Atari Copy Protection

 Last modified 14/01/2007 20:23

DÚsolÚ pas de version Franšaise pour le moment

Atari FD Copy Protection Mechanisms - V0.2

This page describes the Atari floppy disk protection mechanisms only. For a short presentation about generic program protection used on Atari platform please refer to this paragraph. A relative good understanding on floppy diskettes/drives as well as FDC is expected and detail information on these subjects  can be found here.

For a large part the information about the different copy protection mechanisms, used on different platforms, have been collected from the Web and links to original documents / sites can be found at the end of this page in the reference section. It is interesting to note that many specific protection mechanisms used on different platforms are directly related the the limitation introduced by the FD controllers used on these platforms. For example the WD1772 FDC used on Atari has capabilities and limitations that differs from the Intel 8272A FDC used on PC. To gain knowledge copy protections the following platforms have been reviewed (see references): Amiga, Commodore C64, PC, Tandy, Atari 8 bits, ... and of course the Atari ST 16 bits ... Some other useful documents reviewed: Rob Northen Copylock (Backup/restore, Newkey, Keydisk), DM Protection, Extracts from RN Thread, Protection, SpinRight Tech note.

The end goal is to help in duplication (not to be confuse with preservation) of original Atari diskettes with the following philosophy:

A backup program should always do the most to ensure the integrity of the resultant copy. The copy produced should operate just like the original and not remove the protection, or modify the program being copied in any way. The backup program must do the up most to check that the copy produced is correct and therefore dumb "analog copiers" (aka as "bit copiers") should be avoided.

 

Thanks to many people on Atari forum for taking time to describe some of the protections and special thanks to Ijor for his knowledge and patience in helping me to better understand some of the tricky protections.

DrCoolZic - June 2006 - Revision 0.2

Table of Contents


Copy Protection Mechanisms

First a short high level observation about the copy protections used on on Atari:

Simple techniques such as counterfeited id record values, blank tracks, mixed sector sizes, and extra tracks/sectors (referred as custom track layouts) can generally be detected and copied without problem by scanning the track layout with read id and read track commands, followed by reading the data from any sectors found.
More difficult to detect are data hidden in the gap areas, and tough to reproduce (requires special HW) are bit-rate variations, and Fuzzy/weak bits.

The following copy protections are described:

  Short Name DESCRIPTION
  01 NSS Non standard number of Sectors or number of bytes
  02 NST Non standard number of Tracks
  03 MSS Mixed sector size
  04 MSC Missing sector
  05 ESC Extra / Out of order Sector
  06 DSC Duplicate sector
  07 OSC Sectors ordering (interleave factor)
  08 NDM Sector with no Data Address Mark
  09 NIM Sector with no ID Address Mark
  10 BID Sector with bad ID
  11 BDT Sector with bad Data
  12 DOP Data Sector passing over Index Pulse
  13 DIG Data into GAP
  14 ESM Extra Sync Mark
  15 ISS Invalid Sync Sequence
  16 SCD Sync Character in data field
  17 FDB Fuzzy data bits
  18 LSS Long / Short Sector
  19 BRV Bit rate variation (bit density)
  20 TTK Track timing (GAP length)
  21 SWT Sector with Wrong Track number in ID

01 - Non standard number of sectors or number of bytes

  • Description: The Atari standard format is 9 sectors/track with data blocks of 512 bytes. However it is possible to create tracks with 10 or even 11 sectors/tracks as well as tracks with data block size ranging from 128 to 1024 (see Standard Format for 128-256-512-1024 Bytes/Sectors and Standard Format for 9-10-11 Sectors of 512 Bytes).
  • Creation: It is quite easy to format non standard track by sending appropriate information to the FDC during write track command.
  • Detection: Usage of read address command.
  • Duplication: Easy by software
  • Example: Dungeon Master (FTL Inc.) 10 sectors per track on all tracks.

02 - Non Standard Number of Tracks

  • Description: It is possible to go beyond the normal 80 tracks found on standard Atari Diskette. It is possible to go reliability up to 82 and even more with a lower reliability. It is also possible to "hide" one or several tracks on the second side of an "officially" (as specified in the boot sector) single sided diskette.
  • Creation: It is quite easy to add extra track by sending appropriate information to the FDC using the write track command. Be careful, some drives that cannot position the head past track 79 will write the data for tracks 80+ over track 79, even if tracks 80+ are blank.
  • Detection: Probe the diskette to see if some extra tracks exist. If SS diskette try to see if hidden track exist on second side.
  • Duplication: Easy by software.
  • Example: Passengers on the Wind (Infogrames) uses tracks 80 & 81.

