Nightshade protection [technical]

[Rich Talbot-Watkins]

BeebEm 3 is great!

I'm getting to check out stuff I'd never seen before.

Just went to get the Nightshade tape image off the BBC Preservation site, as I thought I'd see if BeebEm loaded it ok. It doesn't...

...but I can hardly say I blame it. I thought Alien8 was evil, but the Nightshade protection is totally downright TWISTED! I have never seen anything quite like it in all my Beeb hacking years! It seems to do all the old Alien8 tricks, using all 4 timers this time, including checksumming the decrypted code, decrypting with itself and the partially-decrypted code, and liberally self-modifying itself. On top of this, it sometimes allows a custom-written IRQ routine to be triggered from the timers which, amongst other things, modifies a 256-byte long sequence of EOR instructions, which are then jumped into at random points (as specified by another timer) at various intervals... aaargh!

To crack that would not only require knowledge of the cycle-stretching for instructions which access the hardware, as per Alien 8, but also precise knowledge of the interrupt timings and latencies, in particular the thing where interrupts don't get serviced until the instruction after a CLI. And of course its non-linearity means that a routine like James Fidell's wouldn't be any good; you'd need to effectively emulate the whole process properly.

It also seems to depend on previously loaded data (it accesses data at &1300,X and &1900,X at one point, and I haven't really figured out where this comes from at the moment). The whole routine is huge and confusing, and it's really difficult to make any sense of it without a fair bit of concentration!

It's a work of warped genius. I would love to hear how Kevin devised and implemented these routines in the first place.

So, I guess this is the new holy grail: an emulator that can successfully load Nightshade. Surely if it can do that, there's very little left to get right...?

[garfield]

Sounds very interesting, Rich!

[billcarr2005]

A big hi to....BTW,DM,Andy,PP,Sparrow man,MG,CJ and all members of the VIA hate society

[Rich Talbot-Watkins]

Whereabouts is that? I can't find it!

[billcarr2005]

Don't know whether this works with WinZIP, but with WinRAR you can open the UEF file to get the HQ file inside. The message is towards the end, with an LDA #&43 : STA &FE68 : STA &FE69 close by it. It's in the last &300 bytes of the HQ file.

[The Owl]

I have just tried Nightshade with the new version of Beebem and it loads fine

[Fraser]

Were you using the tape version? Incidentally a couple of bugs seem to have came back to BeebEm. A cursor visible bug and Electron Moonraider not loading.

[The Owl]

No. I can't seem to find the tape version on here
Anyone care to donate it to me?

[Rich Talbot-Watkins]

The link to the tape version is in the first post in this thread. BeebEm still can't load it though

(Aside: does anyone know why the site is no longer formatting my whatever[/i]]text properly in that message?)

[Kevin Edwards]

Good to hear that Nightshade's protection is still keeping you guys busy. I would be very impressed if an emulator could cope with some of the dirty tricks I used in Nightshade.

The names that you discovered are references to a few friends and fellow beeb people...Boris The Wombat ( BTW ), Martin Galway ( MG ) and Paul Proctor ( PP ) who was coded most of the Ultimate games on the BBC.

You will also find some interesting code later on that would cause havok if you had been trying to hack the game.

Enjoy! And good luck.

[garfield]

Good to hear that Nightshade's protection is still keeping you guys busy. I would be very impressed if an emulator could cope with some of the dirty tricks I used in Nightshade.

You will also find some interesting code later on that would cause havok if you had been trying to hack the game.

Enjoy! And good luck.

Hello Kevin!

Maybe you could 'help in the effort' yourself? 'Twould help make the Beeb emulators more accurate if anything!

[Kevin Edwards]

It's about 20 years ago since i developed the various protection systems for the beeb so things are all very hazy...I do remember the last few were really evil ( Nightshade being one of them ).

However, due to the technique I used to create the encrypted code and data i didn't need to know about every 6522 or CPU cycle...In fact, I only needed basic knowledge about how the 6522 timers worked to take advantage of them to device the encoding systems....

