Thanks a lot for testing this and confirming it works on real STE.
As the image I wrote from the RAW files didn't work on my STF, maybe the RAW file can't be written back in that specific protection case ? (IIRC some games were reported some times ago with this problem, but could be written with SCP). Or maybe I did sthg wrong when using my KF board
Regarding the protection, the loader will do 2 read tracks :
- on track 1, it looks for '7F' in the track header and expect to find it before the 1st 'A1'. The 20 bytes at the start of consecutive read tracks will be different, but they will sync after the 7F. The protection then read the 4 next bytes, ie 92 07 91 90.
Code: Select all
00000140 41f9 0006 0000 LEA.L $00060000,A0
00000146 0c18 007f CMP.B #$7f,(A0)+ [24]
0000014A 6718 BEQ.B #$18 == $00000164 (F)
0000014C 43f9 0000 007a LEA.L $0000007a,A1
00000152 21c9 0024 MOVE.L A1,$0024 [0000007a]
00000156 0c10 00a1 CMP.B #$a1,(A0) [24]
0000015A 6702 BEQ.B #$02 == $0000015e (F)
0000015C 60e8 BT .B #$e8 == $00000146 (T)
00000164 7e00 MOVE.L #$00,D7
00000166 1e18 MOVE.B (A0)+ [92],D7
00000168 e18f LSL.L #$08,D7
0000016A 1e18 MOVE.B (A0)+ [07],D7
0000016C e18f LSL.L #$08,D7
0000016E 1e18 MOVE.B (A0)+ [91],D7
00000170 e18f LSL.L #$08,D7
00000172 1e18 MOVE.B (A0)+ [90],D7
00000174 21c7 02da MOVE.L D7,$02da [04545225]
Track is read at $60000 :
Code: Select all
00060000: 00 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 .$$$$$$$$$$$$$$$
00060010: 24 30 f0 c2 7f 92 07 91 90 90 ff ff ff ff ff ff $0ðÂ............
00060020: ff ff c2 a1 a1 fe 01 00 01 02 bc db 4e 4e 4e 4e ..¡¡þ....¼ÛNNNN
- on track 2, it looks for F7, starting at $78000. Here also the 30 bytes at the start will change after each read track, but content will be stable after CD. So, we read 00, then DE AD FA CE.
Code: Select all
$00060d76 : 1018 move.b (a0)+,d0
$00060d78 : b03c 00a1 cmp.b #$a1,d0
$00060d7c : 671e beq.s $60d9c
$00060d7e : 0c00 00f7 cmpi.b #$f7,d0
$00060d82 : 66f2 bne.s $60d76
$00060d84 : 4a10 tst.b (a0)
$00060d86 : 66ee bne.s $60d76
$00060d88 : 5248 addq.w #1,a0
$00060d8a : 1c18 move.b (a0)+,d6
$00060d8c : e14e lsl.w #8,d6
$00060d8e : 1c18 move.b (a0)+,d6
$00060d90 : 4846 swap d6
$00060d92 : 1c18 move.b (a0)+,d6
$00060d94 : e14e lsl.w #8,d6
$00060d96 : 1c18 move.b (a0)+,d6
Track content at $78000
Code: Select all
00078000: ff fe 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e .þNNNNNNNNNNNNNN
00078010: 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 4e 14 0b cd b4 NNNNNNNNNNNN..Í´
00078020: f7 00 de ad fa ce 00 00 00 00 00 00 00 00 14 a1 ÷.ÞúÎ.........¡
In the case of Hatari, loader will crash just after this part. The crash is "normal" (a real ST would crash too), but maybe that's because the code is not the correct one due to some unexpected results from the 2 read track command, I need to look at this later.
Maybe the SCP file will give better results under Steem ? Just to be sure it's not a limitation to one image format.
Nicolas