Difference between revisions of "Hollywood Collection"
| (2 intermediate revisions by the same user not shown) | |||
| Line 455: | Line 455: | ||
[[File:HollywoodCollection_Disk3_Ocean_parser_s0.g64]] | [[File:HollywoodCollection_Disk3_Ocean_parser_s0.g64]] | ||
| + | |||
| + | = Hollywood Collection Ghostbusters II vs Release Ghostbusters II = | ||
| + | |||
| + | '''Disk 4''' of the ''Hollywood Collection'' compilation contains a copy of | ||
| + | '''Ghostbusters II''' — the same game documented under its own | ||
| + | GMA89-protected release, which uses the standard family mechanism | ||
| + | (sync-length signature measured on track 38, sent to the C64, used as a | ||
| + | single repeating-byte XOR decryption key). For Hollywood Collection's | ||
| + | live tracing and static disk analysis both found | ||
| + | '''no functioning protection check at all''' in any locally-archived copy. | ||
| + | |||
| + | Having a genuine, actively-protected Ghostbusters II source | ||
| + | (<code>GhostbustersII_zrx_s0.g64</code>, measured key <code>$18</code>) and | ||
| + | Hollywood Collection's Disk 4 side by side made it possible to find not | ||
| + | just ''that'' the protection was removed, but the '''exact two-instruction | ||
| + | patch''' that removed it. | ||
| + | |||
| + | == Summary == | ||
| + | |||
| + | * The genuine disk's directory is deliberately near-empty and obfuscated (<code>as</code>, <code>gm1</code>, <code>side flag</code> only, BAM reporting <code>0 blocks free</code>) — the standard GMA-family convention. Hollywood Collection's Disk 4 directory is completely ordinary and legible, with individually-named game asset files and one conspicuous extra entry, <code>gmaread.src.mod</code>. | ||
| + | * <code>gm1.prg</code> is 4 bytes shorter than the genuine version (1440 vs. 1444 bytes) and otherwise byte-for-byte identical apart from address shifts caused by two edits. | ||
| + | * '''Edit 1:''' the <code>JSR $C800</code> instruction (the fixed drive-upload-and-execute trigger used throughout the whole GMA family) is deleted outright — not bypassed, not patched to skip on a flag, simply removed. The drive never seeks to track 38 at all. | ||
| + | * '''Edit 2:''' a single opcode byte inside the decrypt loop — <code>EOR $D000,Y</code> (<code>$59</code>) changed to <code>LDA $D000,Y</code> (<code>$B9</code>) — turns the XOR-decrypt pass into a harmless no-op self-copy. | ||
| + | * The disk's own game data was correspondingly re-saved as already-decrypted plaintext, matching the now-legible directory. | ||
| + | * <code>gmaread.src.mod</code> is an inert leftover file (bogus <code>$FFFF</code> load address, never actually loaded) containing recognizable fragments of the removed drive-upload routine — almost certainly the cracker's own extracted copy of the code they cut out. | ||
| + | |||
| + | == Directory comparison == | ||
| + | |||
| + | Genuine Ghostbusters II source (protection active): | ||
| + | |||
| + | <pre> | ||
| + | 0 "gbii " | ||
| + | 0 "as" prg | ||
| + | 0 "gm1" prg | ||
| + | 1 "side flag" prg | ||
| + | 0 blocks free. | ||
| + | </pre> | ||
| + | |||
| + | Hollywood Collection, Disk 4 (protection removed): | ||
| + | |||
| + | <pre> | ||
| + | 0 "gbii " pj 2a | ||
| + | 1 "as" prg | ||
| + | 2 "gmaread.src.mod" prg | ||
| + | 6 "gm1" prg | ||
| + | 4 "mask2" prg | ||
| + | 4 "mask1" prg | ||
| + | 24 "vigosm image" prg | ||
| + | 24 "janosz image" prg | ||
| + | 24 "venkdana image" prg | ||
| + | 5 "vii text" prg | ||
| + | 4 "win text" prg | ||
| + | 14 "music b" prg | ||
| + | 1 "side flag" prg | ||
