Copy Unprotecting The Black Cauldron Version 1.1J
by the Road Runner
July 4, 1986


In commemoration of 100 years of the Statue of Liberty, the accompanying
program and simple procedure will liberate your Black Cauldron from the chains
of copy protection, by creating a non-protected backup. To create the backup,
you will need:

. An IBM PC, XT, AT or compatible running DOS 2.0 or greater and
having a 360KB or 1.2M drive identified as A.
. The original The Black Cauldron Diskettes 1 and 2.
This program has been tested on Version 1.1J with Game Interpreter
Version 1.12, but may work on other versions. The version number can
be determined by pressing Alt-D during game play.
. Two blank diskettes on which the backup will be made,
. Two diskette labels and two write protect tabs,
. The DOS program DISKCOPY (or equivalent),
. The accompanying program TBCUNP.COM,
. These instructions.

Follow these simple steps:

1. Run DISKCOPY to make a backup of TBC Disk 2 onto one of the blanks.
You should have no difficulty making this copy since Disk 2 is not protected.
Label the copy "Black Cauldron Disk 2" and put a write protect tab on it.

2. Using DISKCOPY, make a backup of TBC Disk 1 on the other blank
diskette. Since it is protected, you should expect to see an "Unrecoverable
read error on track 6" message, followed by a "Target disk may be unusable" at
the end of the copy. Ignore these warnings.

(NOTE: If you do -not- get the warnings, you may not have the right version of
The Black Cauldron and these procedures may not work.)

3. Run program TBCUNP and follow its directions:

. Insert the original TBC Disk 1 in Drive A, then press ENTER,
. Remove the orginal, put the Disk 1 copy in Drive A, then press
ENTER.

4. Remove the backup, label it "The Black Cauldron Disk 1" and put a
write protect tab on it.

You are done!! Enjoy the freedom!!

------------------------------------------------------------------------------

For those of you who would like to know how the copy protection and copy
unprotection work, here is an overview of the details.

Copy Protection:

Track 6 Side 0 of TBC Disk 1 has been specially formatted so that it cannot be
duplicated by most software disk copy programs. When TBC is booted, it
eventually reads track 6 to determine that the special format is present.
Specifically, it reads track 6 side 0 sectors 8 to 2 (backwards) as 1024 byte
sectors, then reads sector 1 as an 8192-byte sector. It expects to find each
sector, and to get a CRC error on each read. If what is read is the expected
data, it assumes you have the original TBC Disk 1, and runs the game. It
never makes this check again during the game.

Copy Unprotection:

The copy unprotection design takes advantage of several characteristics of the
TBC copy protection scheme.

1. Most importantly, TBC uses ROM BIOS INT 13 calls to read the copy
protected sectors, hence a demon can be introduced to intercept TBC calls and
fool the progam into believing it is reading the original.

2. The diskette is formatted with 9 512-byte sectors per track and
track 6 side 1 is not used by TBC. The 8192-byte sector of copy protected
data from side 0 can be stored in 16 of the 18 standard 512-byte sectors on
track 6 sides 0 and 1.

Program TBCUNP reads the boot record and copy protected data from the original
TBC Disk 1. On the copy, it writes a Road Runner produced boot record on
track 0, and a demon, the original boot record and copy protection data on
track 6.

When the TBC copy is booted, the Road Runner boot record reads track 6 into
memory, installs the demon, then gives control to the original boot record.
The demon passes on all disk read requests to the ROM BIOS until TBC asks for
track 6 data. It then feeds TBC the copy protection garbage it expects, until
the last read call to track 6. The demon then uninstalls itself and vanishes,
leaving no trace.

------------------------------------------------------------------------------
Note: This program and writeup can also be used to unprotect King's Quest ][
Version 1.0W.