TRS-80 Disk Copy Protection: How It Worked

From 1979 onward, software publishers for the TRS-80 Model I, Model III and Model 4 looked for ways to stop customers from handing out copies of their disks. Some of the schemes were a few lines of code; others were whole custom disk formats that no DOS could read. Copy utilities grew up alongside them, and several of the best-known copiers were themselves copy protected.

This page describes every copy-protection scheme found in a disk-by-disk analysis of the DMK and DSK disk images in the trs-80.com archive: nearly 8,900 images, examined at the level of individual sector IDs, data marks, CRCs and boot code. For each scheme it explains what is on the disk, how the program checks for it, and why a normal DOS BACKUP or a sector copier could not reproduce it. Where the checking code was traced, it is shown.

Software is named by its title and publisher. Thirty-five product schemes were identified, plus three protections that belong to a DOS rather than to a program: VTOS 3.0's hidden mini-sectors, TRSDOS 1.3's limited-backup counter, and the Tandy protection track read by the DOS itself.

A note on wording: "traced" means the code that performs the check was found and read; "layout identified" means the special format is certain but the code that tests it was not followed to the end.

Every protection scheme on this page works by putting something on the disk that the TRS-80's own disk software would never write. To see why that stops a copier, it helps to know how a track is laid out.

Tracks, sectors and fields

• Tracks (cylinders): a 5¼" disk has 35, 40 or 80 concentric tracks per side, numbered from 0 at the outside edge. TRS-80 DOSes normally use 35 or 40.
• Sectors: each track is divided into sectors. Every sector has two parts recorded on the disk:
  • an ID field: an address mark (FE), then four bytes — cylinder, side, sector number and a size code (0 = 128, 1 = 256, 2 = 512, 3 = 1024 bytes) — and a two-byte CRC;
  • a data field: a data address mark, the sector's data, and another CRC.
• Nothing requires the ID to be truthful. The cylinder, side and sector bytes in an ID are just bytes. A track can carry sector numbers 54 to 63 instead of 0 to 9, claim to be cylinder 127, repeat a sector number, or hold a sector whose CRC is deliberately wrong. The controller simply searches the track for an ID that matches what it was asked for.
• Data address marks: FB is the normal mark. F8 marks a "deleted" sector (TRSDOS uses it on directory sectors). The Model I's controller can also write and tell apart FA and F9, which the later controllers cannot.

Densities and controllers

• Single density (FM): the stock Model I uses a Western Digital WD1771 controller, which records FM only, 10 sectors of 256 bytes per track under TRSDOS 2.3.
• Double density (MFM): the Model III and Model 4 use the WD1793 family, which records both FM and MFM (typically 18 sectors of 256 bytes per track). A Model I can do MFM with a "doubler" board.
• What only the 1771 can do: the WD1771 has a "non-IBM" mode in which the size byte of an ID is read as a multiple of 16 bytes, so a size byte of 10h means a 256-byte sector and 15h means 336 bytes. It can also write four kinds of data mark (FB, FA, F9, F8). No 179x controller can read or write either. Several Model I protections depend on exactly these features, so they cannot even be read on a Model III or with a doubler.

What the controller can be told to do

• Read Sector / Write Sector: find the ID with a given sector number (the controller also checks the cylinder byte against its track register) and transfer the data. This is all a DOS uses, and all BACKUP uses.
• Read Address: return the next ID field that passes under the head, whatever it says.
• Read Track: return the raw bytes of a whole track, gaps and marks included.
• Write Track (format): write a whole track from a buffer. Certain byte values become address marks and CRCs; every other byte, including the ID bytes, is written as given. Write Track is the root of nearly all format-level protection: a publisher's duplicator could put any sector numbers, sizes, marks and CRC errors on a track, and a DOS FORMAT never would.

How a disk boots

• The Model I ROM reads sector 0 of cylinder 0, in single density, into memory at 4200h and jumps to it.
• The Model III ROM reads sector 1 of cylinder 0, in double density, into memory at 4300h and jumps to it.
• A disk whose boot sector loads a program directly, with no DOS, is self-booting. A disk with a working boot sector for each model is dual boot. Most game protections live in a self-booting loader, because a loader that never calls the DOS can read sectors the DOS could not.

Why copies failed

A DOS BACKUP formats a fresh disk with the DOS's own standard layout, then copies each sector by number. A sector copier is smarter, but it still only sees what Read Sector returns: it cannot read a sector that has no data field, cannot see the bytes of a deliberately bad CRC, does not know a sector's ID claims another cylinder, and on a Model III or a doubler cannot touch 1771-only sectors. Whatever the copier cannot see, the copy does not have, and the protected program's check notices.

As Kim Watt wrote in the manual for Super Utility, one of the most capable copiers of the period, with the TRS-80's controller "no program can automatically copy every protected disk."

Every disk image in the archive was examined and its name given these tags, from what the disk itself proves rather than what an old label said:

Tag	Meaning
[Dual Boot]	The disk boots and runs on both a Model I and a Model III. Such disks are listed as Model 13.
[Self Booting]	The boot sector loads a custom loader of the publisher's own, not a DOS. (In the download descriptions this appears as [Self Boot].)
[File Transfer System]	The disk exists to copy its programs onto the buyer's own DOS disk (Breeze/QSD SuperMOVE, Kim Watt's SuperBOOT and File Transfer Utility, SofTrends, Meta Tech and others).
[Special Format]	No DOS can boot the disk, read its directory or reach its contents: there is no directory, the directory is a decoy, or the tracks are in a layout no DOS uses.
[DOS Copy Protected]	The protection belongs to the DOS on the disk, not to the program (see DOS-Level Protection).
[Copy Protected]	The disk carries the product's own protection, and that protection is actually present in this copy.
[JV1] / [JV3]	The image file is in the JV1 or JV3 format rather than DMK. These formats cannot hold most protection, so a protected disk in JV form is often not a working copy.

Two rules shape the tags. A protection tag is given only when the layout or the check is really in that disk's bytes: a cracked or incompletely read copy of a protected title gets no protection tag. And a disk whose errors turn out to be damage (a sector the program never reads, a CRC of FFFF on a loader track, errors that are good sectors on another copy of the same disk) is recorded as damaged, not protected.

Protection on TRS-80 disks lives at four levels. Most schemes combine a special format (level A) with a loader that checks for it (level D).

A. Format level: a track no DOS formatter makes

Made with Write Track, which lets the duplicator put any byte where a sector number, size code or CRC would be. The methods found in the archive:

Method	What is on the disk	Examples
Out-of-range or renumbered sectors	Sector numbers a DOS never uses (54–63, 100–109, 129–146, multiples of 16, 255) so a DOS read of sectors 0–9 finds nothing	Blackjack Master, Frogger (Cogito), MyChess, Tandy's track 40, RSM3-I
Deliberate CRC errors	A sector whose data CRC or ID CRC is written wrong on purpose (often 00 00 or FF FF over clean filler); the program expects the read to fail, and some loaders require the exact status: 18h (Record Not Found with CRC error) for a bad ID, 08h for a bad data CRC	Adventure International's Scott Adams adventures, Super Utility and PowerTool (Kim Watt), VTOS 3.0, Test Bank System, TRSDOS Training Course, PowerDOT
IDs without data	An ID field with no data field behind it	Knossos (Med Systems)
Fake cylinder numbers	IDs that name a different cylinder from the one they are on, so a normal seek-and-read fails; the loader reads them by first writing the fake value into the controller's track register	Olympic Decathlon and Colossal Cave Adventure (Microsoft), Frogger (Cogito), RSM3-I, CopyCat 4, Super Utility+ and PowerTool, The Bottom Shelf's CRAS security disk
1771 non-IBM sectors	Sectors whose length is 16 × the size byte, readable only by a Model I's WD1771 in non-IBM mode	Arranger v1.1 (Dan Foy), Basketball and other Acorn titles, VTOS 3.0
Data-mark tricks	F9, FA or F8 marks where a DOS writes FB; some checked by the loader through the controller's status	Deadline and the other Infocom Model I disks, Blackjack Master, Monty Plays Scrabble v1.1
Mixed densities on one track	FM and MFM sectors interleaved on the same track, which no DOS can format	Super Utility and PowerTool (Kim Watt), HyperZap, Clone-III
Odd sector sizes and short sectors	128-, 512- or 1024-byte sectors where the DOS uses 256, sometimes repeated with different sizes	Master Reversi, CopyCat, CopyCat 4, Big Five's games
Extra tracks	A track past the last one the DOS formats (track 40 on a 40-track DOS)	Tandy's track 40, Snapp's Extended BASIC
Raw "nibble" tracks	Program data written as raw track bytes with no sectors at all, read back with Read Track after a sync string	FunSoft's games by Yves Lempereur
Scrambled tracks	Each track with its own random sector order, most tracks left unformatted	Computex Comprehensive Test
Duplicate sectors, both required	Two sectors with the same ID on one track and different contents; the loader reads the number twice and needs to get both	CopyCat v1.0 and v2.05 (sector 69 on cylinder 15)
Hidden sectors inside other sectors	Twice the normal number of IDs on a track, the extra ones placed inside the data fields of the real sectors, so each real sector reads straight through them; the program reads the hidden ones by number	Vivace! Compiler (Wittsoft)

B. Controller level: timing and alignment

Programs that use Read Track or Read Address and expect exact positions or lengths, so even a sector-perfect copy fails if the track is laid out differently. Big Five's games measure a track's length with Read Track; Computex checks with Read Address; Master Reversi returns into code its duplicator wrote in the gap of cylinder 0, which only a Read Track brings into memory; Super Utility+ v3.x and PowerTool use Read Address to find out which cylinder the head is on, take their step count from the bytes of an ID, and check after each move that the IDs under the head are in the expected range. Fantastic Software, Med Systems, Melbourne House, Beam Software and other publishers of the per-track-numbering family (S-008) read track 3 with Read Track and look for a signature written into the gap after the last sector. A DMK image keeps every byte position, but an emulator may not reproduce the timing exactly.

C. File-system level: no special format at all

Protection that lives in the directory or the files, invisible to a physical scan of the tracks: files deliberately shorter than their directory entries (Big Five's Stellar Escort and Weerd), a relocated directory with a decoy DIR/SYS (a Super Utility+ copy utility), TRSDOS 1.3's limited-backup counter (TRSDOS 1.1 keeps one at another place in the boot sector, and Tandy's Protection Utility on track 40 is the tool that sets such a counter on a master), and a one-time backup that the program erases from the master once it has been used (Cogito's Frogger).

D. Loader level: the code that enforces the rest

A self-booting loader, or the program itself, reads the special sector and refuses to run unless the read behaves exactly as on the original: fails with a CRC error, returns a particular status, finds a sector number, or finds a track of the right length. Finding this check in the code is the strongest proof that an odd format is protection and not just a custom layout.

The checks traced so far use these techniques:

• A required status: the read must end with one exact status, not merely fail: 18h for a bad ID and 08h for a bad data CRC (Super Utility, Super Utility+, PowerTool), 60h for an F8 mark (Blackjack Master, FunSoft), an F9 record type (Infocom).
• The sector contents checked as well: all 128 bytes of each special sector must be 45h (The Bottom Shelf's CRAS); a 9-byte signature must open the bad-CRC sector (Super Utility+ v3.x, PowerTool).
• Read Address to place the head: the ID under the head decides where the loader seeks next and how many steps it takes per cylinder (Super Utility+ v3.x, PowerTool).
• Nibble-encoded, reversed sectors: each memory byte is built from the low halves of two disk bytes and each page is stored backwards, so a sector dump shows no readable code (Super Utility+ v3.x, PowerTool).
• A key in a bad-CRC sector, rechecked by interrupt: the key is kept in the Z80's I register and the timer-interrupt handler recomputes it every 256 ticks; on a mismatch it fills memory with RST 0 and reboots (PowerTool).
• A one-time backup: the program copies itself once and then overwrites its own backup routine on the master with C9h (Cogito's Frogger).
• The vendor's own copier: the disk carries a macro that reproduces its mixed-density tracks; the format is the protection and the program is the only tool meant to copy it (HyperZap).
• Code inside the protected sector: the program runs the data it has just read from the special sector, so a copy without the sector has nothing to run (Asylum's sector 122; the code after the gap marker on track 3 of the per-track-numbering family).
• A deliberate error that is not enforced: Asylum expects its sector 122 to read with an F8 mark and a CRC error, but only counts the mismatch, so a copy with a good CRC still runs. A traced check proves intent; it does not prove that every deviation fails.
• Reading with foreign register values: both the track and the sector register are set to the same out-of-range number before every read (69 on CopyCat, 153 on CopyCat 4), so only IDs carrying that number on both counts are found.
• A sector read over the stack: the boot reads a sector into the memory that holds its own stack, and the return addresses in that sector send it on (Master Reversi).
• Read twice and compare: every sector is read twice and the two reads must match (MyChess).
• A status test that leaves a mark out: the loader's status mask skips the FA record-type bit, so only the sector numbering matters (Monty Plays Scrabble v1.1). Reading the mask shows which deviations a loader really checks.
• A trap for BACKUP only: a missing or odd sector the program itself never reads, there to stop the DOS's BACKUP (Talking Adventure I; the TRSDOS Training Course, whose bad sector also carries a serial number).
• Files decrypted with hidden sectors: every sector read from the special cylinders is XORed with a hidden sector found through a chain of hidden-sector reads; a copy without them cannot even load its overlays (Vivace! Compiler).
• Computed sector numbers: the loader derives both the sector number and the track-register value with a little arithmetic, so the numbers appear nowhere in the code (RSM3-I).
• A patched boot sector: the first records loaded overwrite the DOS boot sector's own "next sector" code with a disguised routine that knows the renumbered tracks (SFinks).
• A check poked in by BASIC: the BASIC programs load a short machine-code routine from a data file and call it; it must read a sector of the renumbered cylinder from the original in drive 1, or memory is wiped (QuikPro+II).
• A sector that must fail, asked through the DOS: the program reads three sectors with the DOS's own sector-read routine and refuses to run unless the middle one fails and its neighbours read (Test Bank System).
• Encrypted loaders: CopyCat XORs its program with 53h and 69h; Clone-III decodes with a chained XOR that runs through memory until it reaches the ROM; Super Utility and PowerTool store their loader nibble-encoded and backwards.

Each scheme has a number, used on this page and in the protection.txt file inside each protected disk's download. Levels: A format, B controller/timing, C file system, D loader or enforcing code. S-001 to S-035 belong to products; S-101 and S-102 belong to a DOS. Disks carrying a product scheme are tagged [Copy Protected]; disks carrying a DOS-level scheme (S-005, S-101, S-102) are tagged [DOS Copy Protected].

