When WerWolv attempted to run a childhood game called 'Findus bei den Mucklas' on modern hardware, they encountered sophisticated copy protection measures that had prevented successful backups for years. The game, distributed across three disk image files (.ccd, .cue, .img), initially appeared to install correctly through WINE, but immediately failed with a 'Missing CD' error upon execution. This triggered a deep dive into the game's protection mechanisms, revealing that the developers had implemented not one, but three distinct systems designed to thwart duplication attempts.
This error message appears when the game's copy protection fails to detect the original CD, as described in the first paragraph of the article.
The first layer of protection manifested during the extraction process itself. When attempting to access the disk image, WerWolv discovered that many files appeared duplicated - once as the legitimate game data and again as either 0-byte or 256-byte files filled with random garbage. This deliberate corruption of directory entries was designed to confuse extraction tools into reading the decoy files instead of the actual game assets. While Windows could correctly navigate to the real files, tools like PeaZip, Ark, Dolphin, and 7z would show inconsistent file listings depending on how they handled the malformed directory structure, requiring manual selection of the proper files to proceed. Beyond this initial hurdle, the game employed a more sophisticated drive-checking mechanism. Analysis of the embedded Director file (a .dxr container within the executable) revealed Lingo script code that systematically checked drives D through Z for the presence of a specific 'p3media' folder - a telltale sign of the original game CD. The script would iterate through each possible drive letter, querying the drive type until it found one reporting as 'CD-ROM' containing the expected folder structure. Only then would it set up the necessary search paths for game resources; failure to detect this configuration would trigger the 'Missing CD' error and quit the game. WerWolv bypassed this check by patching a conditional jump in the Lingo bytecode, altering the instruction to always proceed with the drive setup routine regardless of whether a physical CD was detected.
This image illustrates the first layer of protection where legitimate game data is duplicated with zero-byte or garbage-filled files to mislead extraction utilities.
Perhaps most intriguingly, the game implemented a tertiary protection layer that called into an external DLL named optgraph.dll. The embedded script would load this DLL and execute its initdisplay() function, then verify that the return value matched a specific magic number (26079537). If the value didn't match - which would occur when running without the original CD or proper emulation - the game would display a 'Disc Error!' message and terminate. This approach represents a common anti-tampering technique where protection logic is offloaded to external binary components, making simple script patching insufficient. While WerWolv notes several potential solutions including making the game believe it's running on Mac (where this check wasn't implemented) or patching the DLL itself, the article concludes with the successful execution of the game's intro video after addressing the first two protection layers, leaving the third layer as an unresolved obstacle for full playability.
This shows the result after overcoming the first two copy protection mechanisms, as described in the article's conclusion.