OK..i'm throwing down the gauntlet here and would like to hear your ideas about how you think i did it? The biggest clue i can give you is that I did not use any kind of emulation or complex cycle timing calculations. Also, i did not use any additional hardware attachments or devices...but i must confess to having a slightly modified OS1.20 ROM.

Regards,
Kevin.


BTW I also had a brilliant disk protection system...however, the disc duplicating machines couldn't copy them en mass...they had to be done one at a time.

[billcarr2005]

A few years ago when I was looking at Winter Olympiad '88, I used modelB as a virtual machine to give me the encrypted code for the main loader. Once i had the encrypted and decrypted code side by side, I tried to see if there was a EORing formula I could apply to the data to get from A to B.
Looking back at some notes, I must've given up quite quickly, but I've found a pattern of the high bits and low bits being EORed by a specific pattern of numbers, in groups of 36 and 18.
However, this wouldn't require a modified OS1.20ROM! but in theory it would work? But only if you want to encrypt, since the key is needed.
I assume Superior Software just wanted one that would deter most people from copying the final file over?
Did you create Sabre Wulf & Atic Atac's protection too? So long as I can have a break inbetween, I'll have a stab, but timing loops I've not got the hang of!
"I only needed basic knowledge"! and it's still keeping code locked up today
ISTR Gary Partis's Impact had timing related shenanigans, but had space inbetween to stop it, and write your own code to retrieve what was needed.

PS. Thankyou for the bouts of pleasure and frustration!
PPS. Were you surprised to see Wizadore transferred to disc, after the message contained within, or would someone have found a loophole?

[Kevin Edwards]

My original plan was to have a special loader program that would read in an encrypted block of data which would then be de-crypted before being executed. The loader code was itself encrypted and was hidden until the decoder was run. Pretty simple, but not very effective.

This was simple to implement, however, it was very easy to modify the code and break into the hidden loading code once it was de-crypted. This could be achieved using breakpoints, single stepping using a monitor rom or by clever hardware hacking such as triggering NMIs via a switch. To circumvent this i devised a system that used self-modifying code to achieve the decoding process. This was complicated further by using the self-modifying decoder code as part 'key'. Because this code was position dependent, it would be almost impossible to emulate by re-locating. Of course, the icing on the cake was the idea of using the 1Mhz 6522 timers to provide part of the key - an idea i had whilst coding late one night. If the timing of the decoder was changed very slightly then the whole decoding process would break and the decoded data area would become wrecked.

Wizadore and the early implementations of the 6522 encryption system were cracked in lots of different ways...i'd be interested to know how everyone managed it ( excluding REPLAY as that's not really hacking the protection properly ).

For a bit of fun I did leave lots of humorous messages in the code to wind-up people..can't remember them all.

I didn't work on Atic Atac or Jet-Pac, but did protect all of the other Ultimate games....plus many others.

For me, the whole protection 'project' was a bit of fun - I was more interested in writing games. I'd cracked tons of Beeb games myself, so it was a challenge to write something that stood out and stopped simple tape to disc copying.

Kevin.

[BeebInC]

Originally back in the day, I had the idea of just rigging up some sort of hardware switch to swap in a changed OS (or just OS 0.1) just before hitting BREAK.

Seeing as though the gauntlet was thrown, I brought a copy of the Wizadore tape off ebay to have a stab at that protection...

Heres the bit after the timer decoding/checksumming done

E00 20 0C 0E .. JSR &0E0C .
E03 9D 0C 0E ... STA &0E0C,X .
E06 CA . DEX .
E07 D0 FA .. BNE &0E03 .
E09 4C 00 00 L.. JMP &0000 .