No.	Scheme	Levels
S-001	Kim Watt's Adventure loader (Adventure International, 1981)	A (Disk Formatting) D (Program Checks)
S-002	Music Magic: inflated BOOT/SYS over a bad sector (Tom Dempsey, 1983)	A (Disk Formatting) C (Confusing the DOS File System) D (Program Checks)
S-003	Big Five's Read Track length check (Robot Attack, 1980/81)	A (Disk Formatting) B (Confusing the Controller) D (Program Checks)
S-004	Computex scrambled self-booting format (Comprehensive Test v1.2, 1981)	A (Disk Formatting) B (Confusing the Controller) D (Program Checks)
S-005	Tandy protection track 40 ("TRS-80 Protection Utility Ver 1.1")	A (Disk Formatting) C (Confusing the DOS File System)
S-006	Snapp overlays on track 40, XOR E5 (Extended BASIC, Builtin Functions)	A (Disk Formatting) D (Program Checks)
S-007	Kim Watt Adventure loader, Breeze variant: cyl 0 sector 148 (Adventure International, 1981)	A (Disk Formatting) D (Program Checks)
S-008	FunSoft per-track sector numbering, F8 marks and Read-Track nibble tracks (Yves Lempereur, 1982): Apple Panic, Alien Taxi, Asylum dual boot, Babel Terror, BRCDE	A (Disk Formatting) B (Confusing the Controller) D (Program Checks)
S-009	Dan Foy Arranger v1.1: 1771 non-IBM 336-byte data sectors	A (Disk Formatting)
S-010	Med Systems Asylum (Model I): fixed renumbered sector IDs	A (Disk Formatting) D (Program Checks)
S-011	Acorn Software Basketball: 1771 non-IBM 256-byte sectors (variant of S-009)	A (Disk Formatting)
S-012	Hayden Blackjack Master: sectors 54-63, F8 marks, status 60h requireD (Program Checks)	A (Disk Formatting) D (Program Checks)
S-013	Computer Shack (Bill Dunlevy) Clash: renumbered F8 tracks 18-32	A (Disk Formatting)
S-014	Pegasus Research Clone-III: 1024-byte MFM program sectors and FM signature IDs (cylinder 93, size byte 8Dh)	A (Disk Formatting)
S-015	CopyCat (Bob Bright): banner/serial track on cylinder 39, 1024-byte MFM sectors 69/70	A (Disk Formatting) D (Program Checks)
S-016	Infocom Model I loader: F9 data marks required (Deadline, Enchanter)	A (Disk Formatting) D (Program Checks)
S-017	Microsoft Olympic Decathlon: fake ID cylinders 127 down by 2, odd sectors 111-127	A (Disk Formatting) D (Program Checks)
S-018	Cogito Frogger: sectors 100-109, cylinder-1 IDs naming cylinder 2; a one-time backup that erases its own routine	A (Disk Formatting) C (Confusing the DOS File System) D (Program Checks)
S-019	The Bottom Shelf CRAS security disk: 128-byte sectors with IDs naming cylinder 63 on cylinders 5, 13, 27	A (Disk Formatting) D (Program Checks)
S-020	Med Systems Knossos production disk: IDs without data fields on sector 5 of cylinders 0-4	A (Disk Formatting)
S-021	Instant Software's Master Reversi (C D Heath loader, 1981): duplicate mixed-size IDs on cylinder 0, code in the gap of cylinder 0, sixteen 128-byte FM sectors 32-47 on cylinders 1-4	A (Disk Formatting) B (Confusing the Controller) D (Program Checks)
S-022	Computer Services / Software Protection Systems MyChess (1980): every sector renumbered to a multiple of 16	A (Disk Formatting)
S-023	Ritam's Monty Plays Scrabble v1.1 (Model I, 1981): sectors 16-25 with FA (deleted) data marks	A (Disk Formatting)
S-024	Kim Watt Super Utility / PowerTool: mixed-density loader track (FM 32, 48, 37 + MFM 64, 80, 69) and 512-byte sectors 17, 34, 51, 68; Super Utility+ v2.x even-numbered cylinder 3	A (Disk Formatting) D (Program Checks)
S-025	Small System Software RSM3-I (1981): every track renumbered 0, 7, 17, 24, 27, 34, 44, 51, 54, 61, ID cylinders differing from the physical ones	A (Disk Formatting) D (Program Checks)
S-026	ICR FutureSoft QuikPro+: one cylinder of the DOS disk renumbered 32-49 (MFM 18 x 256)	A (Disk Formatting) D (Program Checks)
S-027	William Fink's SFinks chess: renumbered game tracks (FM 54-63 / 160-169, MFM 179-196 or 54-71 / 160-177) with unformatted cylinders between	A (Disk Formatting) D (Program Checks)
S-028	Cdex TRSDOS Training Course (1983): last cylinder with sector 255 in place of 16 and a bad sector 17	A (Disk Formatting)
S-029	Fantastic Software's Talking Adventure I (Model I, 1981): cylinder 0 sector 235 in place of sector 4	A (Disk Formatting)
S-030	Atherton and Dayton Test Bank System v3.01 (1983): cylinder 5 sector 6 made unreadable	A (Disk Formatting) D (Program Checks)
S-031	Wittsoft Vivace! Compiler v3.0 (1984): 36 MFM IDs with scattered numbers on cylinders 37-39	A (Disk Formatting) D (Program Checks)
S-032	TanData Corporation Parcel Manifest System (CP/M, 1984): an empty ID mark before sector 1 on every cylinder 1-39	A (Disk Formatting)
S-033	CopyCat 4 (Larry Nedry, Omnisoft Research, 1985-86): program in single 1024-byte MFM sectors numbered 153 with ID cylinder 153 on even cylinders	A (Disk Formatting) D (Program Checks)
S-034	Hypersoft HyperZap (M J Gingell, 1983-85): mixed-density cylinders 1-12 (FM 6-1 and MFM 6-1 interleaved), 2 x 1024 FM on 13-25	A (Disk Formatting)
S-035	PowerSoft PowerDOT v2.0 (1983): extra 1024-byte FM sector 255 with a data CRC error on cylinders 8 and 10	A (Disk Formatting)
S-101	VTOS 3.0 cylinder-0 mini-sectors 7C–7F (variant: the same IDs on another DOS's disk, Small C v2.1)	A (Disk Formatting) D (Program Checks)
S-102	TRSDOS 1.3 limited-backup count (boot byte 22h)	C (Confusing the DOS File System)

Some protection was built into the operating system rather than into the program. The archive tags it [DOS Copy Protected]: the program on the disk may be perfectly ordinary, but the DOS it came on limits or prevents copying. Three DOS-level schemes are on TRS-80 disks.

VTOS 3.0: the hidden mini-sectors on cylinder 0

Randy Cook's VTOS (Virtual Technology Inc., 1979–1980, Model I) protected itself, and every disk it formatted. VTOS 3.0's FORMAT replaces sector 4 of cylinder 0 with four tiny sectors that only a Model I can make:

• The sectors: four IDs numbered 7Ch, 7Dh, 7Eh and 7Fh, each with size byte 01. On the WD1771 in non-IBM mode that is a 16-byte sector. They are written with deliberate CRC errors, so a normal read of any of them fails.
• What they encode: which of the four reads cleanly tells VTOS what kind of disk it is looking at:

  Disk type	7C	7D	7E	7F
  Duplicator	bad	bad	bad	valid
  Master	bad	bad	valid	no header
  System	bad	valid	no header	bad
  Data	bad	bad	bad	bad

  A data disk's 7F sector also holds the disk name and date (for example PASSWORD01/01/80).
• Example IDs: FE 00 00 7C 01 BC E7, FE 00 00 7D 01 8F D6, FE 00 00 7E 01 DA 85, FE 00 00 7F 01 E9 B4.
• What defeats a copy: no DOS but VTOS writes these IDs, and a sector copier cannot reproduce the 16-byte non-IBM sectors or their pattern of good and bad CRCs. As Pennington's 1979 notes put it, VTOS 3.0 "will not function unless track 0, sector 4 is unformatted (at least that's the way it appears)", and a SUPERZAP backup must skip that sector.
• Other signs of a VTOS disk: GAT byte CBh = 30h; directory track 17 written with FA marks; the SYS banner VTOS - VIRTUAL TECHNOLOGY'S OPERATING SYSTEM stored negated.
• VTOS 4.0 dropped the scheme: its sector 4 is an ordinary E5-filled sector that happens to be numbered 7Ch. VTOS 4.0 disks are not protected.
• The same IDs on other software: VTComm carries them because it was distributed on VTOS 3.0. Small C v2.1 (Mikorie, 1984) has the same 7C–7F IDs on the second side of cylinder 0 of a disk written by another DOS, and is classed with this scheme.

More about VTOS is on the VTOS page.

Found on (29 disk images in the archive):

• Small C v2.1 — Mikorie, 1984
• VTComm — Randolph H Cook, 1979
• VTOS v3.0 — Randolph H Cook, 1979
• VTOS v3.0.0 — Randolph H Cook, 1979
• VTOS v3.0.1 — Randolph H Cook, 1979

TRSDOS 1.3: the limited-backup counter

Tandy's Model III TRSDOS 1.3 has a copy limit that needs no special format at all, which makes it invisible to any scan of the tracks.

• The counter: byte 22h of the boot sector (cylinder 0, sector 1) holds the number of backups still allowed. FFh means unlimited, which is what an ordinary TRSDOS 1.3 disk carries.
• The protected files: bit 5 of a file's attribute byte in the directory marks it as one the limit applies to.
• What BACKUP does (traced in the code of TRSDOS 1.3's BACKUP; TRSDOS 1.2's is the same): before copying, BACKUP reads the source disk's boot sector. At FFh it copies without limit. At any other count it writes the count less one back to the source disk and gives the copy a count of 00, so every copy is a dead end. At 00 it makes the copy and then removes every bit-5 file from it, clearing the directory entry and freeing the file's space: the backup runs, but the protected program is missing from it. A disk shipped with a count of 00 can never be backed up with its program intact. LS-DOS's CONV utility honours the same byte.
• Older disks: TRSDOS 1.2 and 1.3 BACKUP refuse a TRSDOS 1.1 disk outright (Cannot Backup Version 1.1 Diskette, Use "XFERSYS"). TRSDOS 1.1 keeps its count as a two-byte word at boot offset FCh-FDh, and its own BACKUP applies the same rule to it: FFFFh no limit, 0000h the copy loses its protected files, any other value counted down on the source with 0000h on the copy. This is the word that Tandy's Protection Utility on track 40 writes.
• What it takes to apply it: both halves must be present, a count below FFh and at least one bit-5 file. A count of 00 with no bit-5 file, or bit-5 files with FFh, protects nothing, and the archive does not tag those disks.
• Counts found on originals: 00 (no backup allowed: Infocom's Cutthroats, Galaxy Math Facts, Desktop-Plan-80), 01 (Computer Discovery, Infidel, Enchanter release 16), 02 (High Motivation Reading Series, Chemistry Lab), 03 (Doughflo), 04, 05 or 0Eh (Author I and K-8 Math Program), and other values on the Infocom, Monty and VisiCalc disks.
• What defeats a copy: nothing on the disk is unusual, so a sector copier or a disk-image tool copies it perfectly, counter and all. The protection only works against the DOS's own BACKUP command, which was the copying method most buyers had.

Found on (65 disk images in the archive):

• Author I — Small Computer Company, 1982
• Author I Lesson Presentation Package v1.00B — Tandy, 1982
• Author I v1.0B — Small Computer Company / Tandy, 1982
• Chemistry Lab Volume 1 v1.00 — Richard C Hallgren / Tandy, 1982
• Computer Discovery Disk 1 — Science Research Associates / Tandy, 1982
• Computer Discovery Disk 2 — Science Research Associates / Tandy, 1982
• Computer Discovery Diskette 2 — Science Research Associates / Tandy, 1982
• Cutthroats — Infocom, 1984
• Desktop-Plan-80 v3.10.9 — Don Williams / Personal Software & Tandy, 1981
• Doughflo v3.4 — Mike Erickson / Alphanetics, 1981
• Enchanter — Infocom, 1982
• Galaxy Math Facts Fractions II — Random House, 1982
• Galaxy Math Facts Game — Random House, 1982
• Galaxy Math Facts Place Value — Random House, 1982
• High Motivation Reading Series Amelia Earhart — Pendulum Press, 1982
• High Motivation Reading Series Charles Lindbergh — Pendulum Press, 1982
• Infidel — Infocom, 1983
• K-8 Math Program Preview Library Disk 2 — Tandy, 1983
• Matrices Determinants and Simultaneous Equations — Tandy, 1982
• Monty Plays Monipoly — Ritam, 1981
• Monty Plays Monopoly — Ritam, 1982
• Monty Plays Scrabble v1.0 — Ritam-Personal-Software, 1981
• Planetfall — Infocom, 1983
• Scripsit — Tandy, 1980
• Scripsit v3.2 — Tandy, 1980
• Scripsit-Disk UCLC v3.2 — Radio Shack, 1980
• Sorcerer — Infocom, 1984
• Starcross Rel 17 — Infocom, 1982
• Suspended — Infocom, 1983
• TRSDOS v1.2 — Tandy, 1981
• VisiCalc vVC-150Y0-T83 — Software Arts / Tandy, 1981
• VisiCalc vVC-160Y0-T83 — Personal Software / Tandy, 1980
• Witness — Infocom Inc, 1983
• Zork I The Great Underground Empire — Infocom, 1982
• Zork II The Wizard of Frobozz — Infocom, 1981
• Zork III The Dungeon Master — Infocom, 1982

The TRSDOS 1.3 directory and attribute bytes are explained on the TRSDOS 1.3 internals page.

Tandy's protection track: cylinder 40

Tandy protected some of its own Model I and Model III software (and some programs it published for others) with an extra, 41st track, made by a tool whose code identifies itself as "TRS-80 Protection Utility Ver 1.1".

• The track: cylinder 40, one past the last track TRSDOS uses, holding 18 double-density sectors numbered 129 to 146 (81h–92h) instead of 1 to 18. All CRCs are good. The filler is E5 ending with (c) 1980 Tandy.
• On a protected disk: every sector has an F8 data mark, and sectors 144-146 hold the code of the TRS-80 Protection Utility itself, with its messages XORed with 55h.
• Why BACKUP cannot copy it: TRSDOS FORMAT and BACKUP stop at cylinder 39, so the copy simply has no track 40. Curiously, TRSDOS 1.3's FORMAT/BACKUP overlay contains a routine that, for any cylinder of 40 or more, sets bit 7 of the sector number, which produces exactly these IDs; it is never reached with the stock 40-track count.
• What the code is: the protection tool, not a check. On Tandy disks with TRSDOS 1.1-1.3 the DOS's own SYS7 overlay (cylinder 1, sector 10) loads DE with 2890h (track 40, sector 144) and BC with 0300h, reads sectors 144-146 to 5200h and jumps there. The code reads the boot sector and runs only if the word at offset FCh is FFFFh, a master not yet set up; otherwise it erases itself from memory and returns to the DOS with error code 20h. When it runs it shows TRS-80 Protection Utility Ver 1.1 and asks Filespec to Protect?, Update Password to Assign each of the files? ("ALL programs to protect MUST NOT be password protected") and Number of allowable Backups?. For each file it sets bit 5 and access level 6 in the directory entry and stores the update password; then it writes the backup count into the boot sector at FCh-FDh.
• So what protects the disk is the limited-backup count the tool leaves behind, the same kind of protection as the TRSDOS 1.3 limited-backup counter on this page; the track is Tandy's duplication tool riding along on the master. The code is identical on every disk in the archive that carries it. Because it is run by the DOS supplied on the disk, the archive tags these disks [DOS Copy Protected], including four (two Profile releases, Spelling Demons and the XR-1 control software) where nothing on the disk runs the tool at all. On the disks whose DOS runs the tool, the boot sector shows no count yet: the tool is still armed.
• Whether the count is enforced: yes, by the BACKUP of TRSDOS 1.1, the DOS on these disks: it reads the word at FCh-FDh, counts it down on the source and removes the protected files from a copy once it reaches zero (traced in the code). On every TRSDOS 1.1 disk here the word is still FFFFh, so they back up without limit until the tool is run. The three disks that carry 0000h at FCh (a later Profile release, Spelling Demons and the XR-1 control software) are TRSDOS 1.3 disks, whose BACKUP reads the counter at byte 22h instead (FFh, no limit). TRSDOS 1.2 and 1.3 will not back up a TRSDOS 1.1 disk at all.
• Not every track 40 is protection: a cylinder 40 with FB marks and filler only (a data disk of Accounts Receivable, a set of AllWrite! disks) protects nothing, and neither does one whose check a cracker removed (Demon Seed, hacked by Aragorn).

Found on (13 disk images in the archive):

• Accounts Receivable System v1.2 — Radio Shack, 1980
• Education Demo VS v1.0 — Tandy, 1981
• Educational Products Demonstration Disk v3.0 — Radio Shack, 1981
• Extended BASIC for TD v1.1 — Snapp, 1981
• Microfiles Information Management System v3.0 — Kilgus / RS, 1979
• Profile v1.0 — Tandy, 1980
• Profile v3.1 — Tandy, 1980
• Profile v3.2 — Tandy, 1980
• Quick Quiz A Mini-Authoring System — Tandy, 1981
• Spelling Demons — Random House, 1981
• TRSDOS v1.1 — Tandy, 1980
• Versafile v3.0 — William D Schroeder / Tandy, 1979
• XR-1 Control Software — Quentin Barnes / Rhino Robots, 1983

Snapp's Extended BASIC: encrypted overlays on track 40

Snapp used Tandy's extra track for a cleverer purpose: instead of a check that can be patched out, the track holds part of the program.