03 - Mixed sector sizes

  • Description: Similar to the above but with mixed sector size on the same track. A common example is to add a 1024 bytes sector 10 on a track. Used usually to increase the overall capacity of a track, but can be used for protection.
  • Creation: It is quite easy to format track with mixed sector sizes by sending appropriate information to the FDC using the write track command.
  • Detection: Usage of the read address command.
  • Duplication: Easy by software.
  • Example: ???

04 - Missing sector

  • Description: Normally sectors are numbered sequentially from 1 to 9. It is possible to skip one or more numbers on purpose. For example sectors 1, 2, 3, 4, 5, 6, 7, 9, 10
  • Creation: It is quite easy to format a track with missing sector number by sending appropriate information to the FDC during the write track command.
  • Detection: Usage of the read address command.
  • Duplication: Easy by software.
  • Example: Dungeon Master (FTL Inc.) sector 8 missing on track 0

05 - Extra / Out of order Sectors

  • Description: A totally out of sequence sector is added or replace a missing sector number. For example 1, 2, 3, 4, 5, 6, 7, 247, 9, 10
  • Creation: It is quite easy to format a track with out of order sector by sending appropriate information to the FDC during the write track command.
  • Detection: Usage of the read address command.
  • Duplication: Easy by software.
  • Example: Dungeon Master (FTL Inc.) sector track 0, sector 247 replace the sector 8

06 - Duplicate sector

  • Description: The same sector number is used 2 or more times. For example 1, 2, 3, 4, 5, 6, 7, 8, 9, 3. Reading this sector randomly will return pseudo-random data values (similar to sector with fuzzy bits) due to the fact that one of these multiple sectors will be read randomly. Of course the sectors must contain different values!
  • Creation: It is quite easy to format a track with duplicate sectors by sending appropriate information to the FDC during the write track command.
  • Detection: Can be detected using the read address command or by randomly reading the sector (return random values). It is also possible to read one specific sector (among the duplicated sectors) by using appropriate timing/sequence.
  • Duplication: Easy by software
  • Example: ?

07 - Sectors ordering (interleave factor)

  • Description: Normally the sectors are ordered incrementally on the Atari (interleave of 1). But it is possible to interleaved them or to write them in any order. Note that interleaving might be interesting on tracks with 11 sectors as the GAPs between sector are usually too short for the FDC to recover (see Standard Format for 9-10-11 Sectors of 512 Bytes)
  • Creation: It is quite easy to format a track with sectors in any order by sending appropriate information to the FDC during the write track command. Note that the BIOS call for formatting a FD provides the capability to specify an interleave factor.
  • Detection: Usage of read address command and/or measuring sectors access time.
  • Duplication: Easy by software.
  • Example: ?

08 - Sector with no Data Address Mark

  • Description: Sector with ID block not followed by a DATA block.
  • Creation:  It is quite easy to format a track with a sector without DAM by sending appropriate information to the FDC during the write track command.
  • Detection: Using the read sector command. During the read sector command the FDC expects to find an IDAM within 43 bytes from last ID field CRC byte, if not the sector is searched again for 5 revolutions and the command is terminated  with the Not Found Status bit set.
  • Duplication: Easy by software
  • Example: X-out (Rainbow art games)?

09 - Sector with no ID Address Mark

  • Description: Sector with DATA block not preceded by ID block. This results in a "hidden sector" that can't be accessed using a read sector command.
  • Creation: It is quite easy to format a track with a dummy sector without IDAM by sending appropriate information to the FDC during the write track command.
  • Detection: It is possible to read this sector by using the read track command. However keep in mind that the read track command cannot read reliably a data sector and that the CRC is not verified (see Sync character in data field).
  • Duplication: Easy by software
  • Example: ?

10 - Sector with bad ID

  • Description: Sector that has a CRC error in the ID field resulting in a sector that cannot be read by a normal read sector command.
  • Creation: Possible during write track command. For example by sending 2 normal bytes (e.g. $00, $00) at the end of the block instead of one "write CRC" character ($F7).
  • Detection: It is possible to verify the presence of this sector ID with the read address command and also to check that its CRC is wrong. But it is not possible to read the sector with a normal read sector command and the read track command should be used to read the data. However keep in mind that the read track command cannot read reliably a data sector and that the CRC is not verified (see Sync character in data field).
  • Duplication: Easy by software
  • Example: ?

11 - Sector with bad Data

  • Description: Sector that has a CRC error in DATA block.
  • Creation: Possible during write track command using the same mechanism as described above.
  • Detection: with read sector command. The data sector is read normally but the CRC error status bit is set.
  • Duplication: Easy by software
  • Example: ?

