Req : "Audio Sculpture" (STX,...) even not running...

All about the serious stuff.

Moderators: Mug UK, Zorro 2, Moderator Team

ijor
Hardware Guru
Hardware Guru
Posts: 3919
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby ijor » Thu Jan 23, 2020 4:14 pm

DrCoolZic wrote:As described in my document I am also trying to differentiate “sector write splice” from “track write splice”. To be able to make the distinction between the two requires high-level analysis. The reason for detecting sector write splice is to be able to detect if a FD has been modified (tampered).


That would be nice, but I guess you know that is not conclusive. A track can be rewritten with tools that don't produce sector write splices, even a stock Amiga can do that. That would probably be rare, unless done intentionally, but possible. And some original disks have multiple (sector) write splices, or at least it was recorded in a way that it seems so. But again, it would still be a very useful feature nevertheless.

For the protections present on track three, I need to improve Aufit, because this track used a very smart mechanism that I have never seen before: Each sector contains two ID_field in front of the Data_field! We have exactly 30 bytes (post_id_gap=7 + id_field = 6 + post_id_gap=17) from the end of the first ID_field to the data_field. This is less than the maximum 43 bytes in DD allowed by the WD1772 to correctly read a sector. I have not yet tried to read this tracks under emulation with the WD1772, but in theory you should be able to read the same sector with two different id (sector 2 and sector 12, sector 3 and Sector 13, etc.).


No. You can read the sector with the first header, but not with the second. The second header is too close to the data mark. I am quite certain that this is present on other French releases.

As far as I understand this protection was produced ‘by hand’ (not on a duplicator) and probably on an Atari?


It was almost sure produced in house and not with an industrial duplicator. Don't know if on an Atari or not.
Fx Cast: Atari St cycle accurate fpga core

sarnau
Atari nerd
Atari nerd
Posts: 45
Joined: Tue Sep 07, 2010 4:22 am

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby sarnau » Thu Jan 23, 2020 4:20 pm

FYI: For old protection on the Atari ST the disk was written by an industrial duplicator (for speed), but the actual protection was often written later with an Atari ST (because industrial duplicators often had problems copying it…).

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Thu Jan 23, 2020 4:57 pm

ijor wrote:
For the protections present on track three, I need to improve Aufit, because this track used a very smart mechanism that I have never seen before: Each sector contains two ID_field in front of the Data_field! We have exactly 30 bytes (post_id_gap=7 + id_field = 6 + post_id_gap=17) from the end of the first ID_field to the data_field. This is less than the maximum 43 bytes in DD allowed by the WD1772 to correctly read a sector. I have not yet tried to read this tracks under emulation with the WD1772, but in theory you should be able to read the same sector with two different id (sector 2 and sector 12, sector 3 and Sector 13, etc.).


No. You can read the sector with the first header, but not with the second. The second header is too close to the data mark. I am quite certain that this is present on other French releases.

Yes you are right the minimum distance is 32 bytes (usually 24 x $4E + 8 x $00) but here we only have 13 bytes (2 x $4E + 11 x $00)
as-s2-12-graph.PNG


as-s2-12-data.PNG


Edit: Actually it is pretty smart if you ignore the "Embedded" id_field you have 23 various bytes + 11 $00 byte between end of first id_field and start of data_field that matches the normal gap 3 values

But using the read address command you should be able to read 18 sector address even if all sectors with address above 11 are not readable.
You do not have the required permissions to view the files attached to this post.

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sat Jan 25, 2020 3:28 pm

dlfrsilver wrote:
Brume wrote:dlfrsilver: is the only software that can't be dumped/duplicated with Kryoflux or is there other games/tools like this one?

It seems to be the first of its kind i know of. But, i know also that if the disk protection was exactly described in the IPF generator, a working original could possibly be made.
I'll get in touch with my colleagues about this protection.

I have been thinking about a CTA/IPF description for this program. I am not sure that track 3 can be described accurately. The track write splice can probably be recreated by using two moving gaps (forward, backward) that would 'meet' somewhere depending on the track length. Although the description might be possible it would certainly not ensure that creating a diskette from this master would work.