• The track: cylinder 40, sectors 129–146 with F8 marks, in Tandy's layout. Sectors 129–132, 133–137 and 138–143 hold program overlays E, F and I, every byte XORed with E5h.
• The loader: on cylinder 12, sector 1 (itself XOR E5 on Builtin Functions). It holds a table of overlay letter, track, sector and count, reads each overlay from track 40 and decrypts it after the read. Decoded, the overlays are Z80 code; one carries the text FATAL ERROR - TEXT NOW BAD.
• What defeats a copy: a BACKUP copy has no track 40, so the overlays are simply missing and the extended commands that need them fail. Removing a check does not help, because there is nothing to remove: the code itself is on the track.
• Versions: Extended BASIC v1.1 carries Tandy's protection code in sectors 144–146 as well; v1.3 and Builtin Functions have filler there and rely on the overlays alone.

Found on (3 disk images in the archive):

• Builtin Functions — Snapp, 1981
• Extended BASIC for TD v1.1 — Snapp, 1981
• Extended BASIC for TD v1.3 — Snapp, 1981

TRSDOS 6 and LS-DOS

The Model 4 DOSes can also mark a disk as backup-limited, again without any special format. A tip for removing the limit is on the DOS tips page. The archive's disk-by-disk analysis did not examine this flag, so no Model 4 disk carries a protection tag for it.

How the DOSes themselves defeat format protection

Every DOS copy is a sector-by-sector copy onto a freshly formatted disk. LS-DOS's mirror BACKUP rewrites every sector with an FB mark except the directory, and Super Utility's Format Without Erase rewrites every track to the standard layout. Either one erases any format-level protection a disk had, which is why so many cracked copies in circulation are simply standard DOS disks with the check removed.

The schemes that belong to a program, in the order they were identified. Each describes the disk as it is found on the original, how the program checks it, what a copy loses, and how to recognise the scheme on another disk. S-005 and S-006 are described under Tandy's protection track.

S-001: Kim Watt's Adventure loader (Adventure International, 1981)

Protection levels: A (format), D (loader)

• Cylinder 0: four single-density IDs, all size code 2 (512 bytes):
  • sector 0: the self-booting loader, beginning -Adventure Loader- by Kim Watt;
  • sector 2: the message "ATTENTION … Adventure International has LOTS of good software … If you do not have our catalog let us know …";
  • sector 23: 512 × FF, data CRC stored as 00 00 (correct would be 1535 for FB + FF × 512);
  • sector 113: ID FE 00 00 71 02 with ID CRC FF FF (correct FAD8) and no data field; FF fill follows.
• The check, right after the banner in sector 0:

  LD   BC,6000h
  LD   DE,0017h      ; D = track 0, E = sector 23
  CALL 425Ah         ; read the sector
  JR   Z,hang        ; read succeeded: lock up
  CP   08h           ; status 08h = CRC error
  JR   Z,continue    ; CRC error: go on loading
  hang: JR  $        ; anything else: lock up

  
  The game loads only if sector 23 reads with a CRC error. Repairing that sector, or copying it with a sector copier, makes the disk lock up at boot.
• Sector 113 isn't read by that check. Its purpose (a second check later, or a decoy to stop copiers) is unverified.
• Rest of the disk: cylinders 1–27 FM, 10 × 256, sectors 0–9 (cylinder 1 with F8 on alternate sectors); cylinders 28–34 blank. All 272 good sectors identical in the two sets.
• How to recognise it: a Model I cylinder 0 of 512-byte FM sectors including an out-of-range sector with CRC 00 00, together with Adventure Loader / Kim Watt in sector 0, is this scheme. Other Adventure International titles of 1981–82 should be scanned for it.

Further findings:

• Adams Adventures 04-06 (Adventure International): another copy has the same cylinder 0 (FM 512-byte IDs 0, 2, 23, 113; s23 CRC stored 0000; s113 ID CRC error, no data).

Found on (10 disk images in the archive):

• Adams Adventure 07-09 — Scott Adams / Adventure International, 1981
• Adams Adventures 01-03 — Scott Adams / Adventure International, 1979
• Adams Adventures 01-04 — Scott Adams / Adventure International, 1979
• Adams Adventures 04-06 — Scott Adams / Adventure International, 1979
• Adams Adventures 05-08 — Scott Adams / Adventure International, 1981
• Adams Adventures 09-12 — Scott Adams / Adventure International, 1981
• Adams Adventures 10-13 — Scott Adams / Adventure International, 1981

↑ Back to the scheme list

---

S-002: Music Magic: an inflated BOOT/SYS over a bad sector (Tom Dempsey, 1983)

Protection levels: A (format), C (file system), D (loader)

• The disk: a TRSDOS 2.3-layout data disk (boot 00 FE 11, GAT name MUSIC 00/00/00, directory cylinder 17 with FA marks), 35 FM cylinders of 10 × 256. No SYS0: BOOT/SYS, DIR/SYS, MUSIC/CMD (cylinders 5–11, 66 records, load 5200h–91FBh, entry 5200h) and DEMO3/MUS (cylinders 12–13).
• The reservation: BOOT/SYS's entry claims ERN 49 and one extent of 10 granules from cylinder 0 (00 09), i.e. all of cylinders 0–4, where TRSDOS 2.3's BOOT/SYS is cylinder 0 sectors 0–4. Only cylinder 0 sectors 0–2 hold boot code; the rest is E5 fill, apart from one bad sector per cylinder on 1–4 (1 s4, 2 s7, 3 s1, 4 s9: the same physical slot, fourth on each track). The oversized BOOT/SYS keeps the DOS from ever allocating or writing over them, and a BACKUP stops on them.
• The bad sectors: clean E5 up to about C0h–CCh, then a burst of near-all-ones bytes (FF FD F7 EF FB...), then E5 read slipped (BC = 5 bits, 97 = 2 bits) to the end. The same angular position on four adjacent cylinders: a physical mark made on the media (how it was made is unverified).
• The check (MUSIC/CMD is compiled BASIC; the runtime's file wrappers call $INIT 4420h, $OPEN 4424h, $POSN 4442h, $READ 4436h and store the DOS return code in BEE4h + file number), at startup, 6A68h:

  OPEN  "BOOT/SYS:1"        ; 6A6E: LD HL,5EFEh / CALL 52D3h ($OPEN)
  POSN  record 15           ; 6A7D: LD HL,15 / CALL 530Eh (0-based 14 = cyl 1 s4)
  READ                      ; 6A83: CALL 52C3h ($READ)
  IF status <> 4 THEN CLS : RETURN to DOS     ; 6A89-6A9E (57F7h is "<>")

  
  Status 4 is TRSDOS's "parity error during read" (data CRC error). The program runs only if cylinder 1 sector 4 fails with a CRC error; repaired, or copied cleanly, it clears the screen and quits. Only that sector is read; sectors 2 s7, 3 s1 and 4 s9 are not addressed by the program (spares or decoys, unverified).
• Also: a checksum of a text table (6A38h–6A65h, bytes 3–A8h, into B855h) is compared with 4B32h at 713Ch: an anti-tamper check on the text, not on the disk.
• How to recognise it: a BOOT/SYS (or other system file) whose extent runs well past its normal size and covers data-CRC-error sectors, while the rest of that extent is plain fill, is a protection reservation: hands off.

Further findings:

• On the Music Magic v2.0 disk the scheme was described from, BOOT/SYS inflated to cylinders 0-4 over the bad sectors 1 s4, 2 s7, 3 s1, 4 s9; MUSIC/CMD reads record 15.

Found on (1 disk image in the archive):

• Music Magic v2.0 — Tom Dempsey, 1983

↑ Back to the scheme list

---

S-003: Big Five's Read Track length check (Robot Attack, 1980/81)

Protection levels: A (format), B (controller), D (loader)

• The disk: 35 FM cylinders, single-sided, no DOS. Cyl 0: FM s0 (Model I boot, MINI DOS VER 1.2 BY BIG 5) and MFM s1 (Model III boot). Cyl 1–3 and 6–31 are FM 5 × 512 (order 0 2 4 1 3), cyl 4 is FM 1 × 1024 + 1 × 256, cyl 31 1 × 256. Physical cyl 1 and 2 both carry IDs saying cylinder 2 (identical data), physical cyl 3 and 6 both say cylinder 6 (4 bytes differ): the boot code seeks to 2 and 6, so physical 1 and 3 are decoys. Model I path: cyl 2 (loader at 4400h–47FFh), game on cyl 8–18; Model III path: cyl 6, game on cyl 19–30 (cyl 9–18 = cyl 21–30 byte for byte). On the flux-level originals, cyl 5 and 32–39 are unformatted (noise IDs).
• The check (Model I loader, cyl 2 s1 = 4600h; entry 466Dh, run once the load reaches track 18): changes its own FDC command byte at 4740h from 88h (Read Sector) to E4h (Read Track), Read-Tracks cylinders 13 down to 6 into address 0000h (ROM, so only the count DE survives), and stores the 8 byte counts. It compares them with an 8-word table copied by cyl 2 s0 (LDIR A4ABh → 47B5h, 16 bytes), i.e. cyl 4 s1 offset ABh, the disk's serialised sector (cyl 4 s0 holds the serial number). Each count must be within 6 bytes of its entry (H = 0 and L < 6).
• On failure: the command byte becomes F4h (Write Track), 476Fh becomes 1A 02 (LD A,(DE) / LD (BC),A), and tracks 1–19 are rewritten with ROM bytes. A failed check on a writable image destroys the Model I and shared tracks.
• The Model III loader (cyl 6 s1 = 4600h, entry 4662h, at track 30, table at 47A5h) has the same check.
• Values: HFE table 0C29h 0C29h 0C29h 0C28h 0C2Ah 0C28h 0C29h 0C28h (3112–3114) against Read Track lengths of 3112–3114 FM bytes. The check passes.
• Disabled copies: the original flux read and the serialised copy have C9 (RET) at the check's entry in all four loaders (cyl 1 s1 6Dh, cyl 2 s1 6Dh, cyl 3 s1 62h, cyl 6 s1 62h) and an E5 table. Whether that is a later factory run or a crack is unverified.
• How to break it in an image: any image whose tracks 6–13 do not keep the original disk's own lengths, e.g. an HFE regenerated at a nominal 3127 bytes per track, or a DMK whose fixed track length differs. A DMK gives a Read Track count equal to its track length on every track, so an active check passes on a DMK only if the table happens to match. The fix is to patch the loader (C9 at the entry, as the factory-disabled copies do) or to write that image's own lengths into the table.

Further findings:

• Attack Force v3.0 (Model I and III) has the Robot Attack layout (cyl 1/2 both ID cyl 2, cyl 3/6 both ID cyl 6, serial track cyl 4) with C9 at the check entry (cyl 1/2 s1 6Dh, cyl 3/6 s1 62h) and an E5 table; Attack Force v3.0 (Model I)original has its own layout (IDs match the cylinders, serial track cyl 3 with BILL234000JE...) and an active check: cyl 1 s1 89h LD A,(B270h) / CP 0Bh / RET NZ / LD A,E4h / LD (B34Ah),A.
• Cosmic Fighter (Big Five Software, 1980) has the Robot Attack layout exactly (cyl 1/2 both ID cylinder 2, cyl 3/6 both ID cylinder 6, cyl 4 1 x 1024 + 1 x 256, cyl 5 unformatted, FM 5 x 512 elsewhere) with C9 (RET) at the check entry in all four loaders (cyl 1/2 s1 6Dh, cyl 3/6 s1 62h) and an E5 table at cyl 4 s1 ABh, like Attack Force v3.0 (Model I and III); both boot sectors (MINI DOS VER 1.2 BY BIG 5, MOD1/MOD3 DISK LOADER PROGRAM) are present: [Dual Boot][Self Booting][Special Format][Copy Protected].
• the Robot Attack layout (cyl 1/2 both ID cylinder 2, cyl 3/6 both ID cylinder 6, cyl 4 one 1024-byte and one 256-byte sector, FM 5 x 512 elsewhere) with C9 (RET) at the check entry of all four loaders (check disabled, still [Copy Protected]) on 12 images: Robot Attack and Robot Attack v1.0 (8), Meteor Mission II v3.0 (2), Super Nova v1.2 (2). [Dual Boot] only where MFM s1 is present.
• Cosmic Fighter v3.0 (Model I and III) Sets 1-2 and (Model I) Set 1, Galaxy Invasion v3.0 (Model I and III) Sets 1-2 have the Robot Attack layout with C9 at both check entries; the (Model I and III) copies carry both boot sectors ([Dual Boot]).

Found on (20 disk images in the archive):

• Attack Force v3.0 — Bill Hogue & Jeff Konyu / Big Five, 1980
• Cosmic Fighter — Big Five Software, 1980
• Cosmic Fighter v3.0 — Big Five Software, 1981
• Galaxy Invasion v3.0 — Big Five Software, 1981
• Meteor Mission II v3.0 — Big Five Software, 1981
• Robot Attack — Big Five Software
• Robot Attack v1.0 — Big Five Software, 1980
• Super Nova v1.2 — Big Five Software, 1980

↑ Back to the scheme list

---

S-004: Computex's scrambled self-booting format (Comprehensive Test v1.2, 1981)

Protection levels: A (format), B (controller), D (loader)

• The disk: a self-booting Model I diagnostic (ROM checksum, RAM, keyboard bounce, disk RPM, stepper/alignment and screen tests), no DOS or directory. 35 FM cylinders, one side, 10 × 256 numbered 0–9, but only cylinders 0, 3, 5, 9, 10, 13, 15, 19, 20 and 21 are formatted; the rest read as unformatted. Every formatted track has its own, unrelated sector order, at an even ~301-byte spacing (first ID at about logical byte 21). Unused sectors hold CC fill; no ID or data CRC errors anywhere. | Cyl | Sector order | |---|---| | 0 | 2 7 6 3 4 8 9 5 0 1 | | 3 | 5 0 1 7 6 8 9 4 2 3 | | 5 | 3 2 4 6 0 5 9 7 8 1 | | 9 | 6 5 7 0 8 4 3 1 2 9 | | 10 | 0 9 2 7 8 3 4 1 6 5 | | 13 | 2 5 1 0 3 4 6 8 7 9 | | 15 | 2 1 3 5 4 9 8 6 7 0 | | 19 | 8 1 2 6 7 9 5 0 3 4 | | 20 | 0 9 5 7 8 3 1 2 6 4 | | 21 | 3 0 1 5 8 9 2 6 7 (no s4; never read, all CC fill) | Unformatted: 1, 2, 4, 6–8, 11, 12, 14, 16–18, 22–34.
• The warnings: cyl 0 s0 (boot) shows ATTEMPTING TO COPY THIS DISKETTE MAY DESTROY SOME OF IT'S DATA; cyl 9 s8 (5000h) repeats it with BE CAREFUL!!!!!.
• The load: the boot sector reads cyl 9 s4–8 to 4C00h–50FFh with its own FDC routine (retries on any status in 5Ch) and jumps to 5000h, which copies 4C00h to the screen, then issues command C2h (Read Address) and, while bytes arrive, locks up (JR Z,$) if any byte read is 08h; then it reads cyl 19 s0–9 and cyl 20 s0–5 to 7100h–80FFh and jumps to 7100h. The help pages are read the same way (cyl 3, 5, 10, 13, 15 s2–5, cyl 9 s0–3) straight to video RAM. What the 08h test catches (sector 8's ID, a track 8, a CRC byte; it depends on which ID passes the head after the sector-8 read) is unverified; that it inspects the physical IDs is not.
• What defeats a copy: a DOS BACKUP or sector copier either stops at the first unformatted track or formats every track in its own order; either way the ID order the loader sees changes. The track-9 IDs are FE 09 00 0s 01 + CRC; only sector 8's (8B 0D) holds an 08h byte apart from its sector number. A track copier that keeps each track's ID order and leaves blank tracks blank should reproduce the disk (unverified).
• Boot routine (cyl 0 s0 at 4200h): LD DE,0904h (track 9, sector 4), count 5, buffer 4C00h; reads with command 88h after a 1Bh seek, polls DRQ, AND 5Ch on the status and retries forever on any error; sector number wraps at 0Ah to the next track. The help-page loader at 71A1h–71CDh patches the same routine (buffer at 421Ah → 3C00h, exit at 4232h → 427Bh, a RET) to read 4 sectors from sector 2 of the requested track.
• How to recognise it: a Computex boot sector with the copy warning, or a self-booting disk whose formatted tracks each carry a different random sector order among unformatted ones, is protected: hands off.

