Req : "Audio Sculpture" (STX,...) even not running...

All about the serious stuff.

Moderators: Mug UK, Zorro 2, Moderator Team

ijor
Hardware Guru
Hardware Guru
Posts: 4032
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by ijor »

DrCoolZic wrote:As described in my document I am also trying to differentiate “sector write splice” from “track write splice”. To be able to make the distinction between the two requires high-level analysis. The reason for detecting sector write splice is to be able to detect if a FD has been modified (tampered).
That would be nice, but I guess you know that is not conclusive. A track can be rewritten with tools that don't produce sector write splices, even a stock Amiga can do that. That would probably be rare, unless done intentionally, but possible. And some original disks have multiple (sector) write splices, or at least it was recorded in a way that it seems so. But again, it would still be a very useful feature nevertheless.
For the protections present on track three, I need to improve Aufit, because this track used a very smart mechanism that I have never seen before: Each sector contains two ID_field in front of the Data_field! We have exactly 30 bytes (post_id_gap=7 + id_field = 6 + post_id_gap=17) from the end of the first ID_field to the data_field. This is less than the maximum 43 bytes in DD allowed by the WD1772 to correctly read a sector. I have not yet tried to read this tracks under emulation with the WD1772, but in theory you should be able to read the same sector with two different id (sector 2 and sector 12, sector 3 and Sector 13, etc.).
No. You can read the sector with the first header, but not with the second. The second header is too close to the data mark. I am quite certain that this is present on other French releases.
As far as I understand this protection was produced ‘by hand’ (not on a duplicator) and probably on an Atari?
It was almost sure produced in house and not with an industrial duplicator. Don't know if on an Atari or not.
Fx Cast: Atari St cycle accurate fpga core
sarnau
Atari nerd
Atari nerd
Posts: 45
Joined: Tue Sep 07, 2010 4:22 am

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by sarnau »

FYI: For old protection on the Atari ST the disk was written by an industrial duplicator (for speed), but the actual protection was often written later with an Atari ST (because industrial duplicators often had problems copying it…).
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

ijor wrote:
For the protections present on track three, I need to improve Aufit, because this track used a very smart mechanism that I have never seen before: Each sector contains two ID_field in front of the Data_field! We have exactly 30 bytes (post_id_gap=7 + id_field = 6 + post_id_gap=17) from the end of the first ID_field to the data_field. This is less than the maximum 43 bytes in DD allowed by the WD1772 to correctly read a sector. I have not yet tried to read this tracks under emulation with the WD1772, but in theory you should be able to read the same sector with two different id (sector 2 and sector 12, sector 3 and Sector 13, etc.).
No. You can read the sector with the first header, but not with the second. The second header is too close to the data mark. I am quite certain that this is present on other French releases.
Yes you are right the minimum distance is 32 bytes (usually 24 x $4E + 8 x $00) but here we only have 13 bytes (2 x $4E + 11 x $00)
as-s2-12-graph.PNG
as-s2-12-data.PNG
Edit: Actually it is pretty smart if you ignore the "Embedded" id_field you have 23 various bytes + 11 $00 byte between end of first id_field and start of data_field that matches the normal gap 3 values

But using the read address command you should be able to read 18 sector address even if all sectors with address above 11 are not readable.
You do not have the required permissions to view the files attached to this post.
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

dlfrsilver wrote:
Brume wrote:dlfrsilver: is the only software that can't be dumped/duplicated with Kryoflux or is there other games/tools like this one?
It seems to be the first of its kind i know of. But, i know also that if the disk protection was exactly described in the IPF generator, a working original could possibly be made.
I'll get in touch with my colleagues about this protection.
I have been thinking about a CTA/IPF description for this program. I am not sure that track 3 can be described accurately. The track write splice can probably be recreated by using two moving gaps (forward, backward) that would 'meet' somewhere depending on the track length. Although the description might be possible it would certainly not ensure that creating a diskette from this master would work.