Obviously CTA does not seems to handle this protection at this time. Did you talked to Istvan about this protection?

For similar reasons I is not possible to replicate this floppy using SCP. It is strange that Jim did not provide feedback on his tests?

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sat Jan 25, 2020 3:37 pm

I will be adding a description of the Audio Sculpture protection in my next release of ‘Atari Copy Protection’ document as it introduce two new protection mechanisms that I had not seen before. These new protections are located on track 3 and I call them: “Write splice inside sector” and “ID within ID” (somewhat similar to Sector within Sector). Note that the name are not definitive and may change.

I have attached the description of the protections I am aware of for Audio Sculpture to this post. I have read the thread carefully and I believe that what I described is correct but feel free to comment if anything is wrong or incomplete.
Audio Sculpture.pdf
You do not have the required permissions to view the files attached to this post.

ijor
Hardware Guru
Hardware Guru
Posts: 3919
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby ijor » Sat Jan 25, 2020 11:36 pm

DrCoolZic wrote:Yes you are right the minimum distance is 32 bytes (usually 24 x $4E + 8 x $00) but here we only have 13 bytes (2 x $4E + 11 x $00)


Te minimum gap II size at MFM is 28, not 32.

But using the read address command you should be able to read 18 sector address even if all sectors with address above 11 are not readable.


Yes, of course. Although it is problematic to read all the headers because the pairs are too close. The standard Pasti imaging tool will miss some headers.

“ID within ID” (somewhat similar to Sector within Sector).


I'm pretty sure this was used in a couple of other french games. Can't remember the titles, though, would need to check.

I have attached the description of the protections I am aware of for Audio Sculpture to this post.
...
The track 3 uses potentially many protection mechanisms. But I am not sure which one are actually used / checked


It was more than two years since I checked the protection and I'm afraid I don't remember the details. Give me a couple of days and I would try to answer that as good as possible.

Having the write splice inside sector 10 can potentially create fuzzy bits. This behavior breaks the rule above, and therefore the protection need some tolerance ...


That's correct. It is not only about weak bits per se. The splice area tends to be magnetically noisy and irregular. You might read different things in different drives, even when it always reads the same in a specific drive. That's why this protection in the PC was usually used for custom applications, where the publisher (or developer) typically had direct contact with the customer and could solve any potential issues with the disk.

As I believe I said in this thread, I thinks there seems to be some tolerance in the code that checks the protection. Don't remember the exact details and I didn't fully reverse engineer the code anyway.
Fx Cast: Atari St cycle accurate fpga core

User avatar
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2679
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby spiny » Sun Jan 26, 2020 2:50 pm

Hi thread,

While looking for something else, I've just found this:

asculpture.jpg


Is there anything I can do to help? I have a kryoflux.
You do not have the required permissions to view the files attached to this post.

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sun Jan 26, 2020 8:02 pm

Yes please can you create KF images of the disks. Having different images of the same program is always interesting but with this one it is even more important. Please do not forget to indicate the version of the program.

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sun Jan 26, 2020 8:06 pm

ijor wrote:
DrCoolZic wrote:Yes you are right the minimum distance is 32 bytes (usually 24 x $4E + 8 x $00) but here we only have 13 bytes (2 x $4E + 11 x $00)

Te minimum gap II size at MFM is 28, not 32.

Where did you get this number from?
If I am right the 32 bytes comes from the WD1772 datasheet. But to be honest the table that indicates the min values of the gaps is specially unclear.

Note also that there is a difference between the minimum values as specified in the DS and the actual minimum values acceptable by the FDC. For example the format with 11 sectors per track breaks several minimum values from the DS but obviously works.

User avatar
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2679
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby spiny » Sun Jan 26, 2020 8:45 pm

DrCoolZic wrote:Yes please can you create KF images of the disks. Having different images of the same program is always interesting but with this one it is even more important. Please do not forget to indicate the version of the program.



dissapointingly, the main disk appears to be dead, it's not working in any of my STs (Drive A: is not responding etc) and when I image it, the disk looks odd:

Screenshot 2020-01-26 20.36.13.png


The data disk appears OK though:
Screenshot 2020-01-26 20.31.08.png


disks attached, I did two scans of the program disk, just in case they read differently
audiosculpture.zip
You do not have the required permissions to view the files attached to this post.