Found on (1 disk image in the archive):

• Computex Comprehensive Test v1.2 — James B Penny, 1981

↑ Back to the scheme list

---

S-007: Kim Watt's Adventure loader, Breeze variant: sector 148 (Adventure International, 1981)

Protection levels: A (format), D (loader)

• Cylinder 0: FM 10 x 256 (F8 on s0), with sector 1 replaced by sector 148 (94h); s148 holds 256 x 00 (FB) or 256 x 00 / text (FA); all CRCs good. Cylinders 1 on: FM 10 x 256 with F8 marks. No directory.
• The boot (cyl 0 s0 at 4200h): -Adventure Loader- by Kim Watt, and Breeze Computing Inc. when the 3840h keyboard row holds 03h; it reads 50 sectors from cyl 2 s0 to 6000h and jumps there.
• The check (in the cyl 2 loader, 60F5h-6107h; Ghost Town v2.23 and Savage Island v1.23 at 60F5h-6104h): after copying its read routine to 4200h:

  LD   DE,0094h     ; track 0, sector 148
  LD   BC,9000h     ; buffer
  CALL 4214h        ; read (4200h with HL=1 on the originals)
  JR   NZ,hang      ; any error: JR $
  JP   7050h        ; start the game

  
  The game starts only if sector 148 exists and reads cleanly. A DOS BACKUP or a sector copier that writes the standard numbering has no sector 148, so the copy hangs.
• How to recognise it: a Kim Watt Adventure Loader boot on a 10-sector cylinder 0 where one number is 148: this scheme.

Further findings:

• Purge Master (Breeze) carries the Breeze variant: cylinder 0 sector 148 in place of sector 1.

Found on (9 disk images in the archive):

• Adams Adventure 09 Ghost Town — Scott Adams / Adventure International, 1981
• Adams Adventure 09 Ghost Town v1.25 — Adventure International, 1981
• Adams Adventure 09 Ghost Town v2.23 — Scott Adams Adventure International, 1981
• Adams Adventure 10 Savage Island I v1.23 — Scott Adams / Adventure International, 1979
• Adams Adventures 01-04 — Scott Adams / Adventure International, 1979
• Adams Adventures 05-08 — Scott Adams / Adventure International, 1981
• Purge Master — Kim Watt

↑ Back to the scheme list

---

S-008: FunSoft per-track sector numbering (Yves Lempereur, 1982)

Protection levels: A (format), B (controller), D (loader)

• Cylinder 0: FM s0 (Model I loader 31 F8/FE 41 F3 CD xx 42 CD 1C 42) and FM s2; on the dual-boot disks also MFM s1 (Model III), which copies itself up and reads FM s2 or relocates to B700h.
• Data cylinders: FM 10 x 256, F8 marks, every ID numbered from one table plus the cylinder offset, so each track's numbers rise by 1 per cylinder (Alien Taxi cyl 1: 5 13 27 32 42 45 58 59 63 64, cyl 2: 6 14 28...; Apple Panic cyl 1: 24 37 40 66 80 84 96 101 124 125; Asylum cyl 1: 16 23 24 32 36 39 43 52 54 62).
• Track 3 (traced on Alien Taxi): only five numbered sectors (the table plus 3) and a 128-byte sector 78 with a bad data CRC; after the last sector, in the gap, the duplicator wrote raw bytes: the marker 76 76 followed by a few bytes of code (E1 E1 ED 4B 07 44 C9), then, at fixed distances, 2D F7 00 (5Fh bytes on) and F5 F7 40 (146h bytes on), bytes that no Write Sector can produce. The game reads track 3 with Read Track (E4h, two tries, by patching its own read routine), searches the 3000-byte buffer for 76 76, compares the two 3-byte strings, and then returns into the code that follows the marker in the buffer; on a mismatch it copies a small routine high in memory that clears memory from 4300h. The same signature, at the same distances, is on track 3 of 44 disk images of this family, from Fantastic Software, Med Systems, Melbourne House, Beam Software and others. A DMK keeps these bytes; a sector copy or a sector-level image loses them.
• The loader (Apple Panic): steps to cylinder 2, issues Read Address (C4h), and from the ID's cylinder byte sets the numbering offset at 42FFh; it then reads by the computed numbers. A copy with standard numbering cannot load.
• Read-Track nibble tracks and F8 check (31 October 2026, Babel Terror and BRCDE): see the S-008 facts above the scheme entries.
• How to recognise it: full FM tracks whose sector numbers are a fixed scattered set rising by one per cylinder, with a FunSoft-style boot: this scheme; tracks with one stray ID and the string VYNKA: in their raw bytes are its nibble tracks.

Further findings:

• Babel Terror (1982)(Yves Lempereur-FunSoft)(Model I and III) and BRCDE (1982)(Yves Lempereur)(Model I and III) carry the same loaders (boot sectors and cylinders 1-2 byte-identical) and settle three open points:
• four more titles carry the numbering: Deathmaze 5000 and Labyrinth (Med Systems; cyl 1 94 179 43 165 145 88 48 183 127 100), Desert Peril and Devil's Tower (John R Olsen Jr - Fantastic Software; cyl 1 58 64 5 27 42 63 32 13 59 45, the same table as Alien Taxi's family; loaders say Loader by Paul Brandon, Copyrighted 1982), and Forbidden Planet (Fantastic Software (Model I and III); cyl 1 92 149 44 154 147 38 43 123 137 93). All have the six-ID track 3 with sector 78 (data CRC stored E5E5 on most copies; one ID with size byte 30h on the Olsen originals). The dual-boot copies' MFM s1 either copies itself to 4400h (Desert Peril) or to B700h (Deathmaze Set 2, Forbidden Planet), selects FM and reads FM s2, the port version of the loader, which steps to cylinder 2 and takes the numbering offset from a Read Address (C4h via port F0h): the Babel Terror pattern, so [Dual Boot] is traced. The same pattern is likely on Asylum.
• Seven more titles carry the numbering: Hyperlight Patrol (Warren L Greene - Fantastic Software; cyl 1 25 23 33 52 39 26 36 14 43 62), Identifying Minerals (Focus Media; 48 53 32 12 39 16 36 54 42 62), Institute Adventure (Med Systems; Sets 1-2 and 4: 92 149 44 154 147 38 45 133 138 93; Set 3 test copy: 92 109 44 54 90 38 45 23 82 93), Laser Defense (Med Systems, a hacked copy with the Set 3 table), La Corrida De Oros (Gessler; 47 57 28 45 62 43 16 64 63 2), Grand Prix 80 (Melbourne House; 34 23 31 52 39 15 36 54 43 63) and Galactic Patrol (Micro-Ware, cylinders 1, 5 and 9 only, with the Institute Set 3 table under its own loader). All have the six-ID track 3 with s78 (stored E5E5) except Galactic Patrol. The dual-boot copies' MFM s1 copies itself to B700h (Hyperlight Patrol, Identifying Minerals, Institute Adventure) or 4400h (La Corrida), selects FM and reads FM s2: [Dual Boot] traced. Grand Prix 80 has FM s2 but no MFM s1 in its image ([Dual Boot] removed,). Lucifer's Realm (Med Systems) has the same loader (Loader by Paul Brandon) on standard tracks: no layout, no protection tag.
• 31 more images carry the numbering: Mad Mines, Marketing Peanut Butter, Martian Patrol, Odin, Panik (3), Penetrator (7), Space Attack, Space Invaders, Spox (3), Strike Force, Talking Adventure II Forbidden City (5), Time Runner, Warrior of RAS Volume 1 Dunzhin (3) and Volume 2 Kaiv v1.5, Wild West. Several share the Babel Terror table (125 96 80 40 24 124 84 101 37 66) and have Read-Track nibble tracks with the sync VYNKA: on cylinders 4-5 or 4-11 (Mad Mines, Time Runner, Space Invaders); one has a decoy TRSDOS-layout directory on cylinders 12-17; the Fantastic Software titles have the six-ID track 3 with s78 stored E5E5, as Alien Taxi.
• Black Hole v2.1 (FunSoft (Model I and III)) has the Babel Terror loaders and table (125 96 80 40 24 124 84 101 37 66) with VYNKA nibble tracks on cylinders 4-10 and DOS-format tracks 11-34: [Dual Boot] traced as Babel Terror. Dubois and McNamara Software Demo Disks 1 and 2 and Jungle Boy v1.0 (Dubois & McNamara, 1982) carry a new cylinder-1 table, 64 62 58 8 7 6 15 57 63 59 (+1 per cylinder), F8 marks and the six-ID track 3 with s78 (stored E5E5) and one 768-byte ID (size byte 30h, CRC good), FM s0 and FM s2 loaders only (Model I).

Found on (57 disk images in the archive):

• Alien Taxi — John Olsen / Fantastic Software, 1982
• Apple Panic — Yves Lempereur / FunSoft, 1982
• Asylum — Frank Corr+William F Denman J / Med Systems, 1981
• Babel Terror — Yves Lempereur / FunSoft, 1982
• Black Hole v2.1 — Yves Lempereur / FunSoft, 1982
• BRCDE — Yves Lempereur, 1982
• Deathmaze 5000 and Labyrinth — Med Systems Software
• Desert Peril — John R Olsen Jr / Fantastic Software
• Devil's Tower — John R Olsen Jr / Fantastic Software
• Dubois and McNamara Software Demo Disk 1 v1.2 — Dubois and McNamara Software, 1982
• Dubois and McNamara Software Demo Disk 2 v1.0 — Dubois and McNamara Software, 1982
• Forbidden Planet — Fantastic Software, 1981
• Galactic Patrol — David Lin / Micro-Ware Distributors, 1982
• Grand Prix 80 — Rick Maurice / Melbourne House, 1983
• Hyperlight Patrol — Warren L Greene / Fantastic Software, 1980
• Identifying Minerals — Salvatore Tocci / Focus Media Inc, 1982
• Institute Adventure — Jyym L Pearson / Med Systems Software, 1981
• Jungle Boy v1.0 — Dubois & McNamara Software, 1982
• La Corrida De Oros — Gessler Educational Software, 1983
• Laser Defense — Simon L Smith / Med Systems Software, 1982
• Mad Mines — Yves Lempereur / FunSoft, 1982
• Marketing Peanut Butter — McGraw / Hill, 1985
• Martian Patrol — Rick Maurice / Melbourne House, 1982
• Odin — Peter W Frey / Odesta, 1981
• Panik — William Demas / Fantastic Software, 1982
• Penetrator — Philip Case / Melbourne House, 1982
• Space Attack — C J Abrahams / Melbourne House, 1982
• Space Invaders — Yves Lempereur TRSoft, 1980
• Spox — Tim Knight / Software Guild, 1982
• Strike Force — William Tang / Beam Software, 1981
• Talking Adventure II Forbidden City — William Demas / Fantastic Software, 1981
• Time Runner — Yves Lempereur / FunSoft, 1982
• Warrior of RAS Volume 1 Dunzhin — Randall Don Masteller / Med Systems Software, 1982
• Warrior of RAS Volume 2 Kaiv v1.5 — Med Systems Software, 1982
• Wild West — C J Abrahams / Melbourne House, 1982

↑ Back to the scheme list

---

S-009: Dan Foy's Arranger v1.1: 1771 non-IBM data sectors (1982)

Protection levels: A (format)

• The disk: two sides; side 0 cyl 0-7 FM 10 x 256 with side byte 3Ch; side 0 cyl 8-34: 8 IDs each (order 0 3 6 1 4 7 2 5), size byte 15h, side byte 3Ch, E5 fill: on a 1771 read in non-IBM mode (command bit b = 0) the length is 16 x 15h = 336 bytes. DMK readers take 256 bytes, so every one shows a CRC error (stored E5E5). Side 1: FM 10 x 256.
• The program: the boot (cyl 0 s0, << ARRANGER 1.1 >> BY DAN FOY) loads cyl 0 s1 to cyl 4 to 4400h; at 52ECh it reads these sectors with command 84h (b = 0) as twelve 28-byte records each.
• What defeats a copy: no 179x (Model III, doublers) can read or write non-IBM sectors, and no DOS formats them.

Found on (1 disk image in the archive):

• Arranger v1.1 — Dan Foy, 1982

↑ Back to the scheme list

---

S-010: Med Systems' Asylum (Model I): renumbered sector IDs (1981)

Protection levels: A (format), D (loader)

• The disk: FM, F8 marks; cylinder 0: 0 41 47 87 93 126 164 178 201 214; cylinders 2-11: 41 47 87 93 126 164 178 199 201 214; cylinder 1: only 42 and 122; cylinders 12-34 unformatted. Sector 126 (7Eh) is one of these numbers, not a VTOS mini-sector.
• The boot: cyl 0 s0 copies itself to B700h and reads eight sectors of cylinder 0 to 6800h by a table (41 87 126 178 201 214 93 164 47 199 255; the index is the logical sector), with Read Sector 88h and the status AND FCh compared with a value the caller passes: 60h, the F8 record type, so a copy with ordinary FB marks retries for ever.
• The check: the program at 6800h reads cylinder 1 sector 122 expecting status 68h: an F8 mark and a CRC error, nine tries, and then calls the data it just read: the sector's first bytes (POP HL / POP HL / LD HL,(6802h) / PUSH HL / JP 6E00h) drop the return address and carry on with the game. If the sector is missing, the buffer still holds a single RET and the program falls into JP 0000h, a reboot.
• What is really enforced: the mismatch in the status is only counted, never acted on, so a copy whose sector 122 reads with a good CRC still runs. The protection is the sector's presence, its number and its code; the deliberate CRC error is decoration.
• What defeats a copy: a DOS BACKUP or sector copier writes standard numbers and FB marks, and cylinder 1 (only sectors 42 and 122) is not a track any DOS formats.

Found on (3 disk images in the archive):

• Asylum — Frank Corr & William F Denman Jr / Med Systems Software, 1981

↑ Back to the scheme list

---

S-011: Acorn Software's Basketball: 1771 non-IBM 256-byte sectors (John Allen, 1980)

Protection levels: A (format)

• The disk: FM, one side, 35 cylinders. Cylinder 0: sector 0 (256 bytes, size code 01, F9 mark: the boot) and sectors 11-19; cylinders 1-34: ten sectors numbered 10-19, FB marks. Every ID except the boot's has the size byte 10h: on a 1771 read in non-IBM mode (command bit b = 0) the length is 16 x 10h = 256 bytes; in IBM mode, and to every DMK reader, 10h AND 3 = 0 means 128 bytes, so the DMK shows each of the 349 sectors with a CRC error. Recomputed over 256 bytes, every CRC is good (all four images).
• The program: the boot (cyl 0 s0 at 4200h, FROM ACORN SOFTWARE) clears the screen, decrypts its own code and loads the game from the non-IBM sectors. No directory.
• What defeats a copy: no 179x (Model III, doubler) can read or write non-IBM sectors, no DOS formats them, and a sector copier on a Model I reads them as 128-byte sectors with CRC errors.
• How to recognise it: FM tracks whose IDs carry a size byte with bits above the low two set (10h, 15h...) and whose 128-byte reading fails every CRC while a 16 x size reading passes: 1771 non-IBM sectors, this family (S-009, S-011).

Further findings:

• Duel-N-Droids (Leo B Christopherson - Acorn, Sets 1-4) and Everest Explorer (William Godwin) carry the Basketball loader (FROM ACORN SOFTWARE) and its 1771 non-IBM 256-byte sectors 10-19 with size byte 10h; every such sector's CRC is good over 256 bytes (308-349 per image).
• Acorn's 1771 non-IBM sectors (FM sectors 10-19 with size byte 10h, CRC good over 256 bytes) on Pigskin (John Lawrence), Pinball (2) and Sargon II Chess. The other Pigskin has Acorn dual loaders with F8-marked FM tracks and no such sectors: no protection tag, boot test for [Dual Boot].
• Invaders from Space v3.1 and v3.1.580 (Carl Miller - Acorn): 349 sectors with size byte 10h, every CRC good at 256 bytes; cylinder 0 F9 marks.