E0C A9 00 .. LDA #&00 (0) .
E0E A2 0F .. LDX #&0F (15) .
E10 9D A1 02 ... STA &02A1,X .paged ROM 0 type number
E13 CA . DEX .
E14 10 FA .. BPL &0E10 (>= signed) .
E16 E8 . INX .
E17 BD 39 0E .9. LDA &0E39,X .
E1A 95 00 .. STA &00,X .
E1C E8 . INX .
E1D E0 84 .. CPX #&84 (132=-124) .
E1F D0 F6 .. BNE &0E17 .
E21 A2 41 .A LDX #&41 (65) .
E23 BD BD 0E ... LDA &0EBD,X .
E26 9D 20 01 . . STA &0120,X .
E29 CA . DEX .
E2A 10 F7 .. BPL &0E23 (>= signed) .
E2C A9 CD .. LDA #&CD (205=-51) .
E2E 8D 04 02 ... STA &0204 .IRQ1V vector lo address
E31 A9 D9 .. LDA #&D9 (217=-39) .
E33 8D 05 02 ... STA &0205 .IRQ2V vector hi address
E36 85 FC .. STA &FC .interrupt Acc save register
E38 60 ` RTS .

E39 A9 03 .. LDA #&03 (3) .
E3B 85 F8 .. STA &F8 .
E3D 8D 08 FE ... STA &FE08 .6850 ACIA control register (write) status register (read)
E40 A9 05 .. LDA #&05 (5) .
E42 8D 10 FE ... STA &FE10 .serial ULA control register
E45 A2 FF .. LDX #&FF (255=-1) .
E47 CA . DEX .
E48 D0 FD .. BNE &0E47 .
E4A A9 85 .. LDA #&85 (133=-123) .
E4C 8D 10 FE ... STA &FE10 .serial ULA control register
E4F A9 D5 .. LDA #&D5 (213=-43) .
E51 8D 08 FE ... STA &FE08 .6850 ACIA control register (write) status register (read)
E54 AD 08 FE ... LDA &FE08 .6850 ACIA control register (write) status register (read)
E57 10 FB .. BPL &0E54 (>= signed) .
E59 A8 . TAY .
E5A 29 01 ). AND #&01 (1) .
E5C F0 F6 .. BEQ &0E54 .
E5E 98 . TYA .
E5F 29 70 )p AND #&70 (112) .
E61 F0 07 .. BEQ &0E6A .
E63 24 F8 $. BIT &F8 .
E65 10 ED .. BPL &0E54 (>= signed) .
E67 4C 20 01 L . JMP &0120 .

E6A AD 09 FE ... LDA &FE09 .6850 ACIA transmit/receive data register
E6D 49 B5 I. EOR #&B5 (181=-75) .
E6F 24 F8 $. BIT &F8 .
E71 30 08 0. BMI &0E7B (< signed) .(RTS)
E73 C9 CD .. CMP #&CD (205=-51) .
E75 D0 DD .. BNE &0E54 .
E77 85 F8 .. STA &F8 .
E79 F0 01 .. BEQ &0E7C .
E7B 60 ` RTS .

E7C A2 00 .. LDX #&00 (0) .
E7E 20 1B 00 .. JSR &001B .
E81 38 8 SEC .
E82 F5 7E .~ SBC &7E,X .
E84 55 78 Ux EOR &78,X .
E86 95 72 .r STA &72,X .
E88 E8 . INX .
E89 E0 06 .. CPX #&06 (6) .
E8B D0 F1 .. BNE &0E7E .
E8D A2 00 .. LDX #&00 (0) .
E8F 20 1B 00 .. JSR &001B .
E92 81 72 .r STA (&72,X) .
E94 E6 72 .r INC &72 .
E96 D0 02 .. BNE &0E9A .
E98 E6 73 .s INC &73 .
E9A A5 74 .t LDA &74 .
E9C D0 02 .. BNE &0EA0 .
E9E C6 75 .u DEC &75 .
EA0 C6 74 .t DEC &74 .
EA2 D0 EB .. BNE &0E8F .
EA4 A5 75 .u LDA &75 .
EA6 D0 E7 .. BNE &0E8F .
EA8 6C 76 00 lv. JMP (&0076) .


0EA0 ** ** ** ** ** ** ** ** ** ** ** 00 00 00 00 00 .....
0EB0 00 2D 9B 63 7A 46 67 6E F2 39 CD B3 ** ** ** ** .-.czFgn.9..