12 - Data Sector passing over Index Pulse

  • Description: Some data are placed "under the index hole". Normally all sectors of a track should end up before the index hole. But we can create a track with a total data length slightly more that a normal track can hold  resulting in the last sector "wrapping around" the beginning of the track. As there is small area at the beginning of track (post index GAP), which is not used for storing data (although it is used by index address mark in IBM format), it is possible to overwrite partially this section. But the overlap should not be too large otherwise the IDAM of sector 1 will be erased.
  • Creation: The write track command of the WD1772 FDC starts with the leading edge of the index pulse and continues until the next index pulse (in other word the index pulse terminates the write command). It is therefore not possible to format a diskette with a sector that span over the index hole with the Atari FDC and therefore special HW is required.
  • Detection: Even though the last sector pass over the index pulse it is read normally. It is therefore necessary to use the read track command to find out this information.
  • Duplication: As such a track cannot be created by the FDC it is necessary to use special hardware (either analog or digital copiers)
  • Example: ?

13 - Data into GAP

  • Description: It is possible to write data in the post ID Gap (Gap of 22 bytes) or in the post DATA Gap (Gap of 40 bytes) as well as in the pre and post index GAP (respectively 664 and 60 bytes). See copy me I want to travel from Claus Brod for some interesting examples.
  • Creation: Data can be written in Gap during the write track command. It is recommended to use sync marks in front of the data to be able to read information correctly, but reading pseudo random value may be part of the protection.
  • Detection: Can be detected by using the read track command. But it is not so easy to detect by software as we do not know what to look for and we need to guess there are data in one of these gaps, but some simple heuristics can be used.
  • Duplication: Sometimes difficult to detect, but easy to reproduce by software.
  • Example: ?

14 - Extra Sync Mark

  • Description: Add Extra Sync Mark(s) in Gaps. This is usually not used as a protection per se, but the sync marks are placed before data into gap to ensure synchronization (see also Invalid sync mark sequence).
  • Creation:  It is quite easy to add extra sync marks by sending appropriate information to the FDC during the write track command.
  • Detection: using read track command
  • Duplication: Easy by software.
  • Example: ?

15 - Invalid Synch Mark Sequence

  • Description: A sequence of 3 $A1 (or 3 $C2) Sync Marks should always been followed by an AM. Therefore having a sequence of 3 sync mark without AM is considered as an abnormal condition. Note that usually this sequence is used to sync up the data separator to read data into gap.
  • Creation: It is quite easy to create an invalid sync mark sequence during formatting by sending appropriate information to the FDC using the write track command.
  • Detection: Usage of the read track command.
  • Duplication: Easy by software.
  • Example: ?

16 - Sync Character in data field

  • Description: During normal reading of a data sector the Sync Mark Detector of the WD1772 is disabled. But during a read track command the sync mark detector is active all time. For certain sequence of data bits the detector get confuse and incorrectly detect a $C2 sync mark (see false sync mark pattern) resulting in shift of the following bits. This "feature" can be used to hide some information inside a data block (see copy me I want to travel from Claus Brod for examples).
  • Creation: Write special sequence of bits known to create false $C2 sync in a data block during formatting with the write track command.
  • Detection: Read with read sector command, then read with read track command the same sector and compare the returned data.
  • Duplication: Easy by software.
  • Example: ?

17 - Fuzzy bits

  • Terminology: Fuzzy bits are known under many names: weak bits, wandering bits, flaky bits, flakey bits, phantom bits, ... Weak bits is the most commonly used term, however I prefer the term fuzzy bits as it suggests the resulting effect without inferring any underlying causes.
  • Description: Fuzzy bits returns different values (pseudo-random values) for different reads. They are a special case of the more generic bit-rate variation. The Fuzzy bits used for copy protection are not caused by weak recorded transitions (see also weak bits in SpinRite's Defect Detection Magnetodynamics) as implied in the excellent SPS site!
  • Creation: Fuzzy bits are obtained by placing bits in "uncertain areas". In other word the transitions are placed in locations that will confuse the PLL data separator resulting in random values read (i.e. sometimes 0, sometimes 1). For example shifting a bit to the exact position where the data separator latch the value will return random values due to small variation of the drive rotation. Another example is to create a long period of time without clock or data bits that causes the PLL desynchronize and the next received pulse will be interpreted differently based on small random variation of the PLL clock and/or the drive rotation speed.
  • Detection: Read same fuzzy sector (sector that contains fuzzy bits) several times and check that it returns random data. The detection mechanism should also test that the random values returned are not due to usage of simple tricks like duplicated sectors. Note that:
    • If the fuzzy bits are located inside a DATA block the content of the data block changes and the FDC return a CRC error (in most cases).
    • If fuzzy bits are placed in an ID block the corresponding sector will be randomly existent or not (due to CRC error or not).
  • Duplication: Difficult and requires special hardware. Either analog or digital copiers can be used but, as usual, analog copier should be avoided whenever possible.
  • Example: Dungeon master Track 0, sector 7