Found on (15 disk images in the archive):

• Basketball — John Allen / Acorn Software Products, 1980
• Duel-N-Droids — Leo B Christopherson / Acorn, 1980
• Everest Explorer — William Godwin, 1980
• Invaders from Space v3.1 — Carl Miller, 1980
• Invaders from Space v3.1.580 — Carl Miller / Acorn, 1980
• Pigskin — John Lawrence, 1979
• Pinball — John Allen / Acorn, 1980
• Sargon II Chess — Dan and Kathe Spracklen / Hayden Book Company, 1979

↑ Back to the scheme list

---

S-012: Hayden's Blackjack Master: sectors renumbered 54-63, F8 marks required (Norman J Wazaney Jr, 1980)

Protection levels: A (format), D (loader)

• The disk: FM, cylinders 0-13: ten 256-byte sectors numbered 54-63 (36h-3Fh, order 54 59 55 60 56 61 57 62 58 63), every one with an F8 (deleted data) mark; cylinder 0 has sector 0 (the boot) in the place of 54. Cylinders 14-29 unformatted (a few noise IDs). All CRCs good. No directory.
• The loader (cyl 0 s0 copies itself to BF00h): sets the sector register to 35h, steps it 36h..3Fh across each track (CP 40h wraps to 36h and steps in), reads with command 8Ch and retries until the status is exactly 60h (LD A,(37ECh) / CP 60h / JR NZ), i.e. the record-type bits of an F8 mark with no error; it loads the BASIC program to 4000h up and starts it by feeding RUN through the keyboard vector (4016h).
• What defeats a copy: a DOS BACKUP formats sectors 0-9 and writes FB marks; a sector copier that renumbers or rewrites marks breaks the load.
• How to recognise it: full FM tracks numbered with a fixed out-of-range block (here 54-63) and F8 marks throughout, with a self-booting loader that checks for status 60h: this scheme.

Found on (1 disk image in the archive):

• Blackjack Master — Norman J Wazaney Jr / Hayden Book, 1980

↑ Back to the scheme list

---

S-013: Computer Shack's Clash: renumbered F8 tracks 18-32 (Bill Dunlevy, 1983)

Protection levels: A (format)

• The disk: cyl 0 FM s0 (Model I boot, (c) Computer Shack.) and MFM s1-17 without s6 (Model III boot); cyl 1-17 FM 10 x 256, the game ((C) COPYRIGHT 1983 BILL DUNLEVY, cyl 17 s1 the high-score table); cyl 18-32 FM 10 x 256 with F8 marks on every sector, numbered from one table plus the cylinder: in track order cyl 18 reads 51 40 48 69 56 32 53 71 60 80, i.e. the table 14 22 30 33 35 38 42 51 53 62 plus 18, each later cylinder one higher; all CRCs good; the data is binary, not filler; cyl 33-39 MFM 9 x 512 E5 sectors whose IDs name cylinder 66 and up (an older format).
• The loaders: cylinder 0 carries two complete loaders, FM s0 for the Model I's WD1771 and MFM s1 for the Model III's WD1793 (with an NMI handler); each boot ROM reads only its own, which is how this Computer Shack/CEC dual boot tells the machines apart. Both read cylinder 1 sector 0, a parameter block (end page, entry word, start page), then load standard-numbered sectors: the Model I path cylinder 1 and the start of cylinder 2 to 4300h-4FFFh, the Model III path cylinders 1, 3 and 4 to 4400h-4FFFh, and both cylinders 5 on to 5300h-CAFFh. The low part is a small disk driver with a jump table; the game starts at 54A6h after the title screen. Neither path checks anything.
• What cylinders 18-32 are: another program's data, not Clash's. They hold the screens of a game with a landscape editor (Press "E" for the landscape editor., Press "L" to load another landscape., LANDSCAPE #) and a high-score table with other players' names; none of these strings is in the Clash program that boots, whose high-score table on cylinder 17 is a different one. Followed in an emulator with keys pressed, Clash reads only its own high-score sector after loading. The renumbered tracks are a protected layout of another product left on the disk (an earlier use of the medium or a duplicator master), and nothing in Clash reads them: Clash itself checks nothing.
• How to recognise it: a Computer Shack/CEC dual-boot cylinder 0 with FM tracks past the game whose sector numbers are a fixed scattered set rising by one per cylinder and F8 marks: this scheme.

Found on (1 disk image in the archive):

• Clash — Bill Dunlevy / Computer Shack, 1983

↑ Back to the scheme list

---

S-014: Pegasus Research's Clone-III: 1024-byte MFM sectors and signature IDs (1983)

Protection levels: A (format)

• The disk: cyl 0 MFM 1024-byte sectors 1 6 7 8 9 (s1 the boot: JP 4400h, (c) 1983 by Pegasus Research), cyl 1 MFM 1024-byte sectors 5-9: the program. Cyl 2, 3, 5 and 6: FM IDs naming cylinder 93, size byte 8Dh, sector numbers 225 and 141 (cyl 2: 225, 225, 141; cyl 3: 225, 141; cyl 5: 141; cyl 6: 141), FB marks over FF, E5 or 4E fill; the second cyl 2 s225 stores CRC 0000 and cyl 6 s141 E5E5. Cyl 7-34: scattered single IDs with bad CRCs. No directory.
• The loader: MFM s1 (1024 bytes) jumps to 4400h, copies its last 256 bytes down to 4300h, installs an NMI handler, reads cylinder 0 sector 9 into video memory (the title) and cylinder 1 sectors 5-9 to 4400h-57FFh, each status AND 9Ch required to be 0 (ten tries, then Disk Error and a hang). A chained XOR (each byte XORed with the previous result, starting from 0Ah) then decodes the program in place; the loop runs on through memory until it reaches the ROM and drops into 4400h.
• What defeats a copy: no DOS formats 1024-byte MFM program sectors with IDs naming cylinder 93 and a size byte above 3. The decoded program holds no reference to cylinder 93 or to sectors 225 and 141 (its disk routines are table-driven): no check that reads the cylinder-93 IDs was found (unverified: they may be read through the copier's tables, or be a decoy).
• How to recognise it: a Pegasus boot (C3 00 44, Pegasus Research) on 1024-byte MFM sectors with FM IDs naming cylinder 93: this scheme.

Found on (1 disk image in the archive):

• Clone-III Disk Backup Utility — Pegasus Research, 1983

↑ Back to the scheme list

---

S-015: CopyCat's banner and serial track (Bob Bright, 1984)

Protection levels: A (format), D (loader)

• The disk: a MINI-NEWDOS/80 Model III disk (MFM 18 x 256, sectors 0-17, cylinders 0-38; GAT CB 82h; AUTO BASIC RUN"MENU; files include TRAKCESS/CMD, BOOTBAN/, BANNER/CMD, SERIAL/DAT, CHOOSE/SER). Cylinder 39 holds two MFM sectors of 1024 bytes, numbered 69 and 70, whose IDs name cylinders 69 and 70, CRCs good, carrying banner graphics and the text Release 2.05 Serial# xxxxx, Revised July 23,1984 and Version 2.05 Serial# 00001.
• What reads it: the product writes such banner/serial tracks onto the disks it customises ("Each copy of COPYCAT has its own SERIAL NUMBER"). The reader on this changer disk was not traced; the CopyCat boot that reads a banner and serial sector was traced on CopyCat v1.0 (below).
• The CopyCat boot (traced on an original CopyCat v1.0, serial 01975): cylinder 0 MFM sector 1 is a 1024-byte boot sector. It points the NMI vector at its own handler and reads every sector with both the track and the sector register set to 69 (45h), so only IDs naming cylinder 69, sector 69 match. The handler returns to the loader on a normal completion or on Record Not Found, and otherwise prints Disk drive time out. Reboot COPYCAT. and wipes memory. The loader reads cylinder 0's sector 69 (the program, XOR 53h), cylinder 2's sector 69 straight into video memory (the banner), and steps to cylinder 15, which holds two 1024-byte sectors both numbered 69: one carries the banner with the serial field xxxxx, the other the serial 01975. It reads sector 69 there twice, with a memory-size probe between the reads, keeps the serial bytes of the first read and fails if the second read returns the same bytes, so both physical sectors must exist; it then compares the serial on screen with one kept, encoded, in the loader. The program follows from sectors 69 on cylinders 13, 20, 11, 21, 31 and 22, read back and forth with every status AND 1Ch required to be 0, and is decoded with XOR 69h. On failure it seeks back and forth and jumps into a loop that fills memory with FFh.
• Decoys: the other odd tracks of that disk (F8 IDs naming the next cylinder, 128-byte sectors whose IDs name cylinder 7, bad IDs, mixed FM and MFM) are not read by this boot path (decoys or copier test tracks, unverified). A hacked CopyCat 2 v2.05 has the same layout, cylinder 15 included.
• What defeats a copy: no DOS formats 1024-byte sectors with out-of-range numbers and foreign cylinder IDs; a DOS BACKUP copies cylinders 0-38 (or 0-39 in its own format) and loses the track.
• How to recognise it: a CopyCat disk with a final track of 1024-byte sectors numbered from 69 whose IDs repeat the sector number as the cylinder: this scheme.

Further findings:

• CopyCat v1.0 (Model III)original and CopyCat 2 v2.05 are built from sectors 69 and 105 (512/1024-byte MFM, ID cylinders 69/105) on most cylinders plus scrambled 128-byte tracks, the banner/serial in cyl 15 s69: the same family as the v2.05 cylinder-39 track, [Self Booting][Special Format][Copy Protected]; CopyCat v2.05 Customizer (NEWDOS/80 disk with the cyl 39 69/70 track) takes [Copy Protected] as the Banner and Serial Number Changer.

Found on (4 disk images in the archive):

• CopyCat 2 v2.05 — Omnisoft Research, 1984
• CopyCat Banner and Serial Number Changer — Bob Bright
• CopyCat v1.0 — Omnisoft Research, 1983
• CopyCat v2.05 Customizer — Bill Bright

↑ Back to the scheme list

---

S-016: Infocom's Model I loader: F9 data marks required (1982-83)

Protection levels: A (format), D (loader)

• The disk: FM, one side, 35 cylinders of ten 256-byte sectors numbered 0-9, every sector with an F9 data mark (the 1771's user-defined mark); all CRCs good. No directory any DOS uses (Enchanter's cylinder 17 holds a stub GAT HGFJ with BOOT/SYS and DIR/SYS only).
• The check (cyl 0 s0 at 4200h): the loader reads cylinder 0 from sector 1 on with command 88h (37ECh) into 4300h and up; after each sector it tests the status (42A3h-42ACh):

  LD   A,(HL)     ; status
  AND  1CH        ; record-not-found / CRC / lost data
  RET  NZ         ; error: read again
  LD   A,(HL)
  AND  60H        ; record-type bits
  CP   40H        ; 40h = F9 mark
  RET             ; Z only for F9

  
  and re-reads until it gets Z: a sector written with FB, FA or F8 never passes.
• What defeats a copy: no 179x writes F9 (the Model III and the doublers write only F8 and FB), and no DOS formats with it; a Model I copier that rewrites the marks as FB leaves a disk that hangs at boot.
• How to recognise it: a Model I disk whose every sector carries an F9 mark, with a boot sector testing AND 60h / CP 40h: this scheme. Other Infocom Model I releases should be checked for it.

Further findings:

• Infidel (1983)(Infocom)(Model I)original has the Infocom loader with the F9 check (42A3h: AND 1Ch / RET NZ / AND 60h / CP 40h) and F9 marks on cylinders 0-2 and 27-34 (3-26 FB; the loader reads 28 sectors from cyl 0 s2); has F9 marks on cylinders 6-34 but a TRSDOS 2.3 boot sector: [Special Format][Copy Protected] without [Self Booting], as Deadline.
• 27 Infocom Model I images (Planetfall, Starcross, Suspended, Witness, Zork I, II and III): F9 marks on the game tracks; where the boot sector is the Infocom loader with the AND 60h / CP 40h test, [Self Booting][Special Format][Copy Protected]; copies whose boot sector is TRSDOS 2.3's or zero-filled take [Special Format][Copy Protected] only. Sorcerer Rel 4 has no F9 check: [Self Booting][Special Format].

Found on (33 disk images in the archive):

• Deadline — Infocom, 1982
• Enchanter — Infocom, 1983
• Infidel — Infocom, 1983
• Planetfall — Infocom, 1983
• Starcross — Infocom, 1982
• Suspended — Infocom, 1983
• Witness — Infocom, 1983
• Zork 2 The Wizard of Frobozz — Infocom, 1981
• Zork I The Great Underground Empire — Infocom, 1980
• Zork II The Wizard of Frobozz — Infocom, 1981
• Zork III The Dungeon Master — Infocom, 1982

↑ Back to the scheme list

---

S-017: Microsoft's Olympic Decathlon: fake ID cylinders and odd sector numbers (Timothy W. Smith, 1980)

Protection levels: A (format), D (loader)

• The disk: FM, F9 marks; every track holds sector 0 and nine odd-numbered sectors 119 127 117 125 115 123 113 121 111 (in that order); cylinder 0's IDs name cylinder 0, cylinder 1's name 127, cylinder 2's 125, and so on down by two per cylinder. All CRCs good. No directory.
• The loader (cyl 0 s0 copies 228 bytes to 7F00h): keeps a "fake cylinder" in 7FE0h (AND 7Eh / DEC A / AND 7Fh), writes it to the FDC track register (37EDh) before each step (commands 43h/63h, stepping without verify), so the 1771's Read Sector compares the ID's cylinder byte with the fake value; the sector numbers are computed (ADD 8 / OR 81h / CP F7h / SUB 12h). It loads 50 sectors to 4600h and jumps to 7400h. Status is tested only for errors (AND 1Ch).
• What defeats a copy: a DOS BACKUP or sector copier writes true cylinder numbers and standard sector numbers; the loader then finds no matching ID.
• How to recognise it: a Microsoft boot that relocates to 7F00h, on tracks whose IDs carry descending odd cylinder numbers from 127: this scheme.

Further findings:

• seven Olympic Decathalon images (the archive's spelling) carry the scheme: fake ID cylinders, odd sector numbers 111-127, cylinder-0 IDs in the 7C-7F range, F9 marks.
• Colossal Cave Adventure v1.0 and v1.1 (Microsoft - Softwin, 1979; 18 images in three zips) carry the Decathlon layout (sector 0 and odd sectors 111-127 in varying order, ID cylinders 127 down by 2, F9, F8, FA or FB marks): [Self Booting][Special Format][Copy Protected]. v1.0 (standard tracks) and v1.1 (patched boot on a NEWDOS/80 directory) have no layout.

Found on (26 disk images in the archive):

• Colossal Cave Adventure v1.0 — Microsoft / Softwin, 1979
• Colossal Cave Adventure v1.1 — Softwin, 1979
• Decathalon — Microsoft, 1980
• Olympic Decathalon — Timothy Smith, 1980

↑ Back to the scheme list

---

S-018: Cogito's Frogger: sectors 100-109 and a one-time backup (Sega / Cogito, 1983-85)

Protection levels: A (format), C (file system), D (loader)

• The disk: cylinder 0: FM sectors 0 and 100-104, plus MFM sector 1 (Model III boot); cylinders 1-10: FM ten 256-byte sectors numbered 100-109; on most copies cylinder 1's IDs name cylinder 2. Nothing after cylinder 10. All CRCs good. No directory.
• The loaders: FM s0 (Model I, 37ECh) and MFM s1 (Model III, selects FM with OUT F4,01, NMI-driven reads) do the same: read cyl 0 sectors 100-104 to EC00h, seek to cylinder 2 with a Seek command (track register 2), read sectors 100-109 to E200h and jump to E200h. The module there tells the machines apart by ROM 0125h (LD A,(0125h) / CP 49h) and drives 37ECh or ports F0-F4 accordingly: both boot paths run the game.
• The menu (E208h): L plays, R and B (backup). Before showing it the module tests the first byte of its own cylinder 2 sector 105 (E700h): LD A,(E700h) / CP C9h; if it is C9h it blanks the backup line, and B is refused (E24C: LD A,(E700h) / CP C9h / JR Z,E22Eh).
• The backup (E6A7h, from cyl 2 s105): asks for confirmation, copies the disk to a blank formatted disk (it first checks that the target sector holds E5h filler: LD A,E5h / CP (HL) over 256 bytes), then fills a buffer with C9h (E758: LD HL,ED00h / LD (HL),C9h / LDIR) and writes it over sector 105 of cylinders 1 and 2 of the master, its own code. From then on the master plays but refuses B: one backup per disk.
• Cylinder 1: when the routine works on cylinder 1 it sets the track register to 2 (E715: CP 01h / JR NZ / INC A / LD (37EDh),A / OUT (F1h),A), so the IDs naming cylinder 2 on cylinder 1 are the ones it reads and writes there: the cylinder is used by the backup, not a decoy. Its contents differ from cylinder 2's.
• Copies: of the archive's 13 Frogger images, eight hold C9h in sector 105 of cylinders 1 and 2 (their one backup has been made) and five still hold the backup routine. Cylinder 4 sector 100 differs on every copy (likely the high-score table, written back: unverified).
• What defeats a copy: no DOS formats sectors numbered 100-109; a sector copier that cannot write them loses the game. The module issues no Read Address or Read Track: no further check was found.
• The boot sectors carry a duplication date (06/27/84, 07/20/84, 12/30/84, 01/22/85, 01/24/85).
• How to recognise it: Cogito loaders reading sectors 100-104 on cylinder 0 and 100-109 after a seek to cylinder 2: this scheme.

