Timing-based protections

23 September 2004

Disk Formats / Copy Protection Support


  • A Question of Sport: Another Elite Systems variant
  • Adam Brierley timing protection on Black Hornet, Merchant Colony, Insector Hecti, possibly some other games as well.
  • Another Adam Brierley protection supported found on Cavitas, where the disk key is encoded purely as data density changes, see below for more on this.
  • Behind the Iron Gate
  • Full Contact protection track
  • Future Tank: Added support to sync modified AmigaDOS format
  • Gunshoot: Another CHW variant
  • Joe&Mac Caveman Ninja: Another Elite Systems variant
  • Magic Marble protection
  • Pinball Prelude
  • Skate of the Art protection track
  • Weird Dreams: Another Copylock variant
  • Xenon 2 (Beau Jolly 1 disk version): New Speedlock timing protection (also see Drivin’ Force below)
  • Xenophobe: Old Speedlock timing protection


  • Fix for Dragonflight EN disk id, since there are disk id’s sorted on each track, however many of them are damaged.
  • Fix for the mastering error on retail Return of the Jedi. Some data was damaged on the master but it is known from other games of similar protection what it should be.


  • Renamed Executioner to Golden Sector, the format is used on Discovery In the Steps of Columbus as well.

Drivin' Force

Checking old disks it turned out that Drivin’ Force used the same protection timing as the 1 disk Beau Jolly Xenon 2, and not the usual one. That one worked regardless since the difference is only a few microseconds, but it was changed for accuracy. This is why preserved game id 1504 has been replaced.

Support for Timing-based Protections

The protection systems of games mentioned in the “newly-supported” list above are due to the recent support for timing based protections, and need the newly-released IPF library. This has actually long been due, they were first mentioned in December 2002's WIP, and we were sure that the protection is a derivative of the Adam Brierley scheme that was recently supported. So we finally took the time to reverse engineer Cavitas.

Take a look at the Cavitas cylinder 0, head 1 graph in Figure 1.

Cavitas Head 0 Cylinder 1
Fig 1: Cavitas timing protection

Who would have thought that this reads “a853”? This is the key value for the protection checks, encoded as pure density information and is not present in any other way as real data!

Hex:    $    a    8    5    3
Binary: % 1010 1000 0101 0011

Now reverse the bitstream.

% 1100 1010 0001 0101

The bits are reflected in the density. A fast density (+5% above x axis) area is 1, a slow density area (-5% below x axis) is 0. Density is measured between adjacent sync’s. For an easier interpretation of the boundaries, see below.

Very impressive!

This is not hard-coded into the IPF Library, the library can modulate a track with any possible value using the disk key set by the analyser.

Mark (Sync) Visualisation

Visualisation for the mark (sync) positions was implemented in the analyser which makes the values much more “readable”. Detected marks are displayed on the graph as green lines to help visualise certain data zones/protections and Cavitas as shown in Figure 2.

Cavitas Head 0 Cylinder 1
Fig 2: Cavitas mark positions

“SyncSet” must be set to the desired syncing/filter type (the default N/A is valid as well) and “Dump” must be clicked in order to let the analyser search for the selected marks. This is otherwise not done as you do not want this operation performed each time the syncing is selected through the list, it can be a lengthy operation on some tracks. Once the search is complete the graph is updated with the mark zones. Data is cached for instant redraws until it is changed, like when changing tracks.