Requesting Help with Copy-Protection

[Expack2]

In order to verify Mario's Time Machine (http://www.mobygames.com/game/marios-time-machine) was, in fact, released on the PC (in this case, MS-DOS), I need someone to crack the copy-protection on the image so generously posted by UnconformistSheep in the game's request post (http://www.abandonia.com/vbullet/showpost.php?p=420196&postcount=6http://www.abandonia.com/vbullet/showpost.php?p=420196&postcount=6). If someone can do so, I'd really appreciate it because it will allow either another Abandonia staff member or myself to verify the abandonware status of Mario's Time Machine.

[Professor Oak]

I'll have a look into this later.

[UnconformistSheep]

I guess you guys didn't have more luck than I did, uh? :)

That mobygames.com doesn't list PC/DOS as one of the supported platforms, but wikipedia can confirm both games were released for the DOS:
http://en.wikipedia.org/wiki/Mario%27s_Time_Machine
http://en.wikipedia.org/wiki/Mario_is_missing

I never played the NES and SNES versions, but, from the look of the screenshots, the DOS version looks (from what I remember) a lot like the SNES version.

The archaic copyright protection mechanism I think were introduced by the Portuguese publisher, which also did the translation. It seems to have worked by changing something in the Floppy Disk #5 during install, which I guess got reverted when doing an explicit uninstall. I guess I could have made a backup copy of this 5th Floppy Disk, but I didn't know better as a kid. :-P

Anyhow, this company no longer seems to exist. At least, google returned nothing for the name.

[Professor Oak]

My main problem is trying to work out how to mount multiple floppy images, if only there was a bare bones tutorial which would make actually the process easier.

[The Fifth Horseman]

Current official DOSBox version doesn't support that. The last one that did was v0.65. If you have that, all you have to do is specify the image files one after another. When mounted, CTRL+F4 cycles to the next image (or to the first if the currently mounted one was the last).

[Japo]

I didn't know that but
If you have that,
You can download old versions from the dosbox.com site, it's the last link the in list below all the platforms, it takes you here:

http://sourceforge.net/projects/dosbox/files/dosbox/

[UnconformistSheep]

My main problem is trying to work out how to mount multiple floppy images, if only there was a bare bones tutorial which would make actually the process easier.

I copied each floppy to a zip archive in another computer. What I did next was to copy said content to a directory, which I mounted in DosBox as a:. Then, when the installer asked for the next floppy disk, I replaced the content of that directory by the content of the following floppy disk. ;-)

When mounted, CTRL+F4 cycles to the next image (or to the first if the currently mounted one was the last).
Off-topic, but a nice hack would be to add a menu-bar to DosBox (when in window-ed mode, like in other emulators), so you would have access to such commands, and to allow you to easily mount directories and etc.

[UnconformistSheep]

I still have the box, manual and etc of the game. I will get you guys a scan of the thing. Anyhow, here is a translation of a piece of paper (A5) that came with the game, instructing how to install/handle the game:

Warning
To avoid problems, please attent the following:

Know which floppy disk comes with the program "INSTALAR" (consult the manual)
Before installing, verify that all are disks are unprotected against writing (left hole closed)
Correct eventual problems with the disk with CHKDSK /F (DOS 5) or SCANDISK (DOS 6)
Follow the instructions of the installation program.


A lot products from Multitarefa come with a protection device against illegal copies. This system allows the owner of the original installation disks to install the product an unlimited number of times, provided that, before proceeding to a new installation, the previous one is uninstalled.

In the case of protected products, during installation, besides the product files, your authorization of function is also moved. In this process, two hidden files are created in the root of the disk C ("EV*.SYS"). These files - essential for the product to function - are extremely sensitive and may not be removed, or even altered, otherwise the product will irremediably stop functioning! (Note: There is no problem using "Defrag" in DOS, even under "Full Optimization").
If you have memory managers like QEMM, we advise you to disable them before the installation.

To re-install/uninstall the "Authorization":
The authorization is moved from one drive to another using the command:
"PROTEGER drive_origin: drive_destiny:"
for example, to move the "authorization" from the floppy to the hard-disk, do "proteger a: c:". From the hard-disk to the floppy: "proteger c: a:"
The authorization can only be moved from the original floppy-disk (the one with the file PROTEGER.COM) and the floppy-disk has to be unprotected from writing.

You can also uninstall by using the program "DESINSTALAR" from the same floppy-disk:
From the DOS prompt in drive A, after you introduce the floppy-disk, issue command: DESINSTALAR.

In case of any difficulty, you may solicit help from the Technical Department of Multitarefa through the Green Line 0-500-11-67.


Summary: the floppy #5 is missing two files (named EV*.SYS), because they were moved to the hard-disk by the initial installation.

I am not sure how we can possibly re-create these two files. In Linux (as in other operating systems), you have this "strace" command that allows you to see which system-calls a program is making (which includes stuff like opening and reading files).

That is likely not enough for us: we need to see exactly what the installer (and then the game) are trying to match the file with. Fortunately, with DosBox, we should be able to track exactly what the program is doing. Anyone knowing their x86 Assembly might also be able to do the same by looking at the disassembled code.

I have never done any reverse engineering, and I am short of time at the moment, but it sure sounds like a fun project to eventually get around to. If anyone knows more about this, I would love to help though.

By the way, the same A5 piece of paper is found in both boxes of these Mario games. The manual of the games themselves is very brief in installation instructions: it only says basically: "insert floppy #1; type INSTALAR; follow the instructions". It says nothing about the protection mechanism, or even that you should type DESINSTALAR to uninstall the game. Crappy publishers...