Further findings:

• Game Pack Three: Meteor Mission 2 and Cosmic Fighter (Cogito - Tandy, RS26-1923) has the Frogger layout and loaders (cyl 0 FM s0, sectors 100-104 and MFM s1; cylinders 1-13 numbered 100-109, cylinder 1 IDs naming cylinder 2; the module tests ROM 0125h): [Dual Boot][Self Booting][Special Format][Copy Protected]; boot sectors dated 09/28/83 and 10/03/83.
• 18 Zaxxon images (Zaxxon and Zaxxon v1.0) have the Frogger layout (cylinders 1-13 numbered 100-109, cylinder-1 IDs naming cylinder 2); the module at c1/c2 s106 tests ROM 0125h (LD A,(0125h) / CP 49h) to choose the Model I or Model III routines.
• Game Pack Two: Defense Command and Stellar Escort (Cogito - Tandy, RS26-1926, 8 images) and another Game Pack Three image: the Frogger layout on cylinders 1-26 with both loaders (dated 10/03/83 and 09/28/83): [Dual Boot][Self Booting][Special Format][Copy Protected]; three are named (Model I).

Found on (40 disk images in the archive):

• Frogger — Sega-Cogito-RS, 1983
• Game Pack Three Meteor Mission 2 and Cosmic Fighter — Cogito Software Co / Tandy, 1983
• Game Pack Three Meteor Mission 2 and Cosmic Fighter v1.00.00 — Cogito Software Co / Tandy, 1983
• Game Pack Two Defense Command and Stellar Escort v1.00.00 — Cogito Software Co / Tandy, 1983
• Zaxxon — Sega / Cogito, 1983
• Zaxxon v1.0 — Sega, 1983

↑ Back to the scheme list

---

S-019: The Bottom Shelf's CRAS security disk (1979)

Protection levels: A (format), D (loader)

• The disk: FM, one side, 35 cylinders; no boot sector (cyl 0 s0 E5 fill), no directory. Cylinders 5, 13 and 27 each hold ten 128-byte sectors numbered 116 70 130 67 193 46 244 117 54 115 (in that order) whose IDs name cylinder 63; every other cylinder is blank FM 10 x 256 with E5 fill. Every 128-byte sector holds 128 x 45h (E). All CRCs good.
• The check: SECU/CMD on the program disk (Info Cras, TRSDOS 2.3, AUTO SECU; loads B000h-B8CDh, entry B000h) asks for the security diskette in drive 0 and reads it:
  • a table at B257h lists the cylinders 05h, 0Dh, 1Bh (# ends it), one at B249h the sector numbers 74h 46h 82h 43h C1h 2Eh F4h 75h 36h 73h (the IDs' own order);
  • for each cylinder it makes three reads, taking the next sector number from the list each time (B297h). The read (B839h) fills the buffer at A500h with spaces, seeks (1Bh) to the cylinder, loads the track register with 3Fh so that only IDs naming cylinder 63 match, issues Read Sector 88h and steps back to cylinder 0:

    B866  LD   A,(B254h)     ; cylinder from the table
    B869  LD   (37EFh),A
    B86F  LD   (HL),1Bh      ; Seek
    B87F  LD   (37EEh),A     ; sector from the list
    B882  LD   A,3Fh
    B884  LD   (37EDh),A     ; track register = 63
    B887  LD   (HL),88h      ; Read Sector

  • status: not ready (bit 7) is retried up to 3 times with a message, Record Not Found (bit 4) up to 2, CRC error (bit 3) up to 10;
  • a read with status 0 is tested byte by byte: all 128 bytes must be 45h (B069: LD HL,A500h / LD B,80h / LD A,45h / CP (HL) / CALL NZ,B0F9h, B0F9h counting the misses). The first sector that passes ends the check: SECU asks for the program disk again (INSERT PROGRAM DISK) and returns to the DOS, which goes on to the BASIC program.
• On failure (all nine reads fail): it fills the screen and memory from 3C00h with 42h and clears memory from B0B3h to FFFFh, SECU's own code included: the machine is left hung.
• The archive's security disk is a reconstruction (tagged [Reconstructed Security Disk]) and meets the check.
• What defeats a copy: no DOS formats 128-byte sectors with IDs naming cylinder 63 and sector numbers up to 244; a DOS BACKUP of the security disk fails or writes standard tracks, and SECU then finds no sector.
• How to recognise it: a Bottom Shelf disk set whose program runs SECU/CMD at boot, with a second disk holding 128-byte sectors whose IDs name cylinder 63: this scheme.

Found on (2 disk images in the archive):

• Info Cras — The Bottom Shelf

↑ Back to the scheme list

---

S-020: Med Systems' Knossos production disk: IDs without data fields (Simon L Smith, 1981)

Protection levels: A (format)

• The disk: FM, one side; cylinders 0-4 hold ten 256-byte sectors numbered 0-9 with FB marks, except that sector 5 of each is an ID with no data field (the same track position on every cylinder); cylinders 5-34 unformatted. No directory.
• The loader (cyl 0 s0 at 4200h) steps in and reads sectors 0-4 and 6-9 of cylinders 1-4 to 8000h-A3FFh with its own 37ECh routine (command 8Ch; any error goes to the ROM) and jumps to 8009h; it skips sector 5. The loaded game has no disk access at all, and cylinder 0 beyond the boot sector is not read.
• What defeats a copy: a DOS BACKUP or sector copier stops on (or rewrites) the dataless sector 5 IDs; no DOS formats an ID without its data field. Nothing checks them: the layout only stops copiers, and a copy that skips sector 5 still runs.
• How to recognise it: a Med Systems self-booting disk whose every used track carries one ID without a data field at the same position: this scheme.

Found on (1 disk image in the archive):

• Knossos — Simon L Smith / Med Systems Software, 1981

↑ Back to the scheme list

---

S-021: Instant Software's Master Reversi: the C D Heath loader (1981)

Protection levels: A (format), B (controller), D (loader)

• The disk: FM, one side, no directory. Cylinder 0 holds duplicate sector numbers in mixed sizes (128, 256 and 512 bytes); cylinders 1-4 hold sixteen 128-byte FM sectors numbered 32-47; cylinders 5-10 are standard FM 10 x 256; 11-34 unformatted.
• A sector read over the stack: the 512-byte boot sector keeps the ROM's registers and the ROM's boot stack (407Dh). It reads cylinder 0 sector 2, 128 bytes, into 4000h-407Fh, right over its own stack: the return addresses that sector plants (4345h, then 431Ch) take over two RETs and send the loader into its next stage.
• Code in the gap: that stage switches its read routine to Read Track (E4h), reads cylinder 0 as a raw track to 4400h and returns to 4500h, byte 256 of the raw track, which lies in the gap between sector 1's data and sector 2's ID. The code the duplicator wrote there clears the upper memory and starts the load: cylinders 1-4, sectors 32-47 in a 3-step interleave, 60 sectors from 4400h on, then the game at 5350h. A failed read prints *** DISK ERROR ***, waits for a key and halts.
• No further check: a write-and-read-back routine in the loader's jump table is not called on the way into the game.
• The copies in the archive: one copy was imaged over two revolutions but keeps the gap code at its place and loads; another has a garbled cylinder 0 and resets at boot (damage).
• What defeats a copy: a sector copier cannot rebuild cylinder 0: the duplicate numbers in three sizes, the sector that overlays the stack and above all the code in the gap at its exact place in the raw track. No DOS formats sixteen 128-byte sectors numbered 32-47 either.
• How to recognise it: an Instant Software / C D Heath FM s0 loader with LD A,E4h and 128-byte FM sectors 32-47 on the cylinders after 0: this scheme.

Found on (3 disk images in the archive):

• Master Reversi — C D Heath / Instant Software, 1981

↑ Back to the scheme list

---

S-022: MyChess: sector numbers in steps of 16 (Computer Services / Software Protection Systems, 1980)

Protection levels: A (format)

• The disk: FM, one side, no directory; the disk carries COPYWRITE (C) 1980 SOFTWARE PROTECTION SYSTEMS. Every sector is renumbered to a multiple of 16: cylinder 0 0, 16 ... 144; cylinders 1-34 16 ... 160. All CRCs good.
• The loader: it seeks before every read, reads each sector twice and compares the two reads byte for byte; after five failed tries it prints DISK ERROR, wipes memory and hangs. It loads cylinder 0 sector 144, cylinders 2-13 (sectors 160 down to 16) and cylinder 14 sector 160 to 4500h on, prints the serial line and SECURDOS COPYWRITE (C) 1980 SOFTWARE PROTECTION SYSTEMS, and starts the game. Nothing else on the disk is tested: the numbering is the whole protection. On one original, cylinder 1 holds a single stray ID with a bad CRC that nothing reads.
• The publisher's duplicator: one of the original disks in the archive is not the game at all. Its boot runs a copier (INSERT BLANK DISK, FORMATTING, VERIFYING, INSERT MYCHESS, INSERT FORMATTED DISK, BACKUP COMPLETE (RESET)) that formats a blank disk in the same multiple-of-16 numbering and copies a MyChess disk onto it: the tool that made the protected copies.
• What defeats a copy: a DOS BACKUP writes sectors 0-9; the loader then finds none of its sectors.
• How to recognise it: the Software Protection Systems copyright with every ID a multiple of 16: this scheme. Software Protection Systems may have sold the same scheme to other publishers: check other titles for the string.

Found on (8 disk images in the archive):

• MyChess — Computer Services, 1980

↑ Back to the scheme list

---

S-023: Ritam's Monty Plays Scrabble v1.1: renumbered sectors with deleted-data marks (Model I, 1981)

Protection levels: A (format)

• The disk: FM, one side, no directory. Every sector is numbered 16-25 (cylinder 0: 0 and 17-25) and written with FA (deleted) data marks throughout.
• The loader: the boot sector moves itself to high memory and uses the Level II BASIC ROM. It prints LOADING and reads cylinders 23-34, sectors 16-25 (it adds 16 to each sector number), into memory as a BASIC program, then runs it. After each read it tests the status with AND 5Ch: record not found, CRC error, lost data and the F9/F8 record type. The FA record-type bit is not tested, so the deleted-data marks are written but never checked; a failed read is retried without end.
• A key test: unless H, I, J and K are held down together while it loads, the loader patches one of the ROM's RAM vectors (RST 28h); holding the four keys skips the patch, by its look a developer's way in.
• The game: the BASIC program carries its own disk driver with the same numbering and a formatter for data disks; no check of the disk was found.
• Not the same as Monty Plays Scrabble v1.0 and Monty Plays Monopoly (Model III TRSDOS 1.3 disks with the limited-backup counter).
• What defeats a copy: no DOS numbers sectors 16-25; the FA marks alone would not stop a copy that keeps the numbering.
• How to recognise it: a Ritam Model I loader with FA-marked sectors 16-25: this scheme.

Found on (1 disk image in the archive):

• Monty Plays Scrabble v1.1 — Ritam, 1981

↑ Back to the scheme list

---

S-024: Kim Watt's Super Utility and PowerTool loader tracks (1981-84)

Protection levels: A (format), D (loader)

Two generations of the protection are in the archive, on Super Utility (v2.1c, + v2.1, + v2.2P, + v2.2z, Plus v3.0, + v3.1a, + v3.2, 4/4P) and PowerTool (v0.3, v1.0, v1.00.00). Every loader build in the archive was traced from the boot sector to the check.

Generation 1: Super Utility v2.1c and Super Utility+ v2.x (1981-82).

• The disk: cylinder 0 FM s0 (Model I) and MFM s1 (Model III) boot sectors among FM 0, 6, 2, 8, 4, 10 / MFM 1, 5, 9, 3, 7, 11; cylinder 3 the loader track, FM sectors 0, 2, 4, 6, 8, 10 (and MFM 1, 3, 5 ... 11 on the dual-format copies; the "4 BOOT loaders on this track" disk); cylinder 4: the same IDs, every one with a bad ID CRC; cylinder 5: the same IDs, every data field with a bad CRC; the program follows on cylinder 6 on.
• The loader (Super Utility+ v2.2z, FM s0 at 4200h): CALL 01C9h, then a /CMD-format record reader (type 1 load, type 2 entry, others skipped) fed from cylinder 3 sectors 0, 2 ... 10 (INC E / INC E, next cylinder after sector 10; Seek 1Bh then Read Sector 88h, status AND 9Fh). It loads 3E40h-3FFFh and 5200h-5334h and enters at 5208h.
• The check (5208h, run before the rest of the program is loaded):

  5208  CALL 529Fh          ; screen, memory test 4000h-51FFh and 5300h-FEFFh
  520B  LD   DE,0400h       ; D = cylinder 4, E = sector 0
  5211  CALL 427Fh          ; seek and Read Sector, A = status AND 9Fh
  5214  AND  18h
  5216  CP   18h            ; Record Not Found + CRC error: the bad ID
  5218  JP   NZ,42BFh       ; anything else: error stop
  521B  INC  D              ; cylinder 5
  521C  CALL 427Fh
  521F  AND  18h
  5221  CP   08h            ; CRC error in the data field
  5223  JP   NZ,42BFh
  5226  INC  D              ; cylinder 6: go on loading

  
  After it, the code copies a 20-byte routine to 4300h, sets the RST vectors at 0000h-0038h to jumps into 4000h-4015h and resumes the loader at 4206h.
• What defeats a copy: a copier that writes cylinder 4 with good IDs or cylinder 5 with good CRCs makes both tests fail; a DOS cannot format the even-numbered loader track with mixed densities either.

Generation 2: Super Utility+ v3.0, v3.1a, v3.2, Super Utility 4/4P, PowerTool v0.3 and v1.0 (1982-84). The main build, described first, is on PowerTool v1.0 and v1.00.00, the Super Utility 3.1a Copy Utility and Creator disks, Super Utility+ v3.0 and Super Utility + v3.2; three variants follow it.

