"CYAN" Protection Description
* This protection was disassembled, defeated, and documented by "Jani" in May, 2005.
* Copy protection author/originator is unknown, but it is used extensively on later European-released games by U.S. Gold, Sega, Mindscape, and Gremlin.
* We call it the "CYAN" loader because of the tell-tale way in which copies of these disks fail. The disk drive thrashes for a while, then the screen border turns to the CYAN color, followed by a system reset.
Although many of the games use different loaders (some fast, some not) all share a common copy protection check at boot that is located on track 5s5. The code is XOR'd many times, so decryption is a painful process.
There are two versions of the actual protection check- the older ones check for a signature on track 40s16, and the newer ones check for bad GCR on track 32s1. This latter version checks this a total of 8 times and clears the BAM in between each try, so the drive seeks back and forth across the disk making quite a menacing noise.
After the initial protection check is disabled, they do not check it again, so the disk can be copied cleanly and works in the emulators from a D64. Jani came up with a two-byte patch that defeats both versions of the protection completely.
This is done directly to an original disk converted to a D64:
offset 0x0592D 0xA2
offset 0x05935 0x0f
The disks can be remastered in unmodified form with the original bad GCR in place and play fine. They boot and play only on a PAL computer without any cartridges installed.