| + | 17 "music a" prg | ||
| + | 9 "gbiichars" prg | ||
| + | 121 "vigo 0800-8000" prg | ||
| + | 81 "vigo 8000-cfff" prg | ||
| + | 5 "vigo fc00-ffff" prg | ||
| + | 5 "gm2" prg | ||
| + | 313 blocks free. | ||
| + | </pre> | ||
| + | |||
| + | The genuine disk's near-empty, obfuscated directory (real content hidden | ||
| + | outside the normal directory chain, BAM deliberately reporting the disk as | ||
| + | full) is the standard GMA-family convention documented throughout this | ||
| + | project. Hollywood Collection's directory is a completely ordinary, | ||
| + | legible file listing — the game's graphics, music, and code blocks are all | ||
| + | individually named and directly loadable, consistent with data that no | ||
| + | longer needs a decrypt step at load time. | ||
| + | |||
| + | == Edit 1: the upload trigger is deleted, not bypassed == | ||
| + | |||
| + | <pre> | ||
| + | ;; ---- genuine (protection active) ---- | ||
| + | L03A6: BNE L03A6 | ||
| + | LDA #$37 | ||
| + | STA $01 | ||
| + | LDA #$00 | ||
| + | JSR sub_0461 ; load file 0 | ||
| + | JSR $C800 ; <=== upload + execute the drive-side | ||
| + | ; signature check, collect measured | ||
| + | ; key byte in A | ||
| + | PHA ; stash the REAL measured key | ||
| + | LDA #$01 | ||
| + | JSR sub_0461 ; load file 1 | ||
| + | ... | ||
| + | |||
| + | ;; ---- Hollywood Collection Disk 4 (patched) ---- | ||
| + | L03A6: BNE L03A6 | ||
| + | LDA #$37 | ||
| + | STA $01 | ||
| + | LDA #$00 | ||
| + | JSR sub_045E ; load file 0 (same routine, renamed by the | ||
| + | ; disassembler only because addresses shifted) | ||
| + | PHA ; <=== stashes whatever A happened to hold | ||
| + | ; after the LOAD call - NOT a measured | ||
| + | ; key. The entire "JSR $C800" instruction | ||
| + | ; (bytes 20 00 C8) is simply gone. | ||
| + | LDA #$01 | ||
| + | JSR sub_045E ; load file 1 | ||
| + | ... | ||
| + | </pre> | ||
| + | |||
| + | Confirmed at the raw byte level: searching the genuine file for | ||
| + | <code>20 00 C8</code> (<code>JSR $C800</code>) finds it at file offset 127; | ||
| + | the identical search against Hollywood Collection's <code>gm1.prg</code> | ||
| + | finds '''nothing''' anywhere in the file. The 3-byte call was cut out | ||
| + | entirely, not disabled by a patched branch or a flag check — the loader's | ||
| + | control flow simply never reaches the drive-side code at all. | ||
| + | |||
| + | == Edit 2: a single-byte opcode patch neutralizes the decrypt loop == | ||
| + | |||
| + | Even though nothing meaningful reaches it after Edit 1, the decrypt loop | ||
| + | still runs — over whatever garbage value the removed <code>JSR $C800</code> | ||
| + | would otherwise have replaced with a real key: | ||
| + | |||
| + | <pre> | ||
| + | ;; ---- genuine ---- | ||
| + | TXA | ||
| + | EOR $D000,Y ; 8A 59 00 D0 - actual XOR decrypt against the | ||
| + | STA $D000,Y ; 99 00 D0 key in X, byte by byte | ||
| + | |||
| + | ;; ---- Hollywood Collection Disk 4 ---- | ||
| + | TXA | ||
| + | LDA $D000,Y ; 8A B9 00 D0 - reads the byte and immediately | ||
| + | STA $D000,Y ; 99 00 D0 overwrites A, discarding the | ||
| + | ; "key" TXA just loaded - net | ||
| + | ; effect: read byte, write the | ||
| + | ; same byte back unchanged | ||
| + | </pre> | ||
| + | |||
| + | One byte — <code>$59</code> (<code>EOR abs,Y</code>) changed to | ||
| + | <code>$B9</code> (<code>LDA abs,Y</code>) — turns the entire decrypt pass | ||
| + | into a no-op self-copy loop. | ||
| + | |||
| + | == The leftover: <code>gmaread.src.mod</code> == | ||
| + | |||