• The disk: cylinder 1 mixed density: FM 512-byte sectors 32, 48, 37 and MFM 512-byte sectors 64, 80, 69, every ID with cylinder, side and sector bytes equal (FE 20 20 20 02); the check cylinders (3 and 5 on the traced builds and on 4/4P; 2 on Super Utility+ v3.1a, one serial-numbered Super Utility Plus v3.0 and PowerTool v0.3): FM 512-byte sectors 17 and 34 and MFM 51 and 68, with sectors 17 and 51 carrying a bad data CRC (stored FFFFh) and sectors 34 and 68 a bad ID CRC; cylinder 4 on the traced builds: IDs naming cylinder 1 with side 1 (and on some a second ID naming 0), no data; from cylinder 6 on (4 on the cylinder-2 builds), dual-format data tracks: FM sectors 64, 72 ... 104 and MFM sectors 64, 72 ... 104 on every track, 256 bytes each. Some copies carry a track of random IDs (bad CRCs, no data) on cylinder 3 instead: a decoy, never read.
• Stage 1, the boot sector (FM s0 at 4200h; MFM s1 at 4300h is the same code for ports F0h-F4h): LD SP,42F0h and a table of POP values. It restores, seeks to cylinder 4 and issues Read Address (C0h) until it gets an ID whose cylinder is not 0; it ORs that ID's cylinder, side, sector and size bytes (LD A,(HL) / INC HL / OR (HL) x3) and stores the result (01h) at 4200h: that byte becomes the cylinder it seeks next and the step count stage 2 uses. On cylinder 1 it reads three sectors with the track register set to the ID's own cylinder byte (FM: LD DE,2020h, 2525h, 3030h; MFM: 4040h, 4545h, 5050h) and Read Sector 88h, status 0 required (FB marks), ten tries, then HALT. The sector data is nibble-encoded and stored backwards: each memory byte is built from the low halves of two disk bytes (LD A,(37EFh) / RRD, twice) and the pointer runs down (DEC L), so a 512-byte sector fills 256 bytes from the top: 4400h, 44FFh, 44FEh ... 4401h. It ends with RET into 4400h.
• Stage 2, the check (4400h, from cylinder 1): clears the screen, tests memory 4A00h-FFFFh (Disk Memory Data Error), then:
  • Read Address on cylinder 1: the OR of the ID bytes must be 20h-30h (CP 20h / JP C,45B3h / CP 31h / JP NC,45B3h): the head must be on the loader track;
  • four steps in (each the step count from 4200h), then, on the check cylinder, Read Sector 34 must end with status 18h (Record Not Found with CRC error: the bad ID) and Read Sector 17 with status 08h (data CRC error; the data still arrives): LD E,22h / CALL 4501h / CP 18h / JR NZ,45B3h, then LD E,11h / ... / CP 08h / JR NZ,45B3h (Model III: sectors 68 and 51, MFM, LD E,44h / LD E,33h);
  • sector 17's data must begin with the 9-byte signature zE]OX~eef (compared with 462Ch); its next 16 bytes, XOR 24h, are the program's date text (PowerTool v1.00.00: August 24, 1983), copied to EFF0h; the next two bytes, XOR 23h, form a key that goes into the I register (LD I,A; C0h on PowerTool v1.00.00, the negated byte sum of the date text);
  • one step in, Read Address again: the OR must be 40h-68h (the data tracks);
  • then the stream: six sectors per track (64 ... 104 by 8), each page reversed, read as records FFFF addr count key data... sum (each byte XOR its record's key, two running sums checked) and 0000 entry sum; PowerTool v1.00.00 loads 3C00h-3FFFh (the title screen) and 5200h-EA2Dh and enters at EA1Fh, which moves 5200h-EA1Eh down to 4000h and jumps to C600h;
  • on failure: the Model I restores the drive and HALTs; the Model III restores and reboots (RST 0).
• The run-time check (PowerTool v1.00.00): the start-up code at C658h copies the 16 date bytes from EFF0h to 4505h, clears EFF0h and erases its own 27 bytes (C658h-C672h). The timer-interrupt handler (4440h-44B4h) counts interrupts and every 256th one (about 6 seconds on the Model I): compares 8 bytes at 517Ah with 7341h XOR 21h (a code-integrity test), sums the negated date bytes held at 8336h, and compares the result with the I register: LD A,I / CP C / JR Z,44A9h. On a mismatch it fills 3000h-FFFFh with C7h (RST 0) and reboots. So patching out the boot-time test is not enough: the I register must hold the value that only the bad-CRC sector 17 supplies.
• The cylinder-2 build (Super Utility+ v3.1a and one Super Utility Plus v3.0): the boot sector seeks straight to cylinder 1 (no Read Address) and reads FM 32, 37 and 48 (MFM 64, 69 and 80 on the Model III path) with the track register set to the sector number, nibble-encoded and reversed as above. Stage 2: Read Address on cylinder 1, one step in, then on cylinder 2 sector 34 must end with status 18h and sector 17 with 08h (Model III: 68 and 51); sector 17 must begin with a 16-byte signature (Super Utility + in plain text on one build, encoded on the other), the next 16 bytes XOR 24h are the date, and two bytes XOR 23h, taken as two nibbles, form the key for the I register. The data tracks start on cylinder 4.
• PowerTool v0.3 (1982): the boot sector seeks to cylinder 1 and reads FM 32 and 64 (track register 20h and 40h), nibble-encoded, to 4500h. Stage 2 makes the same status tests on cylinder 2 and requires sector 17 to begin with PowerTool in plain text; there is no key and no I register in this build. The data tracks use five sectors each (80, 88 ... 112). On failure it restores the drive and starts the check again, for ever (as read from the code).
• Super Utility 4/4P: the FM sector 0 only prints This disk is for the TRS-80 Model 4/4P ONLY!. The MFM boot sets the Model 4 memory map, takes its step count from a Read Address on cylinder 4 as above and reads MFM 64, 69 and 80 to E400h. Stage 2 tests memory from 0100h, checks the head is on cylinder 1, steps three times and on cylinder 4 repeats a single-density Read Track until an ID mark appears near the start of the track (its purpose is unverified), then on cylinder 5 requires status 18h on sector 68 and 08h on sector 51, a 16-byte signature, the date and the key, as the main build does. On failure it clears the memory map and reboots.
• Cracked copies in the archive: three Super Utility+ v3.1a copies carry the v3.1a loader with the check patched out on both boot paths: the seven bytes that read sector 34 (68) and test for 18h are NOPs, and the CP 08h after the sector 17 (51) read is AND FCh, so a good read passes; their sectors 17 and 51 are ordinary 256-byte sectors holding the signature, date and key. They boot. Three Super Utility+ v2.x copies that boot without the generation-1 error cylinders are cracked too: on one, the check still reads cylinders 4 and 5 but both error jumps are NOPs; on the other two, the check starts at cylinder 5 instead of 4 and both reads and tests are NOPs, so the loader goes straight on to cylinder 6.
• What defeats a copy: no DOS formats mixed-density tracks, IDs naming cylinder 32 on cylinder 1, or a sector with a bad ID CRC beside one with a bad data CRC; a sector copier gives good CRCs (status 00h, not 18h/08h) and loses the key; an emulator that does not return Record Not Found with the CRC bit for a bad ID fails the check.

Both generations:

• Copies without the layout (the Super Utility+ v2.2z Model III loader on standard MFM tracks, 7 images): [Self Booting][Special Format], no protection tag. One copy is a JV3 image that keeps the cylinder-1 sectors in its sector table; one Super Utility + v2.0a image holds only cylinders 0-1 of the layout.
• Boot paths: FM s0 (Model I loader) and MFM s1 (Model III loader) on the Model I/III issues: [Dual Boot]. On Super Utility 4/4P the FM s0 only says the disk is for the Model 4/4P: no [Dual Boot].
• How to recognise it: a Kim Watt Super Utility or PowerTool boot with a mixed-density cylinder 1 (FM 32, 48, 37 / MFM 64, 80, 69), or Super Utility+ v2.x with even-numbered cylinder-3 sectors and a cylinder of bad IDs followed by a cylinder of bad data CRCs: this scheme.

Found on (74 disk images in the archive):

• PowerTool 1.0 Copy Utility v1.0 — Kim Watt, 1983
• PowerTool v0.3 — Kim Watt / Tandy, 1982
• PowerTool v1.0 Verify Utility — Kim Watt, 1983
• PowerTool v1.00.00 — Kim Watt / Tandy, 1983
• Super Utility — Kim Watt / Breeze Computing
• Super Utility + v2.0a — Kim Watt
• Super Utility + v2.1c — Kim Watt / Breeze, 1981
• Super Utility + v2.2P — Kim Watt / Breeze Computing, 1981
• Super Utility + v3.2 — Kim Watt / Breeze Computing, 1983
• Super Utility 3.1a Copy Utility v1.1 - TRS — Kim Watt / Breeze Computing, 1983
• Super Utility 4-4P — Kim Watt / Breeze Computing, 1984
• Super Utility 4-4P Rev 17 — Kim Watt / Breeze Computing, 1984
• Super Utility Plus v3.0 — Breeze, 1983
• Super Utility v2.1c — Kim Watt, 1981
• Super Utility+ 3.1a Creator v1.1 - MAX — Kim Watt, 1983
• Super Utility+ v2.2P — Kim Watt / Breeze Computing, 1981
• Super Utility+ v2.2PIII — Kim Watt, 1981
• Super Utility+ v2.2z — Kim Watt / Breeze Computing, 1981
• Super Utility+ v3.0 — Kim Watt / Breeze Computing, 1983
• Super Utility+ v3.1a — Kim Watt / Breeze QSD, 1983
• Super Utility+ v3.2 — Kim Watt / Breeze Computing, 1983
• SuperUtility 4-4P — Breeze / QSD, 1984
• SuperUtility Plus — Breeze QSD, 1981

↑ Back to the scheme list

---

S-025: Small System Software's RSM3-I: renumbered sectors and ID cylinders (1981)

Protection levels: A (format), D (loader)

• The disk: FM, one side, no directory; boot text (C) JAN 1980 SMALL SYSTEM SOFTWARE. Every track is renumbered 0, 7, 17, 24, 27, 34, 44, 51, 54, 61, and on cylinders 1-34 the ID cylinder numbers differ from the physical ones (cylinder 1 names 27, cylinder 2 names 54, then 81, 108, 7 ...).
• The boot sector begins with the copyright text, which the Z80 executes as harmless instructions until a jump to the real code; a small computed-jump reader then loads cylinder 0 sector 44 to 4400h.
• The loader reads 50 sectors from cylinder 1 on to 4A00h and computes both numbers instead of storing them: the sector for slot n (0-9) is ((n+1) × 1Bh + E5h) AND 3Fh, giving 0, 27, 54, 17, 44, 7, 34, 61, 24, 51, and the value it writes into the track register for cylinder c is ((c+1) × 1Bh + E5h) AND 7Fh. Each read must end with status AND 5Ch = 0 (no Record Not Found, CRC error, lost data or F8/F9 mark); after ten tries it prints DISK ERROR and resets.
• After loading RSM3-I's relocator asks for a start address and relocates the monitor from memory; nothing more is read on the way in. The monitor's own disk commands are tools for the user, not a check.
• What defeats a copy: no DOS writes this numbering or IDs naming another cylinder, so the loader finds none of its sectors on a standard track.
• How to recognise it: a Small System Software loader with the 0, 7, 17 ... 61 numbering: this scheme.

Found on (1 disk image in the archive):

• RSM3-I with Relocator v1.0 — Small System Software, 1981

↑ Back to the scheme list

---

S-026: ICR FutureSoft's QuikPro+: one renumbered cylinder on a DOS disk

Protection levels: A (format), D (loader)

• The disk: an ordinary DOS disk (TRSDOS 1.3 on v3.1, TRSDOS 6 on the Model 4 edition) with one cylinder renumbered 32-49 (MFM, 18 × 256, all E5 filler): cylinder 0 on v3.1, so that disk does not boot, cylinder 1 on the Model 4 edition. A directory entry covers the cylinder, so the DOS never writes there.
• The check: the BASIC programs that start each part of the package open a small data file of 280 decimal numbers, POKE them into the top of memory (FEE8h-FFFFh) and call them with USR0(40):
  • the routine reads sector 40 of cylinder 0 on drive 1, choosing the Model I (memory-mapped) or Model III (port) version from a byte of the ROM;
  • the read must succeed (status AND 9Ch = 0); the routine then returns -1;
  • otherwise BASIC calls a second routine that fills memory from the screen upward with ? and halts;
  • on success a marker is POKEd into the last byte of memory before the main program is run, and the main program refuses to start (it jumps to address 0) if the marker is missing.
  So the original sits in drive 1 while the user's DOS boots in drive 0.
• The Model 4 edition stores its programs as protected (encrypted) Model 4 BASIC and has no such data file; its check of cylinder 1 was not traced (unverified).
• What defeats a copy: a DOS BACKUP writes sectors 1-18 on the renumbered cylinder, and the read of sector 40 fails with Record Not Found.
• How to recognise it: an ICR FutureSoft disk with one cylinder numbered 32-49: this scheme.

Found on (2 disk images in the archive):

• QUIKPRO+II — ICR / FutureSoft, 1987
• QuikPro+II v3.1 — J W Tamargo / ICR Futuresoft, 1981

↑ Back to the scheme list

---

S-027: William Fink's SFinks: renumbered game tracks (1981-83)

Protection levels: A (format), D (loader)

• The disk: a TRSDOS 2.3 / 1.3 boot sector over the game tracks; no DOS directory. The game tracks are renumbered (for example FM 54-63 and 160-169; MFM 179-196, or 54-71 and 160-177) with unformatted cylinders between them.
• The loader (v4.0, Model I): the boot sector is TRSDOS 2.3's, modified. It reads a directory-like table from cylinder 0, then follows a load-module stream through its own read routine (each read must end with status AND 5Ch = 0, else DISK ERROR). The first records it loads, from cylinder 2 sectors 54-61, overwrite the boot sector's own "next sector" code with a jump to a new routine. That routine, written as XOR arithmetic to hide its constants, ends each track when the sector number reaches 170, starts the next one at 160 and takes the next cylinder from a table. So the game comes from cylinder 2 sectors 54-63, one sector of cylinder 0, then cylinders 5-17 sectors 160-169 (another build uses 96-105). There is no other check.
• v3.0 (Model I): the game tracks themselves are numbered 0-9; the loader follows its own list of cylinders (0, 2, 3, 4, 9, 12, 16, 18, 22, 23, 27), and the cylinders between are double-density tracks of E5 filler numbered 179-196 that nothing reads, which stops a single-density copier.
• The Model III edition: its loader reads cylinder 2 and cylinders 5-11 in double density by the 54-71 and 160-177 numbering (status AND 9Ch).
• What defeats a copy: no DOS writes these numbers, and a DOS BACKUP stops at the first unformatted cylinder.
• How to recognise it: a William Fink SFinks disk whose game tracks carry numbers above 50: this scheme.

Found on (8 disk images in the archive):

• SFinks Microcomputer Chess Game v3.0 — William Fink, 1982
• SFinks Microcomputer Chess Game v4.0 — William Fink, 1983
• SFinks Microcomputer Chess v3.0 — William Fink, 1981

↑ Back to the scheme list

---

S-028: Cdex's TRSDOS Training Course: an odd last cylinder (1983)

Protection levels: A (format)

• The disk: an LS-DOS 6.1 system disk whose last cylinder (39) carries sector 255 in place of sector 16 and sector 17 with a data CRC error; every other cylinder is standard.
• What is there: sector 17 holds an eight-digit ASCII serial number (a different one on each disk) followed by E5, behind its bad CRC; the other sectors of the cylinder hold filler. On the first disk a directory entry for a file of 0 sectors reserves the part of cylinder 39 that holds sectors 12-17, so the DOS never allocates it.
• Searched: the course runs under a Pascal runtime (Alcor Systems) whose calls to the DOS are all file and screen calls; it never asks for a sector by number and never touches the controller, and no other file on the disks does except the DOS itself. Nothing found reads sector 255 or sector 17 (unverified for the course's p-code), so the layout works as a trap for the DOS's BACKUP.
• What defeats a copy: no DOS formats sector 255 or writes a bad sector 17; BACKUP stops at cylinder 39 or writes a standard one.
• How to recognise it: a Cdex Model 4 disk with sector 255 on its last cylinder: this scheme.

Found on (6 disk images in the archive):

• TRSDOS Training Course — Cedex Corp, 1983
• TRSDOS Training Course v1.00.00 — Cdex Corporation / Tandy, 1983

↑ Back to the scheme list

---

S-029: Fantastic Software's Talking Adventure I: sector 235 on cylinder 0 (Model I, 1981)

Protection levels: A (format)

• The disk: a Model I TRSDOS 2.3-based system disk (readable directory) whose cylinder 0 carries sector 235 in place of sector 4. The boot sector is TRSDOS 2.3's with Fantastic Software's messages (BAD DISK., DISK ERROR). TRSDOS 2.3 does not need cylinder 0 sector 4 to start, so the disk boots normally.
• What the program does: the DOS loads a small routine that types the start-up commands, then the voice driver and the adventure; every copy in the archive reaches the game's first prompt (What should I do?) without ever reading sector 235 or sector 4. Whether the game looks at the disk later, when saving, was not traced.
• So the protection is a trap for BACKUP: a DOS BACKUP, or a copier that stops on a missing sector, cannot get past cylinder 0; a copier that skips the sector makes a copy that plays. Talking Adventure II (Forbidden City) uses a different scheme, the FunSoft per-track numbering.
• How to recognise it: a Fantastic Software TRSDOS 2.3 disk with sector 235 on cylinder 0: this scheme.