EBD A2 00 .. LDX #&00 (0) .
EBF 9D 00 04 ... STA &0400,X .
EC2 E8 . INX .
EC3 D0 FA .. BNE &0EBF .
EC5 EE 24 01 .$. INC &0124 .
EC8 10 F5 .. BPL &0EBF (>= signed) .
ECA 95 00 .. STA &00,X .
ECC E8 . INX .
ECD D0 FB .. BNE &0ECA .
ECF A9 3F .? LDA #&3F (63) .
ED1 8D 88 02 ... STA &0288 .OSBYTE &f8 value BREAK intercept code (address lsb)
ED4 A9 01 .. LDA #&01 (1) .
ED6 8D 89 02 ... STA &0289 .OSBYTE &f9 value BREAK intercept code (address msb)
ED9 6C FC FF l.. JMP (&FFFC) .6502 RESET entry lo

EDC 90 10 .. BCC &0EEE .(RTS)
EDE A2 00 .. LDX #&00 (0) .
EE0 8E 87 02 ... STX &0287 .OSBYTE &f7 value BREAK intercept code (opcode JMP usually)
EE3 BD 52 01 .R. LDA &0152,X .
EE6 F0 06 .. BEQ &0EEE .(RTS)
EE8 20 EE FF .. JSR &FFEE .OSWRCH output a character to the VDU stream
EEB E8 . INX .
EEC D0 F5 .. BNE &0EE3 .
EEE 60 ` RTS .

0EE0 ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** 07 .
0EF0 4C 6F 61 64 20 45 72 72 6F 72 0D 0A 0A 00 F9 23 Load Error.....#

[Kevin Edwards]

Hi,

Excellent..I haven't seen that stream loader code for a while. What technique did you use to decode the data and how successfuly was this with later protections such as Alien8 and especially Nightshade?

The hardware switch idea ( with modified OS ) is one that a lot of people I have spoken to have used - quite often as a last resort having been driven MAD attempting to emulate the timer code. I guess you used OS 0.1 as this doesn't do a memory clear on break if ?&258(?) is non-zero.

The hardware switch is something I partly addressed in later protection systems...typically by trashing the previous block of decoded code and by writing critical number into the stack area, ZP or other sneeky places such as hardware registers. These would then be used later on as decoder scramble values or execution addresses.

BTW I would like to congratulate the guys who have worked so hard on the emulators for the beeb and electron. They have done a fantastic job both technically and in keeping the retro computer scene alive. Respect also due to Dave M and the many other people who have dedicated tons of time maintaining the beeb sites.

Regards,
Kevin.

[BeebInC]

Actually I cheated slightly - my emulator is very cycle correct now

If you notice this version does have the trashing the previous block of decoded data code in. e03->e07. I would have had to have been very accurate with a BREAK key press to get that (+page not be set to e00).

I really should get around to cleaning it up and release the windows version.

If someone wants to send me the alien8 or nightshade loader I will see if it works.

Cheers

Dave

[Kevin Edwards]

Not really a cheat if you have emulated things correctly.

How do you cope with the more complex timer manipulation which perform read / write operations such as:-

DEC &FE68
ROR &FE69

Feel free to publish anything you have - it can only benefit the emulation community and retro game fans.

I haven't got the loader code for the games you mention. Perhaps someone else has these on the PC?

I do have all of the protection source master discs somewhere ( if they can still be read ). I could do with a PC with 5.25 drive / FDC that can read the 8271 single density format data. I could then transfer them to the PC and pass on some of the files to help the emulation guys.

Cheers,
Kevin.

[CMcDougall]

I do have all of the protection source master discs somewhere ( if they can still be read ). I could do with a PC with 5.25 drive / FDC that can read the 8271 single density format data. I could then transfer them to the PC and pass on some of the files to help the emulation guys.

Can do that 4 u if u wish , would point u to my hardware sections ! Drives!, but u have mensioned the 8271, so a no go (well i cant test 4u anyways). Best bet 4u is the xFer51 cable and proggy Kevin

[BeebInC]

I actually emulated all the read writes performed each opcode by the 6502, for example

&2000 LDA #&10

Read location &2000 (value &A9)
update clocks by 1, 2MHz tick
Read location &2001 (value &10)
update the clocks by 1, 2MHz tick and set the A reg/flags

obviously read/modify/write instructions are a bit more complicated, but you get the idea.