| + | A 374-byte file present only on Hollywood Collection's Disk 4, with a | ||
| + | bogus <code>$FFFF</code> load address header — meaning nothing ever | ||
| + | actually loads it; it just sits in the directory unused. Its content is | ||
| + | unmistakably recognizable as fragments of the family's standard drive-side | ||
| + | upload machinery: the <code>M-W</code> chunk-upload loop that builds a | ||
| + | memory-write command byte by byte, and — near the end of the file — the | ||
| + | exact <code>LDA $1C00 / AND #$9F / STA $1C00</code> IEC-bus-initialization | ||
| + | sequence that opens every drive-side program documented throughout this | ||
| + | project's GMA-family investigations. This is almost certainly the | ||
| + | cracker's own extracted copy of the code removed from <code>gm1.prg</code> | ||
| + | in Edit 1 above — kept as a personal reference or backup rather than | ||
| + | deleted, and an incidental second confirmation of the shared drive-side | ||
| + | routine's own opening bytes for a title otherwise absent from every other | ||
| + | cross-check in the GMA89 survey. | ||
| + | |||
| + | == Conclusion == | ||
| + | |||
| + | Hollywood Collection's Disk 4 is a clean, complete crack of Ghostbusters | ||
| + | II's GMA89 protection — not an alternate build that never had one, and not | ||
| + | evidence against anything documented elsewhere about the mechanism itself. | ||
| + | The crack: | ||
| + | |||
| + | # Removes the drive-upload trigger, so the drive never seeks to track 38 at all (matching the D64-conversion and live-boot results that first flagged this disk as having no functioning check). | ||
| + | # Neutralizes the decrypt loop as a defense-in-depth measure, even though by that point it's only ever fed garbage. | ||
| + | # Replaces the on-disk data with its already-decrypted plaintext, matching the disk's now-ordinary, legible directory. | ||
| + | |||
| + | Ghostbusters II's own dedicated GMA89 sources remain the correct place to | ||
| + | find this game's actual measured key (<code>$18</code>); Hollywood | ||
| + | Collection's Disk 4 is documented here specifically as a case study in what | ||
| + | a complete GMA-family crack looks like at the byte level, not as a fourth | ||
| + | source for the key. | ||
Latest revision as of 00:09, 29 August 2026
Contents
Contents
Disk 1
Disk 2
Disk 3
Disk 4
The german release of the compilation does not include Robocop.
Source 1
| Property | Data |
|---|---|
| Title | Hollywood Collection |
| Publisher and/or Developer | Ocean Software Ltd. |
| Year | 1990 |
| Disk(s) | 4? |
| Number of Index Holes | 2 |
| Media Type | 5.25 DSDD |
| Retail, Budget or Compilation (with name) | Compilation |
| Country of Release | UK |
| Language(s) | English |
| Platform | C64 |
| NTSC or PAL | PAL |
| Protection | see streams section |
| Working? | Yes, but incomplete |
| Archived | 24 Oct 2014 enigma |
| Verified by | enigma |
Streams
Disk 4
File:Streams GhostbustersII enigma.zip
G64
Disk 4
Mastered with a cracked GMA89 protection, see discussion at the end of this page
Source 2
| Property | Data |
|---|---|
| Title | Hollywood Collection |
| Publisher and/or Developer | Ocean Software Ltd. |
| Year | 1990 |
| Disk(s) | 4? |
| Number of Index Holes | 1 |
| Media Type | 5.25 DSDD |
| Retail, Budget or Compilation (with name) | Compilation |
| Country of Release | UK |
| Language(s) | English |
| Platform | C64 |
| NTSC or PAL | PAL |
| Protection | see streams section |
| Working? | Yes, but incomplete |
| Archived | 19 Oct 2013 jupp3 |
| Verified by | enigma |
Purchased from: From the collection of J-P.J.
