Problem preservating "Mission Elevator" by Euro Gold

[realmml]

Hi Keir!

My name is Mauricio and I am part of the spanish preservation team. I would like to comment a few things and because your suggestion I will use the Discussion section.

First, let me to thank you lot for your work. You have made a lot easier our life mission of preservation software.

Thanks to your disk utilities we have been able to preserve a lot of software. Even if we got a few of the first kryoflux, we were using mainly for preserving Amstrad CPC floppy disks for a lot of reasons.

But since your open source tool appeared, we have been starting to preserve more 16 bits floppy games. Then THANK YOU VERY MUCH!

For example, one year ago we dumped Hoi, but I had not way of verifying that we preserved the game fully. I asked in the eab forum. But the only help that I received was "send the dump and we will check", I don't agree with that way of preserving software. I feel that we can not depend only from one team, anybody should be able to preserve software and the knowledge should be open for helping everybody can find the same or similar problems.

Thanks to one of your last updates in the github, I can put rest in Hoi and verified that our version was correctly dumped.

The main thing that I would like to comment is that I have found a protection not supported by disk-analyse and I would like to help to adding support to it.

The game is Mission Elevator:
https://hol.abime.net/2495

It is the Euro Gold release and it is one floppy only. Then as always, I start by searching in the formats file if there is an specific section, no luck. Then I test with probe_amiga and I got a bad identification (Phantom Fighter):

disk-analyse.exe -f probe_amiga missionele/track m1.eadf
T0.0-78.1: AmigaDOS
T79.0: Unformatted*
T79.1: Phantom Fighter
T80.0: Unformatted
T80.1: Phantom Fighter
T81.0-82.1: Unformatted
** WARNING: 1 track is damaged or unidentified!

Then I test with games from the same or similar publishers. Starting by Street Cat (or Bad Cat, the german name), that I think is the nearest one:
disk-analyse.exe -f "Street Cat Disk 1" missionele/track m2.eadf
T0.0-78.1: AmigaDOS
T79.0-79.1: Unformatted*
T80.0: Street Cat Protection c
T80.1-82.1: Unformatted
** WARNING: 2 tracks are damaged or unidentified!

I tried the second this of Street Cat, but no luck:
disk-analyse.exe -f "Street Cat Disk 2" missionele/track m3.eadf
T0.0-78.1: AmigaDOS
T79.0-79.1: Unformatted*
T80.0: Street Cat Protection c
T80.1-82.1: Unformatted
** WARNING: 2 tracks are damaged or unidentified!

Then I looked in the source of disk-analyse, and Street Cat is a variant of Rainbow Arts and I tried "Spherical":
disk-analyse.exe -f "Spherical" missionele/track m4.eadf
T0.0-78.1: AmigaDOS
T79.0: Unformatted*
T79.1: Spherical
T80.0: Unformatted
T80.1: Spherical
T81.0-82.1: Unformatted
** WARNING: 1 track is damaged or unidentified!

And "Eye Of Horus":
disk-analyse.exe -f "Eye Of Horus" missionele/track m4.eadf
T80.1: sectors 1,2,3,4,5,6,7,8,9,10, missing
T0.0-78.1: AmigaDOS
T79.0-79.1: Unformatted*
T80.0: Unformatted
T80.1: AmigaDOS Extended (Sync, Header)
T81.0-82.1: Unformatted
** WARNING: 3 tracks are damaged or unidentified!

But no luck.

I have the feeling that it is a variation of Street Cat. But I don't know which should be my next steps? I imagine that I should define a new format based in Street Cat, but I don't know how start. Do you have any tips?

If you would like to take a look, I have uploaded the raw dump to dropbox:
https://www.dropbox.com/s/5ab151duenhzb2p/Mission%20Elevator.zip

Thanks!
Mauri.

[keirf]

Unfortunately being "a bit like" an existing track format isn't quite good enough. Actually a lot of Amiga track formats are similar. There's only so many sensible ways to lay out an Amiga track.

This requires reverse engineering the game trackloader. So, unless you are happy doing such things, it needs me or Abaddon to add support.

[realmml]

Of course, my feeling is based in that both games were launched in the same year by the same publisher, Euro Gold; then I think the protection must be similar.

I can take a look to the game trackloader, the game uses normal amigados files (tracks 0 -78) and the protection checks for the tracks 79 and 80, exactly the ones that disk-analyze doesn't identify yet ;).

Lucky for me, the whdload slave includes the source and one of the things the slave is patching is the disk protection. Then I will took a look in the debugger and I hope to get more details about what the game is doing.

[keirf]

Ok, now I look more closely, this will be a longtrack protection on cylinder 79. Pretty common to put a longtrack protection there. The tracks will probably have a sync plus repeating pattern, and that's all.

[realmml]

Thanks again!

Sorry for all the questions, but I can tell that I am having a lot of fun with this little game.

