Conversation

This is ARC. An MSX2 game developed by

in 1990. It was released on two 720K floppies and a cartridge. The cartridge has a 32K EPROM and extra hardware used as anti copy protection. AFAIK, it was never cracked.

An MSX mate (

) posted a picture of the interior of the cartridge. It was covered with some kind of silicone to prevent reverse engineering. I was curious about how the protection worked and he was kind enough to send me the game to examine it. Thanks Markus!

Manuel Pazos

@ManuelPazosMSX

I removed all the silicone, but the ICs have their surface scratched, so it was not possible to read the reference to identify them... at least that was the intention. But I managed to identify them all (I hope ^^!)

3:50 PM · May 18, 2018

Replying to

The cartridge checks write and read operations on I/O port #7F. Each time the value #35 is written, a counter is incremented. If the port is read and the counter bits 0-1 are "11", the value #DA is returned. A simple BASIC program confirms it works in that way.

Manuel Pazos

@ManuelPazosMSX

May 18, 2018

I used openMSX emulator to add breakpoints when the port #7F is accessed. In this way is somehow easy to find the code that checks the protection. The protection has self-modifying code, or obfuscated code that looks like "garbage" or random data.

Manuel Pazos

@ManuelPazosMSX

May 18, 2018

After patching those rutines, I managed to play the game until the end without using the original cartridge. But to be honest, it has no much merit to crack a MSX game using current emulators. (I also had to disassemble the final boss logic to find out how to defeat him ^^!)