Streams
Disk 3
File:Streams HollywoodCollection incomplete disk3 jupp3.zip
G64
Disk 3
Protection: CYAN Loader A
File:HollywoodCollection Disk3 jupp3 s0.g64
Source 3
| Property | Data |
|---|---|
| Title | Hollywood Collection |
| Publisher and/or Developer | Ocean Software Ltd. |
| Year | 1990 |
| Disk(s) | 4 |
| Number of Index Holes | 2, 1, 1, 2 |
| Media Type | 5.25 DSDD |
| Retail, Budget or Compilation (with name) | Compilation |
| Country of Release | UK |
| Language(s) | English |
| Platform | C64 |
| NTSC or PAL | PAL |
| Protection | see streams section |
| Working? | Yes |
| Archived | 24 Jun 2013 Rakki |
| Verified by | enigma |
Purchased from: Tori.fi
Rakki: CIB
Streams
Disk 1
Protection: None
File:Streams HollywoodCollection disk1 rakki.zip
Disk 2
Protection: Ocean Protection
File:Streams HollywoodCollection disk2 rakki.zip
Disk 3
Protection: CYAN Loader A
File:Streams HollywoodCollection disk3 rakki.zip
Disk 4
Mastered with a cracked GMA89 protection, see discussion at the end of this page
File:Streams HollywoodCollection disk4 rakki.zip
G64
Disk 1
File:HollywoodCollection Disk1 rakki s0.g64
File:HollywoodCollection Disk1 rakki s1.g64
Disk 2
File:HollywoodCollection Disk2 rakki s0.g64
Disk side 1 is empty.
Disk 3
File:HollywoodCollection Disk3 rakki s0.g64
Disk side 1 is empty.
Disk 4
File:HollywoodCollection Disk4 rakki s0.g64
File:HollywoodCollection Disk4 rakki s1.g64
Source 4
| Property | Data |
|---|---|
| Title | Hollywood Collection |
| Publisher and/or Developer | Ocean Software Ltd. |
| Year | 1990 |
| Disk(s) | 4 |
| Number of Index Holes | (2, 1), -, 1, 1 |
| Media Type | 5.25 DSDD |
| Retail, Budget or Compilation (with name) | Compilation |
| Country of Release | UK (DE? see comment) |
| Language(s) | English |
| Platform | C64 |
| NTSC or PAL | PAL |
| Protection | see streams section |
| Working? | Yes, but incomplete? (see comment) |
| Archived | 4 Dec 2013 Rakki |
| Verified by | enigma |
Purchased from: ebay.de / sebkotska
Rakki: Loose. Disk 2 missing.
enigma: It could be that the disks originate from the german release of the compilation. In that case disk 2 with Robocop was not part of the compilation.
Streams
Disk 1
Protection: None
File:Streams HollywoodCollection Ocean incomplete disk1 rakki.zip
File:Streams HollywoodCollection Ocean incomplete 2nd copy disk1 rakki.zip
Disk 2
Missing
Disk 3
Protection: CYAN Loader A
File:Streams HollywoodCollection Ocean incomplete disk3 rakki.zip
Disk 4
Mastered with a cracked GMA89 protection, see discussion at the end of this page
File:Streams HollywoodCollection Ocean incomplete disk4 rakki.zip
G64
Disk 1
File:HollywoodCollection alt Disk1 rakki s0.g64
File:HollywoodCollection alt Disk1 rakki s1.g64
File:HollywoodCollection alt Disk1 2nd copy rakki s0.g64
File:HollywoodCollection alt Disk1 2nd copy rakki s1.g64
Disk 2
Missing
Disk 3
File:HollywoodCollection alt Disk3 rakki s0.g64
Disk side 1 is empty.
Disk 4
File:HollywoodCollection alt Disk4 rakki s0.g64
File:HollywoodCollection alt Disk4 rakki s1.g64
Source 5
| Property | Data |
|---|---|
| Title | Hollywood Collection |
| Publisher and/or Developer | Ocean Software Ltd. |
| Year | 1990 |
| Disk(s) | 3 |
| Number of Index Holes | 2, -, 2, 1 |
| Media Type | 5.25 DSDD |
| Retail, Budget or Compilation (with name) | Compilation |
| Country of Release | DE |
| Language(s) | English |
| Platform | C64 |
| NTSC or PAL | PAL |
| Protection | see streams section |
| Working? | Yes |
| Archived | 8 Nov 2020 Quader |
| Verified by | enigma |
The german release of the compilation does not include disk 2 with Robocop.
For Disk 3 a second disk was dumped as well.
Protection
Disk 1 Batman: Protection: None
Disk 3 Indiana Jones and the Last Crusade: The Action Game: Protection: CYAN Loader A
Disk 4 Ghostbusters II: Mastered with a cracked GMA89 protection, see discussion at the end of this page
SCP
File:SCP Compilation Hollywood Collection quader.zip
enigma: In the SCPs the back side of Batman was modified. It also has an error 5 on track 20 in the data area of the game.
