Retrocomputing Stack Exchange is a question and answer site for vintage-computer hobbyists interested in restoring, preserving, and using the classic computer and gaming systems of yesteryear. It only takes a minute to sign up.
Sign up to join this community
I was watching a video on netlist simulation of the 6502. The presenter mentions how the 6502 has a double store upon using INCY, and then offhandedly mentions that this can be used for copy protection.
How does a double write to a spot in memory enable the ability to have copy protection?
The presenter mentions how the 6502 has a double store upon using INCY,
Not sure what an INCY should be or how it's related to the video shown.
What is explained are the standard workings of a 6502 INC instruction. INC increments a memory cell by reading it, incrementing what's read and writing it again. Just, to do so it needs a cycle to increment the value (*1). Problem is that each and every cycle of a 6502 is a memory cycle (*2). Whenever there is an internal cycle, the CPU issues an external cycle as well, usually by repeating the last. This is true for all page crossing indexing as well as RMW (Read Modify Write) instructions like INC, DEC and all in memory shifts. It's always the second before last cycle (*3). In most cases it's a read cycle, but with RMW it's a write cycle using the last read value.
and then offhandedly mentions that this can be used for copy protection.
Not really, what he mentions (at 19:21) is that this behaviour can be detected by hardware - as writing twice the same address is a behaviour only (*4) RMW instructions and only on a genuine NMOS 6500 (*5) will show.
He does only mention the behaviour, not any further usage. Coming up with something to do when detecting the behaviour is not part of the speech - nor is it how to detect. He's simply tickling the audience' sense for creativity.
How does a double write to a spot in memory enable the ability to have copy protection?
That's up to you. The point is that this is a very unique feature of an otherwise inconspicuous instruction. Find a way to use it. Like switching in another ROM when detecting it, or trigger an protection interrupt if the feature doesn't get activated once per frame - or whatsoever.
And how to detect? [Follow up rhetorical question]
As so often this depends what the goal is
A simple case would be to detect a certain address with incorporated R/W in write state - like in ROM - and set an RS flip flop when it's accessed with, or reset it when any other address is accessed. Now a state of a (previous) set flip flop AND an incoming address detection will only happen during a RMW instruction accessing that location, not any other instruction (*6).
A related circuitry will need as little as half a 7474 and 1/4th a 7400 in addition to otherwise already existing circuitry - easy to hide in a complex (and never published) schematic - or even better within a decoder circuit, like a PAL, modifying it's behaviour in an extreme hard to detect way.
Based on such detection a lot can be done - from simply mapping in another ROM over doing so for just a few cycles, or whats ever, or several cycles later and then for some cycles, or doing so for hardware registers otherwise not visible. And so on.
Be creative - more creative than you expect the hacker to be.
So long story short: This section of the speech is not about any specific copy protection but a specific behaviour that can easy be detected and used in surprising ways.
Be Creative
*1 - Can't be done hidden.
*2 - It's a way how they simplified the bus interface. Unlike other CPUs the 6500 series do not know any internal cycle. Each and every cycle is a memory cycle.
*3 - See this answer to 'What is the MOS 6502 doing on each cycle of an instruction?' for a basic explanation of 6502 instruction cycles regarding memory.
*4 - Err ... NO. There is another case with subroutine calls (JSR). Here the stack address for high byte of the return address is as well written twice. First with the low byte of the address of the last byte of the jump instruction, then with the high byte of the return address.
*5 - The behaviour has been changed with the CMOS version. Now all internal cycles are read cycles, including RMW instructions.
*6 - Caveat: If the decoded address is the (whole) stack, than JSR or interrupts will trigger it as well when pushing the their return address. Of course,this can be again be used to flip some hardware,or decoding,when done from the right place. Forgeing CPU watching decoders into a PAL will already make a pretty nifty protection chip. Posibilities are endless and beautiful :))
