1# This patch modifies CW.EXE from the 1984 DOS release of "Castle Wolfenstein" to stub out the faulty
2# OS tamper protection checks, which were part of the original copy protection code for this game. This
3# game used quite sophisticated copy protection for 1984, employing polymorphic code to both check for
4# pirated copies, and trigger the blocks when this was detected at multiple points in code. While
5# "cracked" versions of the game have been circulating for 40 years, there was another hidden issue
6# lurking in the code which remained unaddressed, and would cause problems even for original disks on
7# original hardware without any cracks being performed.
8#
9# The authors of Castle Wolfenstein had another layer of independent copy protection checks hidden in
10# the code, which didn't verify the actual disk itself, rather it is probably one of, if not the earliest
11# example of OS-level anti-tampering protection. The code has a routine, triggered when starting a new
12# game, which checks the address of the interrupt routine handler 0x13 for low-level floppy disk access
13# appears to point directly into the BIOS routines. The original intent is, if the interrupt appears to
14# have been redirected to user code, assume the user is trying to bypass the copy protection via a patched
15# disk IO routine, to make the game code think it's seeing an original floppy disc when it actually isn't.
16# If the routine appears to have been redirected, it'll set a "tamper" flag, and trigger the "You're Caught"
17# ending routine. That's deliberate you see, saying "You're Caught" is a personal message to the would-be
18# pirate/hacker, saying "we've caught you trying to crack our software"! The problem is, while on DOS
19# 1.x/2.x the original PC-XT disk access routines may have gone direct to the BIOS, that was no longer the
20# case as of DOS 3.x and up, meaning this tamper protection first broke things for legitimate users back
21# in 1985, just a year after launch! This was a case of the programmers getting a little too clever.
22#
23# It wasn't even just this OS-level anti-tampering protection in the code. It turns out there was yet
24# another layer of protection, which is possibly the earliest example of anti-debugger protection. There
25# were additional checks, independent of the disk IO redirection check, which were designed to trigger
26# if a debugger was detected. First, on program start, there was a check for if any software breakpoints
27# appeared to be active by checking the address of the interrupt routine handler 0x03. If this was detected
28# the tamper protection would be tripped. Additionally, when the game was running, polling was done to
29# check if an interrupt handler 0x01 appeared to be hooked for single-stepping. Debugging tools on systems
30# later than the PC-XT with the 8086 processor would generally make use of hardware debugging registers
31# on the 286+ CPU rather than hooking software interrupts like these, but these anti-debugger checks
32# could still in theory cause problems on some DOS releases because of the way they're implemented. If
33# any of the software interrupt addresses don't match expected known values, the protection will be
34# tripped, and since these addresses are not fixed constants intended to remain unchanged, apart from
35# debuggers actually using trace and breakpoint features, different versions of DOS, let alone third
36# party clones or variants, may legitimately have different addresses, which would trip these protection
37# routines.
38#
39# This patch removes all identified anti-tamper and anti-debugger protection routines in the executable.
40# It does NOT remove the original actual disc copy protection, for that you need to look elsewhere,
41# however this patch can be applied to either a cracked or original CW.EXE file. This patch will make the
42# game work as intended on all hardware, not the narrow window of PC-XT machines running DOS 2.x or below.
43# Note that since this game has no speed clocking and is therefore timing sensitive, we have preserved the
44# execution time of the original unpatched code.