Obviously CTA does not seems to handle this protection at this time. Did you talked to Istvan about this protection?

For similar reasons I is not possible to replicate this floppy using SCP. It is strange that Jim did not provide feedback on his tests?
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

I will be adding a description of the Audio Sculpture protection in my next release of ‘Atari Copy Protection’ document as it introduce two new protection mechanisms that I had not seen before. These new protections are located on track 3 and I call them: “Write splice inside sector” and “ID within ID” (somewhat similar to Sector within Sector). Note that the name are not definitive and may change.

I have attached the description of the protections I am aware of for Audio Sculpture to this post. I have read the thread carefully and I believe that what I described is correct but feel free to comment if anything is wrong or incomplete.
Audio Sculpture.pdf
You do not have the required permissions to view the files attached to this post.
ijor
Hardware Guru
Hardware Guru
Posts: 4032
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by ijor »

DrCoolZic wrote:Yes you are right the minimum distance is 32 bytes (usually 24 x $4E + 8 x $00) but here we only have 13 bytes (2 x $4E + 11 x $00)
Te minimum gap II size at MFM is 28, not 32.
But using the read address command you should be able to read 18 sector address even if all sectors with address above 11 are not readable.
Yes, of course. Although it is problematic to read all the headers because the pairs are too close. The standard Pasti imaging tool will miss some headers.
“ID within ID” (somewhat similar to Sector within Sector).
I'm pretty sure this was used in a couple of other french games. Can't remember the titles, though, would need to check.
I have attached the description of the protections I am aware of for Audio Sculpture to this post.
...
The track 3 uses potentially many protection mechanisms. But I am not sure which one are actually used / checked
It was more than two years since I checked the protection and I'm afraid I don't remember the details. Give me a couple of days and I would try to answer that as good as possible.
Having the write splice inside sector 10 can potentially create fuzzy bits. This behavior breaks the rule above, and therefore the protection need some tolerance ...
That's correct. It is not only about weak bits per se. The splice area tends to be magnetically noisy and irregular. You might read different things in different drives, even when it always reads the same in a specific drive. That's why this protection in the PC was usually used for custom applications, where the publisher (or developer) typically had direct contact with the customer and could solve any potential issues with the disk.

As I believe I said in this thread, I thinks there seems to be some tolerance in the code that checks the protection. Don't remember the exact details and I didn't fully reverse engineer the code anyway.
Fx Cast: Atari St cycle accurate fpga core
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2709
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by spiny »

Hi thread,

While looking for something else, I've just found this:
asculpture.jpg
Is there anything I can do to help? I have a kryoflux.
You do not have the required permissions to view the files attached to this post.
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

Yes please can you create KF images of the disks. Having different images of the same program is always interesting but with this one it is even more important. Please do not forget to indicate the version of the program.
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

ijor wrote:
DrCoolZic wrote:Yes you are right the minimum distance is 32 bytes (usually 24 x $4E + 8 x $00) but here we only have 13 bytes (2 x $4E + 11 x $00)
Te minimum gap II size at MFM is 28, not 32.
Where did you get this number from?
If I am right the 32 bytes comes from the WD1772 datasheet. But to be honest the table that indicates the min values of the gaps is specially unclear.

Note also that there is a difference between the minimum values as specified in the DS and the actual minimum values acceptable by the FDC. For example the format with 11 sectors per track breaks several minimum values from the DS but obviously works.
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2709
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by spiny »

DrCoolZic wrote:Yes please can you create KF images of the disks. Having different images of the same program is always interesting but with this one it is even more important. Please do not forget to indicate the version of the program.

dissapointingly, the main disk appears to be dead, it's not working in any of my STs (Drive A: is not responding etc) and when I image it, the disk looks odd:
Screenshot 2020-01-26 20.36.13.png
The data disk appears OK though:
Screenshot 2020-01-26 20.31.08.png
disks attached, I did two scans of the program disk, just in case they read differently
audiosculpture.zip
You do not have the required permissions to view the files attached to this post.
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