Found on (5 disk images in the archive):

• Talking Adventure I Forbidden Planet — William Demas / Fantastic Software, 1981

↑ Back to the scheme list

---

S-030: Atherton and Dayton's Test Bank System: one unreadable sector (1983)

Protection levels: A (format), D (loader)

• The disk: a TRSDOS 1.3 (Model III) system disk that starts the program automatically, whose cylinder 5 sector 6 is made unreadable. The archive has it restored three ways: a data CRC error, an ID CRC error, and the sector left out (cylinder 5 with 13 IDs).
• The check, the first thing the program does after its title screen, reads three sectors through TRSDOS 1.3's own sector-read routine:

  LD   DE,0505h   ; cylinder 5 sector 5
  CALL 4675h
  JP   NZ,0000h   ; must read
  LD   DE,0506h   ; cylinder 5 sector 6
  LD   A,01h
  LD   (467Dh),A  ; DOS retry count 1 for this read
  CALL 4675h
  LD   A,09h
  LD   (467Dh),A  ; retry count back to 9
  JP   Z,0000h    ; must FAIL
  LD   DE,0507h   ; cylinder 5 sector 7
  CALL 4675h
  JP   Z,57ADh    ; must read: start the program
  JP   0000h

  
  Any failure of sector 6 will do, so all three restored copies pass; a good sector 6, or a failure on 5 or 7, reboots the machine.
• A cracked copy in circulation changes only the first instruction into a jump straight to the program, skipping the three reads.
• What defeats a copy: a DOS BACKUP writes a good sector 6.
• How to recognise it: a Test Bank System disk with cylinder 5 sector 6 unreadable: this scheme.

Found on (3 disk images in the archive):

• Test Bank System v3.01 — Atherton and Dayton Advanced Technology Applications, 1983

↑ Back to the scheme list

---

S-031: Wittsoft's Vivace! Compiler: scattered IDs on cylinders 37-39 (1984)

Protection levels: A (format), D (loader)

• The disk: a TRSDOS 1.3 (Model III) system disk whose cylinders 37-39 carry 36 MFM IDs each where a DOS writes 18: sectors 1-18 plus sector 0 and seventeen others with scattered numbers (121, 238, 239, 233, 112, 199, 73, 37, 89, 240, 181, 78 ...). In the first half of each track the IDs stand only 85 bytes apart, inside one another's data fields: each 256-byte sector reads straight through the next IDs, and almost every one still has a good CRC.
• What is stored there: the compiler's overlay modules, which the DOS reads like any file, but which are encrypted.
• The check: the compiler carries, written as a line of decimal numbers, a machine-code module that takes over its overlay loader. At the first byte of every sector read from cylinder 37 or above it decrypts the sector:
  • from the sector's number it picks a first hidden sector (sector 0 for the first, then numbers handed on from the previous step through the Z80's I register or kept in the routine's own code);
  • it reads that hidden sector with its own controller routine (five tries), takes one of its bytes as the number of a second hidden sector and another as the next value for the I register;
  • it reads the second hidden sector and XORs the whole 256-byte sector buffer with it;
  • a failed read ends with a DOS error.
  Decrypting the two overlays this way gives valid program modules; the three hidden IDs with bad CRCs are never read.
• The disk initializer on the same disk copies TRSDOS 1.3's system files from the user's own TRSDOS disk onto the product disk: it was sold without the DOS. It never touches cylinders 37-39.
• What defeats a copy: a DOS BACKUP writes 18 standard sectors on those cylinders; the hidden sectors are lost and the overlays cannot be decrypted.
• How to recognise it: a Wittsoft disk with over-packed cylinders 37-39: this scheme.

Found on (1 disk image in the archive):

• Vivace! Compiler v3.0 — Lou Witt / Wittsoft, 1984

↑ Back to the scheme list

---

S-032: TanData's Parcel Manifest System: an extra ID mark on every data cylinder (1984)

Protection levels: A (format)

• The disk: CP/M; cylinder 0 is the boot (MFM, 18 × 256), cylinders 1-39 each hold eight 512-byte MFM sectors 1-8.
• The extra mark: right after the index gap of every data cylinder stands an ID address mark with no ID behind it: A1 A1 A1 FE followed only by gap bytes 4Eh, so the controller reads an ID of cylinder 78, sector 78, size code 78 with a bad CRC. A short stray data field follows (a few bytes copied from the track's own data), then sector 1's real ID.
• Searched: the system reads its sectors by number and uses Read Address only to find the next good ID; nothing on the disk asks for sector 78 or looks at the mark. It may be the mark of the duplicator's track writer rather than a deliberate layout; the tag rests on the rule that an extra ID with a deliberate CRC error on the product's tracks counts.
• What defeats a copy: a copier writes the eight data sectors only.
• How to recognise it: a TanData CP/M disk with an empty ID mark (all 4Eh) before sector 1 on its data cylinders: this scheme.

Found on (1 disk image in the archive):

• Parcel Manifest System — TanData Corporation, 1984

↑ Back to the scheme list

---

S-033: CopyCat 4: the program in sectors numbered 153 (Larry Nedry - Omnisoft Research, 1985-86)

Protection levels: A (format), D (loader)

• The disk: cylinder 0 MFM sector 1 (the Model III/4 boot) plus sector 153 (128 bytes, ID cylinder 153); cylinders 1-2 one 128-byte sector 153; from cylinder 4 every even cylinder holds one 1024-byte MFM sector numbered 153 whose ID names cylinder 153, the odd cylinders are unformatted. The release, serial and assembly date sit in cyl 4 s153 (Release 4.18 Serial #32531, Assembled May 23, 1986). Where present, FM s0 only says CopyCat 4.1 will only run on TRS-80 Models 3, 4, 4P and 4D (not a boot).
• The loader (MFM s1 at 4300h): OUT (E4h),0, OUT (ECh),48h, OUT (84h),01h (Model 4 memory map), NMI vector at 0066h set to a handler (43A6h). Its read routine (4366h) writes 99h (153) into both the track and the sector register (LD A,99h / OUT (F1h),A / OUT (F2h),A), selects MFM (OUT (F4h),81h) and issues Read Sector 80h, taking the bytes with INI under wait states. The read ends in the NMI handler (43A6h), which reads the status into E and returns to the loader when port E4h bit 6 is set or the status shows Record Not Found (bit 4), and reboots (RST 0) otherwise; the loader then requires AND 1Ch of the returned value to be 0, or reboots.
  • It reads cyl 0 s153 to 4500h: the configuration block (two 16-byte copies; byte 4508h is the step rate used for every seek).
  • It seeks two cylinders on (OUT (F1h),0 / OUT (F3h),2, Seek with the stored rate) and reads s153 to 4700h. If the first byte read is not 40h it is on a 96-tpi drive (two steps reached only the 48-tpi disk's cylinder 1): it seeks two more and doubles the step to 4 for the rest (LD (43CBh),4). On a 48-tpi drive cylinder 1 is never read; it holds E5 filler on most copies and a data field with a bad CRC on others.
  • Then, 18 times (v4.1 of 1985, v4.15, v4.16) or 7 times (v4.18 and the 1986 v4.1): seek two cylinders on and read sector 153 (1024 bytes) into 4700h upward, and jump to 56ADh. The 18-read builds find sector 153 only on cylinders 4-34 (16 sectors, 4700h-86FFh) on every image, the 40-cylinder one included: the last two reads find nothing, and the handler's Record Not Found path lets that pass (as read from the code; how port E4h bit 6 behaves there is unverified).
• No further check: the program's own CP 18h / CP 08h tests belong to its copier's analysis of other disks; it rewrites its configuration (cyl 0 s153, Write Sector A0h with the same 99h registers) when the user saves settings.
• Why it counts: no DOS formats sectors numbered 153 with ID cylinder 153, and the program exists only there (as S-015). A copy with standard IDs loads nothing (Record Not Found on every read) and the jump to 56ADh runs whatever is in memory.
• Copies: 18 even cylinders (v4.15/v4.16) or 9 (v4.18); one 1986 copy carries MS-DOS data on side 1 (a user's leftover).
• How to recognise it: MFM sector 153 with ID cylinder 153 on cylinder 4: this scheme.

Found on (22 disk images in the archive):

• CopyCat 4 v4.1 — Larry Nedry / Omnisoft Research, 1985
• CopyCat 4 v4.15 — Larry Nedry / Omnisoft Research, 1985
• CopyCat 4 v4.16 — Larry Nedry / Omnisoft Research, 1985
• CopyCat 4 v4.18 — Larry Nedry / Omnisoft Research, 1986
• CopyCat 4.16 — Larry Nedry / Omnisoft Research, 1985
• CopyCat v4.1 — Omnisoft Research, 1985

↑ Back to the scheme list

---

S-034: HyperZap: mixed-density dual-format tracks (M J Gingell - Hypersoft, 1983-85)

Protection levels: A (format)

• The disk: cylinder 0 FM s0 (Model I loader 18 06 00 55 00 55 0C 06) and MFM s1 (Model III loader 18 06 00 56 00 56); cylinders 1-12 each hold FM sectors 6-1 and MFM sectors 6-1 on the same track (FM first on v3.2c, MFM first on v3.2e and v3.2g), 256 bytes each; cylinders 13-25 two 1024-byte FM sectors 1-2. Sign-on Hyperzap V3.2c Feb-03-85 Copyright 1985 M.J.Gingell Hypersoft.
• The loaders: each boot sector starts with a parameter block after JR +6: load and entry address (FM: 5500h; MFM: 5600h), cylinder count 0Ch and sector count 06h. The loader forces an interrupt (D0h), steps in (53h) to cylinder 1 and, for each of cylinders 1-12, reads sectors 6 down to 1 (LD A,C / LD (37EEh),A, Read Sector 88h; Model III the same through ports F0h-F4h in MFM) into consecutive memory, steps in, and finally jumps to the load address. The status mask is AND 9Ch (not ready, Record Not Found, CRC error, lost data: the record type is ignored); ten tries per sector, then Disk fault and a hang. The Model I's 1771 sees only the FM IDs of each track and the Model III's 179x in MFM only the MFM IDs, so one track serves both machines: 18 KB for each.
• No check found: neither loader tests anything beyond reading its own density; the program's Read Address and status tests belong to its copier functions (not followed one by one). The protection is the format: a 179x Write Track cannot change density inside a track and no DOS formats such tracks (as S-024's mixed-density cylinder 1).
• Cylinders 13-25 hold HyperZap's own macro files, beginning with "Hyperzap Self Copy": the steps (XC, YS2, N0, YS12, N1, 12, N13 ...) by which HyperZap copies its own disk, mixed-density tracks included. The vendor's backup route is the program itself.
• Boot paths: both loaders run to the program (traced; emulator boot tests agree). HyperZap v3.0c for the Model III is a Model III edition with MFM-only program tracks and no S-034 layout.
• Why the archive's v3.2e copies fail on the Model I: every v3.2e image lacks at least one FM sector the Model I loader needs, so it ends in Disk fault: one has a DMK track length of 6400 bytes, which cuts off FM sector 1 (the last on the track) of every cylinder 1-12, and FM sector 6 of cylinder 4 is missing; the other two lack FM sector 6 of cylinder 11. The Model III path reads the MFM sectors, which are all present. The disk as made is dual-boot: its FM program is byte-identical to the FM program of v3.2g (which runs on the Model I), except the last byte of cylinder 12 sector 1 (00h on v3.2e, 01h on v3.2g), so the Model I side of v3.2g carries the v3.2e build. Each missing sector exists on another v3.2e copy: this is damage to the images, not a different protection.
• How to recognise it: Hypersoft loaders 18 06 00 55 / 18 06 00 56 with mixed-density cylinders 1-12: this scheme.

Found on (9 disk images in the archive):

• HyperZap v3.0c — M J Gingell / Hypersoft, 1983
• HyperZap v3.2c — M J Gingell / Hypersoft, 1985
• HyperZap v3.2e — M J Gingell / Hypersoft, 1985
• HyperZap v3.2g — Hypersoft, 1985

↑ Back to the scheme list

---

S-035: PowerDOT v2.0: an extra bad sector 255 on cylinders 8 and 10 (PowerSoft, 1983)

Protection levels: A (format)

• The disk: a SuperMOVE disk (Model I and Model III boot sectors, a DOS-readable directory); cylinders 8 and 10 each carry, among their ten 256-byte sectors 0-9, an extra 1024-byte FM sector 255 whose data CRC is bad. Other copies of the same product (another build) have no such sector.
• Why it counts: an extra sector with a deliberate CRC error on the product's tracks is protection even without a traced check.
• Searched: nothing on the disk asks the controller for sector 255, issues Read Track or Read Address, or keeps data on cylinders 8 and 10. A 1024-byte single-density sector cannot fit on a track that already holds ten 256-byte sectors: its "data" is just the bytes that follow it on the track. So it is an ID found inside a gap or another sector, possibly left by the imaging; the image format (JV3) keeps no raw track to tell (unverified).
• How to recognise it: a 1024-byte sector 255 with a CRC error added to a standard 10 × 256 FM track of a PowerSoft/Breeze disk: this scheme.

Found on (1 disk image in the archive):

• PowerDOT v2.0 — PowerSoft, 1983

↑ Back to the scheme list

Many disks look protected to a copier or a disk-checking tool without being protected at all. These were all ruled out in the archive's analysis:

• A program's own disk format. MMSForth uses its own layout (cylinder 0 single density, then 1024-byte double-density blocks), and Percom's MicroDOS and the UCSD p-System have directories no TRS-80 DOS can read. All of them are standard, error-free formats: [Special Format], but not protection. Twenty-five MMSForth disks were checked; any protection it has would be a serial check in the code, and none was found.
• A custom loader on an ordinary layout. Self-booting disks such as J&M's Digital Disk Diagnostic (18 × 256 double density, sectors 1–18 on every track) or Micro Clinic's Floppy Doctor boot their own code but carry no deliberate errors.
• Dual-boot cylinder 0. A cylinder 0 with a single-density sector 0 for the Model I and a double-density sector 1 for the Model III is simply how a disk is made to boot on both.
• File transfer disks. SuperMOVE and similar distribution disks boot a small program that copies the files to the buyer's own DOS disk. Copying the product is their whole purpose.
• F8 marks on a directory track. TRSDOS marks its directory sectors this way; it is a DOS convention, not a trick.
• Sectors running past the end of the track, overlapping sectors, a side byte that does not match the side. Overfilled tracks, damage, imaging artifacts, or a second side formatted by a single-sided formatter.
• Errors the program never reads. CRC errors on free space, on E5-filled tracks, or on leftovers of an older format beyond the end of the game are damage or leftovers, not protection. A good test is a second copy of the same disk: if the "error" is a good sector there, it was damage.
• A stored CRC of FFFF on a loader track. This is the signature of a sector that failed when it was written or imaged. On Big Five's Attack Force original it stopped the disk booting on both models.
• A boot-time Read Track with no test of the result. Acorn's King of the Jungle reads cylinder 0 with Read Track but never branches on what it gets.
• Disk code that is not a check. Soft Sector Marketing's talking Caterpillar writes directly to the controller, but only to save its high scores.
• Odd tracks on one copy only. Ridge-Tec's Back-Track v1.0 has unusual tracks on one copy, while another copy of the same version works fully without them: a previous owner's test area.
• Test media. Drive-diagnostic disks such as Memory Minder's Digital Diagnostic Diskette (43 cylinders, 75 deliberately bad sectors) and Disk Drive Analyzer's engineered tracks carry intentional errors for the program to measure. They are recorded like protection and must never be "repaired", but they protect nothing.

• Use DMK. The DMK image format can represent essentially everything a real TRS-80 floppy controller can do, protected disks included: every ID byte, every mark, every deliberately wrong CRC, and the byte positions on each track. JV1 and JV3 store only sectors, so wrong track or side numbers, real CRC bytes, physical order and gaps are lost (JV3 has one emulator-specific allowance for VTOS 3.0). A protected disk converted to JV3 is usually no longer a working copy; the archive tags such images [JV3] so that is visible.
• Read with few retries. When reading an original with a flux reader or a tool like gw2dmk, use low retry counts so that intentional CRC errors are recorded as they are rather than retried away, and avoid merging passes on disks where that would hide what is really there. Non-standard track numbers can also fool a reader's double-step detection.
• Never "repair" a protected sector. Fixing a deliberate CRC error, filling in a missing data field or renumbering a sector makes the disk fail its own check. Repair only what is proven to be damage, ideally by comparing with a second copy of the same disk.
• Keep the extra tracks. Never trim cylinder 40 or other tracks beyond the DOS's range from an image, whether or not they look used: Tandy's and Snapp's protection live there.
• Emulators: a DMK of a protected disk runs in an emulator that reproduces the controller faithfully. Checks that depend on timing (level B) may still behave differently from real hardware.