectors. The optional software disk (ordering -32-