So, I took a look at this, and the protection is on track 6. It tries reading sector 5 (which fails), then reads it “using ports”, by communicating directly with the FDC (which also fails on my Pentium, but works on the 286, timing issues I assume).
Anyway, I copied the sector data from the Snatchit image and put it in the provided image file, modified the read routine in 2 places, I assume one is for PC and one for PCjr. The only data it uses from this sector are 8 bytes, starting at 100h. These 4 words are used to add to the CS:IP and SS:SP it will set up after the rest of the init is done. If this sector is all 00s, it’ll end up jumping to 70:0 instead of 80:0.
Also, I couldn’t debug the part where it reads using ports, but it seems that it doesn’t read into the same memory space as it tried to read using INT 13, so I had to modify where it accesses this data in 4 places, once where it checks the last byte of the sector (should be F7), and once where it loads the values from the sector. The exact same code is found in 2 places, once for PC, once for PCjr.
It checks the Machine ID code, and compares it to FD, which should be PCjr. When I made it think it was running on a PCjr in the debugger, it loads from different areas on the disk. However, for whatever reason, the read to the (no longer) protected sector failed here, no idea why, but it shouldn’t if booted properly.
Also, the game should be pretty easy to convert to DOS, the disk contains Sierra’s usual LOAD, MAIN.EXE and MAINJR.EXE files. The only INT 13s found in the EXE files are reads and writes to the highscore (track 27, sector 1 on both versions, so the 2 versions share highscores), and the copy protection check. Running MAIN.EXE from the harddrive on my 286, with the Snatchit produced disk in drive A makes the game start and run properly.
Cracked image file is done. It’d help a lot if it could be verified that it works on a real PCjr.
DOS loader might come after lunch 😉