[dunham]

It's much simpler than weak bits, but I remember one of the Ultima games for DOS had a track with a small sector embedded in the middle of a long sector. So from the point of view of the controller after decoding, there were more sectors than could be written onto a track.

All the copy protection did was decrypt itself, read the starting address of the executable from a sector on that track, and jump to it. My fix was to just stuff that address back into the executable header. (I had actually purchased the game, I was just tired of having to insert the floppy every time I ran it off of the hard drive.)