|
|
IDENTIFICATION SERVEUR : 10.0.97.1 - CLIENT : 54.167.196.208 |
|
Voir le sujet précédent :: Voir le sujet suivant |
Auteur |
Message |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2928 Localisation: Le Chesnay, France
|
Posté le: Jeu 28 Déc 2017, 21:24 Sujet du message: Bookends v1 and v1.1 (Sensible software, 1983) |
|
|
#988 - This is a utility software to manage your library. Search data thanks to advanced features.
Note that I've generated v1.1 from the .FDI copy provided by Jorma H. and I've copied the files onto my fresh crack of v1.0. What is v1.1 is the program, not the protection
Disk structure
This is a weird disk. Single-sided but the noise made by the disk drive is frightening. The disk does not boot on a IIgs with the smartport interface, it relies on the open phase of the Disk II interface card. But I had a IIe with such an interface card.
Tracks 2-3 and F-22 can be copied, the others are not readable.
From T15, we have the executable and sample data. So, we believe that the first tracks contain the boot code and prevent the rest from running fine.
Protection type
This is a weird disk. I knew that Sensible Software made heavy protections and I was not disappointed but they are made to prevent boot tracing and once you have the correct data in memory, the game is over!
What do we find?
- encoded data (boot 2 at $300 uses key #$99)
- nibbles read in memory and decyphered once loaded (thanks to the same key)
- nibble count (two because two is better than one)
- load addresses not in RAM but stored in nibbles! You know, like EDD!
- key generated from the firmware ROM (grrr, not good for compatibility but now it runs on a IIgs)
- mandatory data stored in the keyboard buffer at $200..$202
- load code in the text screen at $400..$7FF
Arrgghh!
Boot trace
Note that there are some code in the next messages of this thread but I have not disassembled all of them, I will over time.
We start with our usual move:
9600<C600.C6FFM
96F8:20 DA FD 60
9600G
01
We run the first part of the crack on a //e because it does not boot on a IIgs
The code is moved to $200 (just like DOS 3.2) and it loads the next stage at $300 where we find the first encoded data from $33F to $3FF. The key is stored at $200 and is the value of the first byte of the sector: #$99
96F8:A9 98 8D 43 08 4C 01 08
9800:A9 00 8D 31 03 4C 01 03
9600G
*beep*
At $331 restore the A9 value.
Now, the code searches for the nibbles DB B7 and loads the following nibbles at $7800..$7FFF. The code at $35F "unpacks" them at $400..$7FF and jumps to $400.
Now, the code (the one is the next messages) moves the arm, checks the nibbles, moves the arm, etc. and then loads the following data:
- the intro picture at $4000..$5FFF
- the boot code at $88C.$108B
- the DOS 3.3 image at $9D00..$BFFF
by loading nibbles at $9000..$9AFF, decyphering them and putting them at the right place.
What I did is disassemble the code at $400..$7FF and rewrite some parts of it to load the mandatory data in memory, save the mandatory values ($200..$202) and send control to me. That part was done on a IIgs, so I could save memory through a bit of 16-bit code (my modified code at $300..$7FF in bank $10 copied to bank $00 and executed there).
It WORKED!
So, in memory I have:
- the boot code at $88C..$108B
- the boot image at $4000..$5FFF
- the DOS 3.3 image at $9D00..$BFFF
I moved the data in bank $20 of my IIgs
How to normalize
First, I INIT HELLO,D2 a blank disk
Then, I copied TF-T22,D1 to my blank disk,D2
Then, I booted the disk
It did not find the HELLO file (it does not exist yet)
Code: |
10 REM LOGO WAS HERE 12/2017
20 HGR2
30 PRINT CHR$(4)"BLOAD TITLE"
40 PRINT CHR$(4)"BRUN BOOT"
SAVE HELLO
|
Then,
Code: |