[kkrellwitz]

I had a look at the protection and it is identical to Crystal Hammer. The only issue is that the check length is checking for 100000 and mission elevator has a track length of 99937. I will update the format to support Mission Elevator

Protection Check 1

0002a652 move.l $0001fbe8 [0000a018],$00dff020
0002a65c move.w #$4489,$00dff07e
0002a664 move.w #$8400,$00dff09e
0002a66c move.w #$4000,$00dff024
0002a674 move.w #$8010,$00dff024
0002a67c move.w #$8010,$00dff024
0002a684 move.w $00dff01e,d1
0002a68a and.w #$0002,d1
0002a68e beq.b #$f4 == $0002a684 (T)
0002a690 move.w d1,$00dff09c
0002a696 move.w #$4000,$00dff024
0002a69e move.w #$0400,$00dff09e
0002a6a6 movea.l $0001fbe8 [0000a018],a0
0002a6ac adda.l #$00000002,a0
0002a6b2 bsr.w #$0022 == $0002a6d6
0002a6b6 lsl.l #$08,d1
0002a6b8 move.l d1,$0002a87c [0000016a]
0002a6be bsr.w #$0016 == $0002a6d6
0002a6c2 lsl.l #$04,d1
0002a6c4 or.l d1,$0002a87c [0000016a]
0002a6ca bsr.w #$000a == $0002a6d6
0002a6ce or.l d1,$0002a87c [0000016a]
0002a6d4 rts == $0000ffff

0002a6d6 clr.l d0
0002a6d8 move.b (a0)+ [00],d0
0002a6da clr.l d1
0002a6dc lea.l $0002a86c,a1
0002a6e2 cmp.b (a1,d1.W,$00) == $0000185f [00],d0
0002a6e6 beq.w #$000a == $0002a6f2 (T)
0002a6ea add.l #$00000001,d1
0002a6f0 bra.b #$f0 == $0002a6e2 (T)
0002a6f2 and.l #$0000000f,d1
0002a6f8 rts == $0000ffff

0000A018 4489 554A 52AA AAAA AAAA AAAA AAAA AAAA D.UJR...........
0000A028 AAAA AAAA AAAA AAAA AAAA AAAA AAAA AAAA ................

==================
protection 2

0002a7bc move.l $0001fbe8 [0000a018],$00dff020
0002a7c6 move.w #$4489,$00dff07e
0002a7ce move.w #$8400,$00dff09e
0002a7d6 move.w #$4000,$00dff024
0002a7de move.w #$8001,$00dff024
0002a7e6 move.w #$8001,$00dff024
0002a7ee move.w $00dff01e,d1
0002a7f4 and.w #$0002,d1
0002a7f8 beq.b #$f4 == $0002a7ee (T)
0002a7fa move.w d1,$00dff09c
0002a800 move.w #$4000,$00dff024
0002a808 move.w #$0400,$00dff09e
0002a810 and.b #$fd,$00bfd100
0002a818 and.b #$fe,$00bfd100
0002a820 nop
0002a822 nop
0002a824 nop
0002a826 or.b #$01,$00bfd100
0002a82e move.l $0001fbe8 [0000a018],$00dff020
0002a838 move.w #$4000,$00dff024
0002a840 move.w #$8200,$00dff024
0002a848 move.w #$8200,$00dff024
0002a850 move.w $00dff01e,d1
0002a856 and.w #$0002,d1
0002a85a beq.b #$f4 == $0002a850 (T)
0002a85c move.w d1,$00dff09c
0002a862 move.w #$4000,$00dff024
0002a86a rts == $0000ffff

---

Protection check 2 validation

0002a5f2 movea.l $0001fbe8 [0000a018],a0
0002a5f8 move.l $0002a87c [0000016a],d1
0002a5fe move.b (a0,d1.W,$00) == $0001fbe7 [00],d0
0002a602 lsl.l #$08,d0
0002a604 move.b (a0,d1.W,$01) == $0001fbe8 [00],d0
0002a608 lsl.l #$08,d0
0002a60a move.b (a0,d1.W,$02) == $0001fbe9 [00],d0
0002a60e lsl.l #$08,d0
0002a610 move.b (a0,d1.W,$03) == $0001fbea [a0],d0
0002a614 move.l #$0000001f,d1
0002a61a cmp.w #$4489,d0
0002a61e beq.w #$0014 == $0002a634 (T)
0002a622 lsr.l #$01,d0
0002a624 dbf .w d1,#$fff4 == $0002a61a (F)
0002a628 clr.l $0002a880 [00000001]
0002a62e bra.b #$fe == $0002a62e (T)
0002a630 bra.w #$000c == $0002a63e (T)
0002a634 move.l #$00000001,$0002a880 [00000001]
0002a63e movem.l (a7)+,d0-d7/a0-a6
0002a642 movea.l $0004 [00c00276],a6
0002a646 jsr (a6,-$008a) == $0001aadc
0002a64a move.l $0002a880 [00000001],d0
0002a650 rts == $0000ffff

[keirf]

Thanks for jumping in!

[realmml]

Thank you very much Keir and Keith!!! :)

Last night, I finished of understanding the first protection check (reading 16 words from tracks 79.0 and 79.1 and finding the correct sequence) and the second one (the one that read one word and get the disk sync)... , but it was too late and too tired for trying to post here, hehehe.

It is fun to try to understand the protections instead of cracking them :)

Even if we have some rare games (*), for now this is the only game that disk-analyse was unable to handle.

(*) The problematic game that has one wrong bit (and I started the other thread), it uses a silly protection, simply the track 79 is unformatted and disk-utilities handle it perfectly.

[kkrellwitz]

I am reworking the protection c decoder and have to test with all 3 supported games to make sure I didn't break anything. I hope to get it completed tomorrow evening.

[kkrellwitz]

I just pushed the update to support Mission Elevator.

[realmml]

Thanks Keith!

We got a few more interesting and problematic floppies, as P47 by Firebird and Seven Gates of Jambala by Thalion. I will open a few new threads when I arrived home.

[kkrellwitz]

I have 2 dumps of P-47 and will take a look. I know the ctraw image for both do not boot in WinUAE. The format is rainbird, but it appears that there is something special about the track 0 or both of my versions are bad. I will need to investigate track 0