What you show on kf imager looks good
Can you provide raw and ctr images please even if not running on atari
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

You provided .st file which are of no use :(
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

If you are not sure about how to do it read page 23 of Atari Copy Protection Based on Key Disk http://info-coach.fr/atari/documents/_m ... ection.pdf
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2709
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by spiny »

DrCoolZic wrote:What you show on kf imager looks good
Can you provide raw and ctr images please even if not running on atari
no problem :)

I think I've done this right (I only use my kryo to image normal disks :D )

CT Raw, I used the dropdown option on the UI
Full raw I used: dtc -p -fname -i0

let me know if there are extra command line stuff I should be using, and I'll do another image :)

files are 30 meg, so linked here: http://www.tortil.la/temp/asculpt_raw.zip
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2709
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by spiny »

DrCoolZic wrote:You provided .st file which are of no use :(
do you need a CT Raw of the data disk too ?
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

No it is not necessary. Cant check now will do it tomorow thanks
spiny
Disk Imager Supreme
Disk Imager Supreme
Posts: 2709
Joined: Mon Aug 11, 2003 11:53 pm
Location: just outside bristol
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by spiny »

DrCoolZic wrote:No it is not necessary. Cant check now will do it tomorow thanks

neat, happy to help :)
orionfuzion
Atari User
Atari User
Posts: 30
Joined: Fri Nov 11, 2016 1:57 pm
Location: Paris, France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by orionfuzion »

Jean,

I have Audio Sculpture v1.2 and v1.3 in STX format.
Protection is almost the same: the software part has only subtle differences and I guess the hardware part is the same.
I probably found the images on the net (I don't remember where) and I can provide them if you are interested.

Orion/Sebastien
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

Yes please
How do you know protections are similar?
I think I did an inteligent stx file comparator (used to check Aufit stx output)
orionfuzion
Atari User
Atari User
Posts: 30
Joined: Fri Nov 11, 2016 1:57 pm
Location: Paris, France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by orionfuzion »

DrCoolZic wrote:Yes please
How do you know protections are similar?
I think I did an inteligent stx file comparator (used to check Aufit stx output)
Zip files attached.

This protection has been used on all software released by Expose Software: Audio Sculpture (all versions), No Buddies Land and Son Shu Shi.
I traced the protection under Hatari and found that the software part is very close from one release to another (there are only small variations).

The protected tracks might be different from one release to another, but I'm pretty sure the technique is the same.
Note that it's only a guess based on the fact that the software part of the protection is almost the same in all releases.
I count on you to confirm that :)

When I did the reverse engineering of the protection, I focused on the software part (all the tricks used to make it difficult to crack) in order to document it, but I did not analyze the hardware part.
You do not have the required permissions to view the files attached to this post.
ijor
Hardware Guru
Hardware Guru
Posts: 4032
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by ijor »

DrCoolZic wrote:
ijor wrote:Te minimum gap II size at MFM is 28, not 32.
Where did you get this number from?
If I am right the 32 bytes comes from the WD1772 datasheet. But to be honest the table that indicates the min values of the gaps is specially unclear.
By reverse engineering the FDC, of course. The datasheet is wrong, ambiguous, and sometimes even contradictory in many things.
Fx Cast: Atari St cycle accurate fpga core
ijor
Hardware Guru
Hardware Guru
Posts: 4032
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by ijor »

orionfuzion wrote:This protection has been used on all software released by Expose Software: Audio Sculpture (all versions), No Buddies Land and Son Shu Shi. I traced the protection under Hatari and found that the software part is very close from one release to another (there are only small variations).
I don't remember seeing protected dumps of No Buddies Land or Son Shu Shi. Do you have the original disks or copy protected images? If so, could you please post them, thanks.
Fx Cast: Atari St cycle accurate fpga core
User avatar
DrCoolZic
Fuji Shaped Bastard
Fuji Shaped Bastard
Posts: 2261
Joined: Mon Oct 03, 2005 7:03 pm
Location: France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by DrCoolZic »

Spiny I have looked at the image you provided (1.2). It is similar but different from previously posted image (1.3).