18 - Long / Short Sector

  • Description: The result is equivalent to a sector of a track written on a drive with slow or fast rotation speed (although in most cases this is not done by actually varying the drive speed, but more often by varying the FDC bitcell clock). The IBM standard specify a deviation of the rotation speed of the drive within a 2% range and therefore the PLL of a FDC is suppose to tolerate a 4% variation from central frequency. But in practice the WD1772 PLL will handle at least 10% variation for MFM encoding and 100% variation for FM encoding. It is therefore possible to write bitcell at a frequency between 225 to 275 KHz (3.6 to 4.4 Ás width) and still read the sector correctly but this will result into a longer or shorter sector read time. The most famous usage of this protection was developed by Rob Northen in the so called Copylock mechanism (see an interview with Rob Northen)...
  • Creation: Requires special hardware: e.g. the capability to vary the drive rotation speed, or the capability to vary the FDC bitcell clock on the fly, or the capability to directly control the bitcells width.
  • Detection: Measure the time taken to read the short/long sector and compare it with time to read other sectors on the same track. For example the Rob Northen Copylock protection was changing the bit width to approximately 4.2Ás (5% variation). Note that usually the beginning of the sector was written at standard speed.
  • Duplication: Difficult requires special hardware. Either analog or digital copiers can be used but, as usual, analog copier should be avoided whenever possible.
  • Example: Populous - Track 0 Sector 6

19 - Bit-rate variation (aka bit density)

  • Description: This is the most generic form of the bit-rate (aka bit-density) variation protection mechanism. It is similar to what has already been explained in  long/short track and Fuzzy bits but in this case the bitcell width variation is not constant during the sector and may go beyond the PLL capture range. This should result in incorrect data read with CRC error and some randomness like with fuzzy bits. It is possible for the bitcell width to differ in different sub-section of the same sector (i.e. sort of bit-width modulation) and that the overall sector ends up with a ônormal length" (e.g. one sub section faster and one sub section slower) making it difficult to detect.
  • Creation: Requires special hardware that has capability to vary the FDC clock on the fly, or the capability to directly control  bitcell width/position.
  • Detection: As already mentioned this kind of sector should result in random value returned. Usually the beginning of the sector is done using normal bitcell width and this part should be read correctly.
  • Duplication:  Of course it is impossible for the WD1772 FDC to copy this kind of sector and therefore special HW is required. Either analog or digital copiers can be used but, as usual, analog copier should be avoided whenever possible.
  • Example: D50 Editor from Dr T - Track 0 Sector ?

20 - Track timing (GAP length)

  • Description: It is possible to fully control the layout of  a track by playing on the different gaps length. It is therefore possible to create track with a specific pattern.
  • Creation:  It is quite easy to format a track with specific values for the different GAPs by sending the appropriate information to the FDC during the write track command.
  • Detection: Measure the time it takes to read the complete track and/or measure the length of the different GAPs using the read track command.
  • Duplication: Easy by software.
  • Example: ?

21 - Sector with Wrong track number in ID

  • Description: Sector that has one/or several ID field that contains a wrong track number. In order for the type 1 command (e.g. seek) to succeed, when the verify bit is set, at least one sector need to have the correct track number.
  • Creation: Possible during write track command by sending incorrect track number during formatting of one or several ID field.
  • Detection: The read sector command compares the track number of the ID field with the track register if this match it then compare the sector number of the ID field with the sector register if one of these compare fails the FDC retry 5 times then terminate the command with a record not found error. To read this sector it is necessary to use a read track command. However keep in mind that the read track command cannot read reliably a data sector and that the CRC is not verified (see Sync character in data field).
  • Duplication: Easy by software
  • Example: ?

FD Protection References

Documents / Articles

Forums Threads

Web Sites

FDC & Related Information


Copyright and Fair Use Notice
This web site contain copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to help in the understanding of the Atari Computers. We believe this constitutes a 'fair use' of any such copyrighted material. The material on this site is accessible without profit and is presented here with the only goal to disseminate knowledge about Atari computers. Consistent with this notice you are welcome to make 'fair use' of anything you find on this web site. However, all persons reproducing, redistributing, or making commercial use of this information are expected to adhere to the terms and conditions asserted by the copyright holder. Transmission or reproduction of protected items beyond that allowed by fair use notice as defined in the copyright laws requires the permission of the copyright owners.

e-mail to Jean Louis-Guerin This page is maintained by DrCoolZic (Jean Louis-Guerin).
If you have any comments please send me an e-mail (remove _REMOVE_)