[The Fifth Horseman]

There's one thing I could think of - if the files are erased from the floppy just by deletion and not overwriting, it could be possible to locate and recover their contents from the disk images.

[The Fifth Horseman]

Scratch what I said. Your floppy image isn't missing those files - IMGMOUNT it in DOSBox and see for yourself.
What's the case is that the image is truncated and more than likely missing part of the original game data.

[The Fifth Horseman]

PROTEGER.COM contains another executable wrapped in it - EVMOVE.COM, which is associated with the Everlock copy protection scheme.

Found this: http://www.searchlores.org/protec/everlock.htm

[UnconformistSheep]

As I mentioned in the other thread (http://www.abandonia.com/vbullet/showpost.php?p=420196&postcount=6), the mario-time-machine disk #5 is probably borked (just look at the size of the image file), but maybe not the where-is-mario disk #5. I could try using a different programme to create the img disk to see if we get better results... (I created them using dd system command from Linux.)

But indeed, there are these two files: EV31.SYS and EV32.SYS in disk #5 of both games. The size of the files is identical between games, but the data differs.

It still seem like the protection mechanism is at fault here. Just try to do a proteger a: c:, and you'll get an error: Current Available Install Count = 0. (disk #5)

Re-reading the Warning text, and looking at the output of the proteger command, it seems clear the copy protection mechanism is more sophisticated than shuffling a couple of files around.

More than a counter, I bet those two files encode information about the computer, like the floppy-disk Label, hard-disk Label and etc, otherwise it would be too trivial for the ordinary computer user to piracy the game, by either cloning the original floppy-disk, or by cloning the hard-disk installation.

Interestingly, the "proteger" command is a PROTEGER.COM file. COM executables are known to be easily disassembled (though I have no experience myself), so maybe someone could have a look.

By the way, I renamed the image files to disk*.img to make them easier to mount, and placed the all thing in this zip files: http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario-games.zip

[UnconformistSheep]

PROTEGER.COM contains another executable wrapped in it - EVMOVE.COM, which is associated with the Everlock copy protection scheme.

Again, I did get errors while copying both disk #5, so the page you referenced makes a lot of sense. I couldn't tell what to do (if anything I could do) to crack the protection system.

If anyone would like to accompany me in the process, I will follow your commands. ;-) I have a computer here with a floppy driver, and I recently managed to install Windows 7 on it, so I can try whatever you guys want. (If there is a hacker around, I can also buy you this cheap $1.00 ebay copy (http://cgi.ebay.com/Mario-Missing-PC-/260727040114?pt=Video_Games_Accessories&hash=item3cb48ae872), which is probably also "protected".) Anyhow, it probably makes more sense to just buy the game from ebay (if still in its unprotected state): interestingly, there are CD-ROM versions of the "Mario is Missing" game in ebay too.

[The Fifth Horseman]

What program did you dump the floppy image with? WinImage, RaWrite (2?), something else ?

[UnconformistSheep]

What program did you dump the floppy image with? WinImage, RaWrite (2?), something else ?

I created that raw imgdisk using 'dd' in Linux. It's a basic system tool. It did error'd while copying part of disk #5.

Anyhow, it's pretty clear no matter how the image disk is created, this will be one hard mother f----- to break. ;-) I might just buy the games from ebay, but pretty sad I can't play them in Portuguese (maybe I can copy over the data from the Portuguese floppies or something :-/). We wouldn't be able to post these games in Abandonia either way, right? Mindscape is still an active publisher...

EDIT: Anyway, I will indulge you guys in creating the image disks in other ways. I just installed Windows 7 in my computer with the floppy driver, so feel free to suggest other ways to create the image disk. I would just appreciate if you could tell me exactly what steps to follow (I'm short of time ATM). Or can just ship my floppies to anyone who has any experience in these things -- either that, or I will just order for you one copy from ebay.

By the way, here are scans of the the boxes if you guys are curious about it (click for a bigger size):

Onde está o Mario? / Mario is Missing!

http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-missing-1-small.jpg (http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-missing-1.jpg) http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-missing-2-small.jpg (http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-missing-2.jpg)

Mario e a Máquina do Tempo / Mario's Time Machine

http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-time-1-small.jpg (http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-time-1.jpg) http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-time-2-small.jpg (http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/mario-time-2.jpg)

[The Fifth Horseman]

WinImage and RaWrite2 are the ones I'd suggest.
Some people have alsoe recommended "Floppy Disk Analyser" for dumping images of copy-protected floppies.

[UnconformistSheep]

WinImage and RaWrite2 are the ones I'd suggest.
Some people have alsoe recommended "Floppy Disk Analyser" for dumping images of copy-protected floppies.

Okay, will give it a try next week after exams. I doubt it will help much though. :-(

By the way, I gave a quick try to the SNES version of the game. I was surprised because I remembered the graphics being quite a lot superior, and the gameplay/controls more intuitive. Did some googling, and it seems I am right: the PC version is one notch superior from the SNES. Uff, I thought I was going Alzheimer. ;-) There is also a story introduction to the PC version of "Mario Is Missing!" where Mario is seen going to Bowser's Castle because Bowser promises him candy. (I think Bowser is disguised, but can't remember: it was something stupid like that either way.) I think there is also some joke about Mario eating a spoiled mushroom, and Luigi reprehending him for eating every mushroom he sees. (Maybe this is before Mario leaves home? Or maybe this one was the introduction to the "Time Machine" one? The details are all foggy. ;-))

[UnconformistSheep]

Here are image disks for Mario's Time Machine (pt) using WinImage: floppy disk images (http://www.alunos.dcc.fc.up.pt/~c0607045/trash/mario/time-machine/).

As you can see, just looking at the file size, there is something wrong with disk #5.