Track 1, 2, 3 look the same with same protections.
But track 0 + tracks 4-58 are different:
- On version 1.3: we find a duplicated sector id (sect 66) with no data
as-1.3-t0.PNG
- On version 1.2: There is no duplicated sector id, but at the end of the track we have an unformatted area on all these tracks and as usual this area creates fuzzy bits. As this area is located outside normal sectors it does not change the values read with read sectors. However, a read-track would return fuzzy content at end of the track. But most probably this is not used for protection? Note it not possible to create such area on an Atari !?!
as-1.2-t0.PNG
Another difference is that on V1.3 all the tracks on side 1 are unformatted. On version 1.2 track 0-27 have a very strange bit-width repartition. This is probably not significant but strange.
as-1.3-t0.1-a.PNG
as-1.2-t0.1.PNG
You do not have the required permissions to view the files attached to this post.
Last edited by DrCoolZic on Mon Jan 27, 2020 3:21 pm, edited 1 time in total.
orionfuzion
Atari User
Atari User
Posts: 30
Joined: Fri Nov 11, 2016 1:57 pm
Location: Paris, France
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by orionfuzion »

ijor wrote:I don't remember seeing protected dumps of No Buddies Land or Son Shu Shi. Do you have the original disks or copy protected images? If so, could you please post them, thanks.
I don't have original disks/images of these 2 games.
However, 2/3 of the protection code is still present in the cracked versions, even if the protection is no longer executed.

The protection is composed of 3 distinct parts. 2 of them are stored on standard tracks, so they can be found in the cracked copies.
But the third part is located on the special track with 1024-bytes sectors, so this part is missing in cracked copies of course...

I was able to execute the protection code of Son Shu Shi by replacing missing parts (including the bootloader) with their equivalent ripped from the Audio Sculpture copy.
ijor
Hardware Guru
Hardware Guru
Posts: 4032
Joined: Sat May 29, 2004 7:52 pm
Contact:

Re: Req : "Audio Sculpture" (STX,...) even not running...

Post by ijor »

I made a quick check at what the programs reads from the disk. It performs something like that:

Code: Select all

Read sector(s). track: 0 (0), side: 0, sector: 1
Read sector(s). track: 0 (0), side: 0, sector: 2
Read sector(s). track: 1 (1), side: 0, sector: 1
Read sector(s). track: 1 (1), side: 0, sector: 3
Read sector(s). track: 1 (1), side: 0, sector: 5
Read sector(s). track: 1 (1), side: 0, sector: 7
Read sector(s). track: 1 (1), side: 0, sector: 8
Read sector(s). track: 1 (1), side: 0, sector: 9
Read track. track: 1, side: 0
Read sector(s). track: 4 (4), side: 0, sector: 1
...
Read track. track: 2, side: 0
Read sector(s). track: 2 (2), side: 0, sector: 1
Read sector(s). track: 2 (2), side: 0, sector: 2
Read sector(s). track: 2 (2), side: 0, sector: 3
Read sector(s). track: 2 (2), side: 0, sector: 4
Read sector(s). track: 2 (2), side: 0, sector: 5
Read sector(s). track: 2 (2), side: 0, sector: 6
Read track. track: 3, side: 0
Read sector(s). track: 3 (80), side: 0, sector: 10
...
Read sector(s). track: 29 (29), side: 0, sector: 1
Read track. track: 1, side: 0
I didn't analyze the software to see what it actually checks. But the core of the protection seems to be reading the big sectors on track 2, the special sector on track 3, and to perform a read track on tracks 1,2 & 3.
Fx Cast: Atari St cycle accurate fpga core
Post Reply

Return to “Applications”