The main thing to remember is that the VIA's are 1MHz devices. So obviously the 2MHz 6502, has to synchronize itself to 1MHz to communicate, via cycle stretching.

E.g. a read/write operation in memory that takes 1 cycle in normal memory can take 2 or 3 cycles when talking to the VIA's.

Thus an instruction like INC absolute (INC &2000), takes 6 cycles in normal memory. But something like INC&FE68 (not really advisable) talking to the VIAs, will take at least 9 cycles (but can be 10).

[garfield]

Please continue everybody. This could end up being an interesting Wikipedia article at some point!

[John Kortink]

I hacked a few game protections in my time. Well, okay, a whole lot really. I can remember this radical protection method well.

I can't remember in which game I first encountered it, but it must have been the one that first prompted me to change my OS 1.20 ROM not to clear memory on BREAK anymore (and hide some more hacking code in the FRED and JIM pages, some of it allowing snippets of hacking code to run on interrupt, undisturbed by any attempts to disable it, except, of course, by SEI, which, in practice, hardly anybody ever used in protection code).

After getting suitably frustrated trying to follow this particular protection's endless VIA timer based insane control flow, I decided to abort that approach and just try to press BREAK at the exact right time, so the decoded data would be there to scoop up. It was only a matter of ten minutes or so before the protection code was down for the count.

I wouldn't usually do hacking this way, following and eliminating all the red herrings in protection code used to be part of the fun, but this one was just too much, too damned boring and frustrating (in that respect, it succeeded remarkably well, as protections go). In the end, it was sort of like that scene from an Indiana Jones movie, where this big guy with a turban makes a whole scene of swishing his sword about trying to impress Jones in a fight, and Jones, looking bored, sighs, takes out his gun, and simply shoots the guy.

[Kevin Edwards]

Thanks, I do have a serial transfer cable etc...not had chance to try it out yet. May take you up on the disc transfer offer...

But something like INC&FE68 (not really advisable) talking to the VIAs, will take at least 9 cycles (but can be 10).

INC &FE68 ( not advisable ) is an example of one of the read/modify/write instructions that were used in the Nightshade protection if I recall. In fact i think i even had something like DEC &FE69 ( 6522 high-order-counter!). These are likely to be causing emulation problems as the timings are very tricky to work out. Could one of the emulator authors tell us how they handle these cases?

Once these r/m/w instructions ( to 6522 timers ) have been addressed i can't see any reason why the emulators cannot load Nightshade tape images.

Kevin.

[John Kortink]

I do have all of the protection source master discs somewhere ( if they can still be read ). I could do with a PC with 5.25 drive / FDC that can read the 8271 single density format data. I could then transfer them to the PC and pass on some of the files to help the emulation guys.

You need a GoMMC, mate.

[sorvad]

Shameless advertising

[John Kortink]

Shameless advertising

Yeh ... Well, okay, he needs 65Link then (recently made PC compatible).

[Kevin Edwards]

LOL!

Hey, John, you don't miss a sales opportunity... 10 out of 10!

In fact, I may take you up on the offer and get a GoMMC to save a bit of time...do i qualify for a special price?

I guess it's easy to copy my DFS, ADFS floppies and ADFS HD images onto the memory card and load them up into BeebEm ( or similar)?

Kevin.

[John Kortink]

In fact, I may take you up on the offer and get a GoMMC to save a bit of time...do i qualify for a special price?

Um ...

I guess it's easy to copy my DFS, ADFS floppies and ADFS HD images onto the memory card and load them up into BeebEm ( or similar)?

Well, its dead easy to move whole discs from the original filing system (as long as it's a standard Acorn DFS or ADFS) to the MMC. Then take the disc images off again on a PC with a flash card reader. Or vice versa, put them on on a PC, then use them on a BBC.

[John Kortink]

But if you want to transfer just a few files, and don't mind fabricating a cable and blow an EPROM, 65Link will probably do nicely as well.

[alchresearch]

Shameless advertising

yeah, particular when he's poaching our members to the BBC Micro mailing list!