Friday, March 29, 2013

Exposing the Code Wheels - PC Game Document Copy Protection at its "Most Advanced"

In the mid to late 80's, computer gamer players were beginning to get fed up with playing games strictly off floppies.  The market, at least in the United States was clearly gravitating to the IBM PC platform.  That platform, which at best supported 16-color graphics and few sound choices, had one huge advantage over the more technically impressive Commodore Amiga & Atari ST machines, standardized support for hard drives.  As MS-DOS came with virtually every clone PC and offered standardized methods for interfacing with hard and floppy drives, combined with prices that made hard drives within reach of consumers and smaller businesses, game companies started to realize that the days of floppy-only games were coming to an end.  At first, several game companies like Sierra tried to compromise by allowing a game to be installed to the hard drive, but requiring a copy-protected "key disk" to be in the floppy drive when playing the game.

Consumers still complained because floppy disks were fragile and they wanted to make backups of their games.  Thus came the next evolution of copy protection, the document based check.  Now disks were wholly unprotected and could be backed up as many times as the consumer liked.  However, at some point in the game, the game would ask a question that could only be answered by referring to the game's documents.  The most simple version of this form of protection would be "Enter the third word in the fifth paragraph on page seven of the manual".  King's Quest IV, Leisure Suit Larry II and Police Quest II all use this, although the latter two incorporate graphics to make the protection codes harder to disseminate.  Its probably the most common form too.

However, some publishers did not like the simple approach.  First of all, it was too obvious and dull.  Second, although most homes did not have a photocopier in these days, the local library usually did.  Several alternate approaches were tried.  One was to publish codes in a separate code book and make the resulting codes difficult or impossible to copy.  Maniac Mansion had a codebook that in the original Commodore 64, Apple II and IBM PC releases, was made difficult to copy by using dark red paper and black ink for the codes.  However, apparently this was not deemed secure enough, so when Lucasfilm games re-released the game in a high resolution PC version and for the Amiga and ST, they used white paper, printed the codes in blue and printed the words "Maniac Mansion" in red over the codes, requiring a red gel filter to read the codes.  A decent color printer or scanner can beat either of these forms of protection, a little photoshop helps.

Other games use included unusual items like maps, which not only were used as a selling point but also served as copy protection when the game would ask the coordinates for a particular area on a map.  Maps, especially color ones, were often found in role playing games and games requiring trading.  Still, a photocopier would work here.

The main focus of this article is the Codewheel, the most intricate form of copy protection offered in PC Games.  The first known codewheel was included in the Infocom Text Adventure A Mind Forever Voyaging.  Here it is :

It had an inner and an outer ring, turning the ring would reveal a color which corresponded to a pair of numbers.  The inner ring concealed sixteen different colors.  While the codewheel may seem more complex due to small marks and large marks and 32 numbers on the inner and outer ring, the inner ring window is the double the width of the distance between two numbers on the code wheel.   Naturally therefore, you would think that there are only therefore sixteen possible options.  However, one color can correspond to thirty two combinations of numbers.  Since the game gave you the color and the inner number, you had to respond with the outer number.  As you had to know which inner number corresponded to which other number, the total possible combinations would be 512 (16 colors x 32 number pairs)

Today, with a scanner, this codewheel can be fully represented with fifteen images.  Put them in order in a pdf and the resulting page flipping will resemble the user actually moving the codewheel.  It can also be turned into a table, like this :

Numbers, colors, letters and words are easy to describe in text, so publishers that came after Infocom used more complex code wheels.  Electronic Arts used a three-wheel codewheel in The Bard's Tale III,  SSI used a two-wheel codewheel with multiple windows cut into the inner codewheel for Pool of Radiance, and Interplay used a codewheel with symbols in Out of this World.

Out of this World/Another World's codewheel was used in every early disk based release for the game.  Some games would use document based protection for the IBM PC and disk-based protection for the Atari ST and Commodore Amiga, but this was not one of them.  At first, this Codewheel looks rather daunting :

After a few startups, however, the player would learn that the game never seemed to ask for a symbol sequence more than three symbols in length.  That means only windows G, H, I, L, N, O and U were likely to house the correct symbols.  Even so, twenty scans of this wheel would give a full representation of its contents.  The game did not care which order you input the symbols.  You may notice that the symbols are not fixed-width, which makes it difficult to easily count how many symbols are printed on the outer ring.

Here is a famous codewheel :

Most of the time, by the time the game made its way into slash releases or compilation CDs, the company would crack the codewheel protection.  The Gold Box games, Pool of Radiance, Curse of the Azure Bonds and Hillsfar were frequently re-released but always had paper codewheels included.  I bought a Gamefest : Forgotten Realms Classics CD and all three codewheels were included.  Pool and Curse shared a Codewheel in that one side of the outer ring had the Pool codes printed on it, the other had the Curse codes, and each side had an inner ring.  Hillsfar was on a separate codewheel.  They need not have bothered, as Pool and Hillsfar use the exact same codes on their codewheel.  Pool/Hillsfar and Curse share the same letters in the same position in the 1st ring, as the translation idea requires.  Thirty six scans are required fully represent these codewheels.

Now suppose you wanted to spread your newly acquired game over your local BBS, but lacked the cracking skills to beat the codewheel protection.  How would you manage this :

While the place names and the dates are easy to type, unless you were a dynamite ASCII artist, you would need to provide text descriptions of the faces.  Skull, fat faced pirate with skullcap, female pirate with eyepatch, blond pirate, (Guybrush) wavy haired pirate, monkey, female pirate (Elaine), pirate with two eyepatches, masked cannibal, pirate with hat (LeChuck), pirate with widows peak and goatee, dead pirate with cutlass in forehead, dead pirate with scar, bald old man, pirate with knife between teeth.  It may take the user a few times since the game mixes and matches the upper facial features with the lower facial features.  There are 105 possible codes here, but the game can throw 225 possible upper/lower face combinations at you.  Fifteen scans will fully represent this codewheel.

The most complex codewheels are the ones with a third, middle ring.  This ring may have the code or it may have a window to point to the code on the outer ring.  Accolade loved these things and used them in most of their games from 1989-1992.   Here is a deconstructed example (not to true scale) :

Although the outer wheels use symbols, at least it is team logos.  There are 72 codes on the outer ring and 66 on the inner ring for a total of 138 codes.  In order to fully capture this codewheel, you would need to scan it 144 times!  You would need to turn the inner ring 12 times for each turn of the middle ring.  Clearly, scanning is not the ideal method to capture the properties of this wheel.  Not only that, there are 1,728 possible combinations of questions the game could ask you.  A table would be huge, and a separate program to generate the code would have been useless in a single task operating system like DOS.  Even so, I doubt the game actually asked more for a code from more than 30-40 combinations, because size constraints on floppy disk games also tend to scale down the ambitions of the copy protectionists.

The solution was to destroy a codewheel and let it be photocopied, or to crack the game.  Codewheel games seemed especially prone to cracking.  Its as if the challenge invited hackers to test their mettle against the latest and greatest in technology.

As the industry transitioned to CD-ROM, codewheels became less common, even for floppy games.  Most floppy games from 1992 to 1995 either used simpler document checks or neglected to implement copy protection at all, relying on the sheer number of disks to deter pirating.


Trixter said...
This comment has been removed by the author.
David Alastair Hayden said...

I preferred the code wheels to the random page of the book checks, because the wheels were nifty. I was a kid, what can I say?

Great site, by the way.