I already wrote a news article about the search on how to decrypt the ACID protection of the Amstrad Plus computers. Now NoCa$h, also known for his No$cpc emulator for DOS, received a Amstrad CPC Plus cartridge by Fano and decrypted the ACID protection of the cartridge within a few days. To do this, he desoldered the ACID protection chip from the cartridge and connected it to the printer port of the PC. With a small program he sent data to the chip and tried to find a way to reproduce the signals of the chip. He found an algorithm which produces the same sequence.
With the decryption of the chip, the last big unknown mystery of the CPC is now resolved. In the future we can produce new cartridges for the CPC Plus and maybe someone will develop a reprogrammable cartridge.
You can find the pseudocode in the thread about the ACID protection in the CPCWiki forums and this information will also be included in the CPCWiki article about the ACID protection in the future, too.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 | ;ACID reverse-engineered 13-16 February 2010 by nocash (Martin Korth) ;below is repeated on every CLK cycle... CmpVal=13596h, XorVal=0c820h if PinA0=1 then CmpVal=CmpVal XOR 0000ch, XorVal=XorVal XOR 00004h if PinA1=1 then CmpVal=CmpVal XOR 06000h, XorVal=XorVal XOR 06000h if PinA2=1 then CmpVal=CmpVal XOR 000c0h, XorVal=XorVal XOR 00080h if PinA3=1 then CmpVal=CmpVal XOR 00030h, XorVal=XorVal XOR 00020h if PinA4=1 then CmpVal=CmpVal XOR 18000h, XorVal=XorVal XOR 08000h if PinA5=1 then CmpVal=CmpVal XOR 00003h, XorVal=XorVal XOR 00000h if PinA6=1 then CmpVal=CmpVal XOR 00600h, XorVal=XorVal XOR 00000h if PinA7=1 then CmpVal=CmpVal XOR 01800h, XorVal=XorVal XOR 00800h if PinCE=0 AND (ShiftReg OR 100h)=CmpVal then ShiftReg=ShiftReg XOR XorVal NewBit=ShiftRegBit0 XOR ShiftRegBit9 XOR ShiftRegBit12 XOR ShiftRegBit16 ShiftReg=(ShiftReg SHR 1) + (NewBit SHL 16) Wait for falling edge on PinCLK if PinCCLR=0 then ShiftReg=1FFFFh ;\done at falling CLK edge PinSIN=ShiftRegBit0 ;/ ;Mind that above is a software example - a hardware solution obviously ;wouldnt require CmpVal and XorVal registers - instead, hardware would ;directly deal with the PinAx (or NOT PinAx) signals. |