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sun Jan 26, 2020 8:54 pm

What you show on kf imager looks good
Can you provide raw and ctr images please even if not running on atari

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sun Jan 26, 2020 8:56 pm

You provided .st file which are of no use :(

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sun Jan 26, 2020 9:05 pm

If you are not sure about how to do it read page 23 of Atari Copy Protection Based on Key Disk http://info-coach.fr/atari/documents/_m ... ection.pdf

User avatar
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2679
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby spiny » Sun Jan 26, 2020 9:11 pm

DrCoolZic wrote:What you show on kf imager looks good
Can you provide raw and ctr images please even if not running on atari


no problem :)

I think I've done this right (I only use my kryo to image normal disks :D )

CT Raw, I used the dropdown option on the UI
Full raw I used: dtc -p -fname -i0

let me know if there are extra command line stuff I should be using, and I'll do another image :)

files are 30 meg, so linked here: http://www.tortil.la/temp/asculpt_raw.zip

User avatar
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2679
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby spiny » Sun Jan 26, 2020 9:13 pm

DrCoolZic wrote:You provided .st file which are of no use :(


do you need a CT Raw of the data disk too ?

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sun Jan 26, 2020 9:18 pm

No it is not necessary. Cant check now will do it tomorow thanks

User avatar
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2679
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby spiny » Sun Jan 26, 2020 9:22 pm

DrCoolZic wrote:No it is not necessary. Cant check now will do it tomorow thanks



neat, happy to help :)

orionfuzion
Atariator
Atariator
Posts: 27
Joined: Fri Nov 11, 2016 1:57 pm
Location: Paris, France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby orionfuzion » Sun Jan 26, 2020 9:44 pm

Jean,

I have Audio Sculpture v1.2 and v1.3 in STX format.
Protection is almost the same: the software part has only subtle differences and I guess the hardware part is the same.
I probably found the images on the net (I don't remember where) and I can provide them if you are interested.

Orion/Sebastien

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Sun Jan 26, 2020 10:39 pm

Yes please
How do you know protections are similar?
I think I did an inteligent stx file comparator (used to check Aufit stx output)

orionfuzion
Atariator
Atariator
Posts: 27
Joined: Fri Nov 11, 2016 1:57 pm
Location: Paris, France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby orionfuzion » Sun Jan 26, 2020 11:34 pm

DrCoolZic wrote:Yes please
How do you know protections are similar?
I think I did an inteligent stx file comparator (used to check Aufit stx output)


Zip files attached.

This protection has been used on all software released by Expose Software: Audio Sculpture (all versions), No Buddies Land and Son Shu Shi.
I traced the protection under Hatari and found that the software part is very close from one release to another (there are only small variations).

The protected tracks might be different from one release to another, but I'm pretty sure the technique is the same.
Note that it's only a guess based on the fact that the software part of the protection is almost the same in all releases.
I count on you to confirm that :)

When I did the reverse engineering of the protection, I focused on the software part (all the tricks used to make it difficult to crack) in order to document it, but I did not analyze the hardware part.
You do not have the required permissions to view the files attached to this post.

ijor
Hardware Guru
Hardware Guru
Posts: 3919
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby ijor » Mon Jan 27, 2020 1:17 am

DrCoolZic wrote:
ijor wrote:Te minimum gap II size at MFM is 28, not 32.
Where did you get this number from?
If I am right the 32 bytes comes from the WD1772 datasheet. But to be honest the table that indicates the min values of the gaps is specially unclear.


By reverse engineering the FDC, of course. The datasheet is wrong, ambiguous, and sometimes even contradictory in many things.
Fx Cast: Atari St cycle accurate fpga core

ijor
Hardware Guru
Hardware Guru
Posts: 3919
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby ijor » Mon Jan 27, 2020 1:51 am

orionfuzion wrote:This protection has been used on all software released by Expose Software: Audio Sculpture (all versions), No Buddies Land and Son Shu Shi. I traced the protection under Hatari and found that the software part is very close from one release to another (there are only small variations).