NBZ
File:NBZ Compilation Hollywood Collection quader.zip
G64
Disk 1
File:Batman - The Movie - Compilation Hollywood Collection - Disk A - SCP.g64
File:Batman - The Movie - Compilation Hollywood Collection - Disk B - NBZ.g64
Disk 2
Missing
Disk 3
File:Indiana Jones 3 - Compilation Hollywood Collection - A -SCP.g64
File:Indiana Jones 3 - Compilation Hollywood Collection - 2ndCopy - A -SCP.g64
Disk side 1 is empty.
Disk 4
File:Ghostbusters 2 - Compilation Hollywood Collection - A - SCP.g64
File:Ghostbusters 2 - Compilation Hollywood Collection - B - SCP.g64
Additional Information
Manuals
Scans by quader.
Source 6
| Property | Data |
|---|---|
| Title | Hollywood Collection |
| Publisher and/or Developer | Ocean Software Ltd. |
| Year | 1990 |
| Disk(s) | 4 |
| Number of Index Holes | 1 |
| Media Type | 5.25 DSDD |
| Retail, Budget or Compilation (with name) | Compilation |
| Country of Release | UK |
| Language(s) | English |
| Platform | C64 |
| NTSC or PAL | PAL |
| Protection | see streams section |
| Working? | Yes, but incomplete |
| Archived | 17 Jul 2021 parser |
| Verified by | enigma |
Streams
Disk 3
File:Streams HollywoodCollection Disk3 Ocean parser.zip
G64
Disk 3
Protection: CYAN Loader A
File:HollywoodCollection Disk3 Ocean parser s0.g64
Hollywood Collection Ghostbusters II vs Release Ghostbusters II
Disk 4 of the Hollywood Collection compilation contains a copy of Ghostbusters II — the same game documented under its own GMA89-protected release, which uses the standard family mechanism (sync-length signature measured on track 38, sent to the C64, used as a single repeating-byte XOR decryption key). For Hollywood Collection's live tracing and static disk analysis both found no functioning protection check at all in any locally-archived copy.
Having a genuine, actively-protected Ghostbusters II source
(GhostbustersII_zrx_s0.g64, measured key $18) and
Hollywood Collection's Disk 4 side by side made it possible to find not
just that the protection was removed, but the exact two-instruction
patch that removed it.
Summary
- The genuine disk's directory is deliberately near-empty and obfuscated (
as,gm1,side flagonly, BAM reporting0 blocks free) — the standard GMA-family convention. Hollywood Collection's Disk 4 directory is completely ordinary and legible, with individually-named game asset files and one conspicuous extra entry,gmaread.src.mod. gm1.prgis 4 bytes shorter than the genuine version (1440 vs. 1444 bytes) and otherwise byte-for-byte identical apart from address shifts caused by two edits.- Edit 1: the
JSR $C800instruction (the fixed drive-upload-and-execute trigger used throughout the whole GMA family) is deleted outright — not bypassed, not patched to skip on a flag, simply removed. The drive never seeks to track 38 at all. - Edit 2: a single opcode byte inside the decrypt loop —
EOR $D000,Y($59) changed toLDA $D000,Y($B9) — turns the XOR-decrypt pass into a harmless no-op self-copy. - The disk's own game data was correspondingly re-saved as already-decrypted plaintext, matching the now-legible directory.
gmaread.src.modis an inert leftover file (bogus$FFFFload address, never actually loaded) containing recognizable fragments of the removed drive-upload routine — almost certainly the cracker's own extracted copy of the code they cut out.
Directory comparison
Genuine Ghostbusters II source (protection active):
0 "gbii " 0 "as" prg 0 "gm1" prg 1 "side flag" prg 0 blocks free.
Hollywood Collection, Disk 4 (protection removed):
0 "gbii " pj 2a 1 "as" prg 2 "gmaread.src.mod" prg 6 "gm1" prg 4 "mask2" prg 4 "mask1" prg 24 "vigosm image" prg 24 "janosz image" prg 24 "venkdana image" prg 5 "vii text" prg 4 "win text" prg 14 "music b" prg 1 "side flag" prg 17 "music a" prg 9 "gbiichars" prg 121 "vigo 0800-8000" prg 81 "vigo 8000-cfff" prg 5 "vigo fc00-ffff" prg 5 "gm2" prg 313 blocks free.