I don't remember seeing protected dumps of No Buddies Land or Son Shu Shi. Do you have the original disks or copy protected images? If so, could you please post them, thanks.
Fx Cast: Atari St cycle accurate fpga core

User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2258
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby DrCoolZic » Mon Jan 27, 2020 9:01 am

Spiny I have looked at the image you provided (1.2). It is similar but different from previously posted image (1.3).

Track 1, 2, 3 look the same with same protections.
But track 0 + tracks 4-58 are different:
- On version 1.3: we find a duplicated sector id (sect 66) with no data
as-1.3-t0.PNG

- On version 1.2: There is no duplicated sector id, but at the end of the track we have an unformatted area on all these tracks and as usual this area creates fuzzy bits. As this area is located outside normal sectors it does not change the values read with read sectors. However, a read-track would return fuzzy content at end of the track. But most probably this is not used for protection? Note it not possible to create such area on an Atari !?!
as-1.2-t0.PNG

Another difference is that on V1.3 all the tracks on side 1 are unformatted. On version 1.2 track 0-27 have a very strange bit-width repartition. This is probably not significant but strange.

as-1.3-t0.1-a.PNG

as-1.2-t0.1.PNG
You do not have the required permissions to view the files attached to this post.
Last edited by DrCoolZic on Mon Jan 27, 2020 3:21 pm, edited 1 time in total.

orionfuzion
Atariator
Atariator
Posts: 27
Joined: Fri Nov 11, 2016 1:57 pm
Location: Paris, France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby orionfuzion » Mon Jan 27, 2020 11:08 am

ijor wrote:I don't remember seeing protected dumps of No Buddies Land or Son Shu Shi. Do you have the original disks or copy protected images? If so, could you please post them, thanks.


I don't have original disks/images of these 2 games.
However, 2/3 of the protection code is still present in the cracked versions, even if the protection is no longer executed.

The protection is composed of 3 distinct parts. 2 of them are stored on standard tracks, so they can be found in the cracked copies.
But the third part is located on the special track with 1024-bytes sectors, so this part is missing in cracked copies of course...

I was able to execute the protection code of Son Shu Shi by replacing missing parts (including the bootloader) with their equivalent ripped from the Audio Sculpture copy.

ijor
Hardware Guru
Hardware Guru
Posts: 3919
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Postby ijor » Mon Jan 27, 2020 5:14 pm

I made a quick check at what the programs reads from the disk. It performs something like that:

Code: Select all

Read sector(s). track: 0 (0), side: 0, sector: 1
Read sector(s). track: 0 (0), side: 0, sector: 2
Read sector(s). track: 1 (1), side: 0, sector: 1
Read sector(s). track: 1 (1), side: 0, sector: 3
Read sector(s). track: 1 (1), side: 0, sector: 5
Read sector(s). track: 1 (1), side: 0, sector: 7
Read sector(s). track: 1 (1), side: 0, sector: 8
Read sector(s). track: 1 (1), side: 0, sector: 9
Read track. track: 1, side: 0
Read sector(s). track: 4 (4), side: 0, sector: 1
...
Read track. track: 2, side: 0
Read sector(s). track: 2 (2), side: 0, sector: 1
Read sector(s). track: 2 (2), side: 0, sector: 2
Read sector(s). track: 2 (2), side: 0, sector: 3
Read sector(s). track: 2 (2), side: 0, sector: 4
Read sector(s). track: 2 (2), side: 0, sector: 5
Read sector(s). track: 2 (2), side: 0, sector: 6
Read track. track: 3, side: 0
Read sector(s). track: 3 (80), side: 0, sector: 10
...
Read sector(s). track: 29 (29), side: 0, sector: 1
Read track. track: 1, side: 0


I didn't analyze the software to see what it actually checks. But the core of the protection seems to be reading the big sectors on track 2, the special sector on track 3, and to perform a read track on tracks 1,2 & 3.
Fx Cast: Atari St cycle accurate fpga core


Social Media

     

Return to “Applications”

Who is online

Users browsing this forum: No registered users and 7 guests