The genuine disk's near-empty, obfuscated directory (real content hidden outside the normal directory chain, BAM deliberately reporting the disk as full) is the standard GMA-family convention documented throughout this project. Hollywood Collection's directory is a completely ordinary, legible file listing — the game's graphics, music, and code blocks are all individually named and directly loadable, consistent with data that no longer needs a decrypt step at load time.
Edit 1: the upload trigger is deleted, not bypassed
;; ---- genuine (protection active) ----
L03A6: BNE L03A6
LDA #$37
STA $01
LDA #$00
JSR sub_0461 ; load file 0
JSR $C800 ; <=== upload + execute the drive-side
; signature check, collect measured
; key byte in A
PHA ; stash the REAL measured key
LDA #$01
JSR sub_0461 ; load file 1
...
;; ---- Hollywood Collection Disk 4 (patched) ----
L03A6: BNE L03A6
LDA #$37
STA $01
LDA #$00
JSR sub_045E ; load file 0 (same routine, renamed by the
; disassembler only because addresses shifted)
PHA ; <=== stashes whatever A happened to hold
; after the LOAD call - NOT a measured
; key. The entire "JSR $C800" instruction
; (bytes 20 00 C8) is simply gone.
LDA #$01
JSR sub_045E ; load file 1
...
Confirmed at the raw byte level: searching the genuine file for
20 00 C8 (JSR $C800) finds it at file offset 127;
the identical search against Hollywood Collection's gm1.prg
finds nothing anywhere in the file. The 3-byte call was cut out
entirely, not disabled by a patched branch or a flag check — the loader's
control flow simply never reaches the drive-side code at all.
Edit 2: a single-byte opcode patch neutralizes the decrypt loop
Even though nothing meaningful reaches it after Edit 1, the decrypt loop
still runs — over whatever garbage value the removed JSR $C800
would otherwise have replaced with a real key:
;; ---- genuine ----
TXA
EOR $D000,Y ; 8A 59 00 D0 - actual XOR decrypt against the
STA $D000,Y ; 99 00 D0 key in X, byte by byte
;; ---- Hollywood Collection Disk 4 ----
TXA
LDA $D000,Y ; 8A B9 00 D0 - reads the byte and immediately
STA $D000,Y ; 99 00 D0 overwrites A, discarding the
; "key" TXA just loaded - net
; effect: read byte, write the
; same byte back unchanged
One byte — $59 (EOR abs,Y) changed to
$B9 (LDA abs,Y) — turns the entire decrypt pass
into a no-op self-copy loop.
The leftover: gmaread.src.mod
A 374-byte file present only on Hollywood Collection's Disk 4, with a
bogus $FFFF load address header — meaning nothing ever
actually loads it; it just sits in the directory unused. Its content is
unmistakably recognizable as fragments of the family's standard drive-side
upload machinery: the M-W chunk-upload loop that builds a
memory-write command byte by byte, and — near the end of the file — the
exact LDA $1C00 / AND #$9F / STA $1C00 IEC-bus-initialization
sequence that opens every drive-side program documented throughout this
project's GMA-family investigations. This is almost certainly the
cracker's own extracted copy of the code removed from gm1.prg
in Edit 1 above — kept as a personal reference or backup rather than
deleted, and an incidental second confirmation of the shared drive-side
routine's own opening bytes for a title otherwise absent from every other
cross-check in the GMA89 survey.
Conclusion
Hollywood Collection's Disk 4 is a clean, complete crack of Ghostbusters II's GMA89 protection — not an alternate build that never had one, and not evidence against anything documented elsewhere about the mechanism itself. The crack:
- Removes the drive-upload trigger, so the drive never seeks to track 38 at all (matching the D64-conversion and live-boot results that first flagged this disk as having no functioning check).
- Neutralizes the decrypt loop as a defense-in-depth measure, even though by that point it's only ever fed garbage.
- Replaces the on-disk data with its already-decrypted plaintext, matching the disk's now-ordinary, legible directory.
Ghostbusters II's own dedicated GMA89 sources remain the correct place to
find this game's actual measured key ($18); Hollywood
Collection's Disk 4 is documented here specifically as a case study in what
a complete GMA-family crack looks like at the byte level, not as a fourth
source for the key.