CALL -151
00/800<20/0800.5FFFFM
00/
BSAVE TITLE,A$2000,L$2000
88C:4C 89D /* To bypass some useless inits
BSAVE BOOT,A$88C,L$800
|
And... that worked
The disk images of v1.0 and v1.1 are available at http://www.brutaldeluxe.fr/crack/
Reboot and... enjoy,
LoGo
12/2017 |
|
Revenir en haut de page |
|
 |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2928 Localisation: Le Chesnay, France
|
Posté le: Jeu 28 Déc 2017, 21:24 Sujet du message: |
|
|
The original code at $400..$7FF
Code: |
*
* Bookends v1.0
* (c) 1983, Sensible Software
*
*----------------------------
mx %11
org $400
lst off
*----------------------------
SOFTEV EQU $03F2
PWREDUP EQU $03F4
USRADR EQU $03F8
KBD EQU $C000
CLR80VID EQU $C00C
CLRALTCHAR EQU $C00E
TXTCLR EQU $C050
TXTSET EQU $C051
MIXCLR EQU $C052
TXTPAGE2 EQU $C055
HIRES EQU $C057
SETAN0 EQU $C058
ROMIN2 EQU $C081
RDROM2 EQU $C082
BELL1 EQU $FBDD
*----------------------------
L0400 JMP L071A
L0403 DB $03
L0404 LDA $C08C,X
BPL L0404
EOR #$FF
BNE L0404
LDY #$00
STY $40
LDA #$19
STA $3B
LDY #$60
L0417 LDA $C08C,X
BPL L0417
EOR #$FF
BEQ L043C
INC $40
BEQ L0446
L0424 LDA $C08C,X
BPL L0424
L0429 LDA $C08C,X
BPL L0429
L042E LDA $C08C,X
BPL L042E
L0433 LDA $C08C,X
BPL L0433
EOR #$FF
BNE L0446
L043C DEY
BNE L0417
DEC $3B
BPL L0417
JMP L044A
L0446 LDA #$FF
STA $40
L044A LDA $40
CMP L0403
BEQ L0454
JMP L0455
L0454 RTS
*--- Reboot
L0455 PHA
LDA #$00
STA $3A
LDA #$05
STA $3B
PLA
L045F STA ($3A),Y
INY
BNE L045F
INC $3B
LDX $3B
CPX #$0C
BCC L045F
LDA #$00
CPX #$C0
BCC L045F
LDA RDROM2
LDA TXTSET
LDA $2B
LSR
LSR
LSR
LSR
ORA #$C0
STA L0483+2
L0483 JMP $C600
*--- This is where the data is loaded from disk
L0486 LDX $2B
LDA #$00
STA $38
LDA #$90
STA $39
L0490 LDA $C08C,X
BPL L0490
LDA #$14
STA $40
L0499 LDA $C08C,X
BPL L0499
SEC
ROL
STA $42
L04A2 LDA $C08C,X
BPL L04A2
AND $42
STA $37
L04AB LDA $C08C,X
BPL L04AB
SEC
ROL
STA $42
L04B4 LDA $C08C,X
BPL L04B4
AND $42
BEQ L04C1
CMP $37
BCS L0490
L04C1 STA $37
DEC $40
BPL L04AB
L04C7 LDA $C08C,X
BPL L04C7
SEC
ROL
STA $42
L04D0 LDA $C08C,X
BPL L04D0
AND $42
BEQ L04DF
CMP $37
BEQ L0490
BCS L04E4
L04DF STA $37
JMP L04C7
L04E4 LDY #$07
L04E6 LDA $C08C,X
BPL L04E6
SEC
ROL
STA $42
L04EF LDA $C08C,X
BPL L04EF
AND $42
CMP $37
BCC L0490
L04FA BEQ L0490 ; change to *-1, infinite loop
STA $37
DEY
BNE L04E6
L0501 LDA $C08C,X
L0504 BPL L0501
SEC
ROL
STA $42
L050A LDA $C08C,X
BPL L050A
AND $42
CMP $37
BCC L0518
JMP L0490
L0518 STA $36
L051A LDA $C08C,X
BPL L051A
SEC
ROL
STA $42
L0523 LDA $C08C,X
BPL L0523
AND $42
STA $34 ; destination address
LDA #$08 ; load 8 pages
STA $40
L0530 LDA $C08C,X
BPL L0530
SEC
ROL
STA $42
L0539 LDA $C08C,X
BPL L0539
AND $42
STA $35 ; destination address + 1
L0542 LDA $C08C,X
BPL L0542
SEC
ROL
STA $42
L054B LDA $C08C,X
BPL L054B
AND $42
STA $4A
L0554 LDA $C08C,X
BPL L0554
SEC
ROL
STA $42
L055D LDA $C08C,X
BPL L055D
AND $42
STA $4B
LDY #$00
L0568 LDA $C08C,X
BPL L0568
SEC
ROL
STA $42
L0571 LDA $C08C,X
BPL L0571
AND $42
L0578 STA ($38),Y ; save at $9000
INY
BNE L0568
INC $39
L057F LDA $C08C,X
BPL L057F
SEC
ROL
STA $42
L0588 LDA $C08C,X
BPL L0588
AND $42
DEC $40
BNE L0578
STA $0200 ; an address
L0596 LDA $C08C,X
BPL L0596
SEC
ROL
STA $42
L059F LDA $C08C,X
BPL L059F
AND $42
STA $0201 ; another one
L05A9 LDA $C08C,X
BPL L05A9
SEC
ROL
STA $42
L05B2 LDA $C08C,X
BPL L05B2
AND $42
STA $3F
L05BB LDA $C08C,X
BPL L05BB
SEC
ROL
STA $42
L05C4 LDA $C08C,X
BPL L05C4
AND $42 ; and now ensure
EOR $34 ; that all values read
EOR $35 ; were read correctly
EOR $0200
EOR $0201
STA $3E
STY $3C ; Y is 0
STY $3D
STY $3A
LDA #$90 ; decode the data read
STA $3B ; at $9000..$97FF
L05E1 LDA ($3A),Y
PHA
EOR $3D
STA $3D
PLA
EOR $36
LDX #$03
L05ED LSR
PHP
ROL
PLP
ROR
DEX
BNE L05ED
EOR $36
PHA
EOR $3C
STA $3C
PLA
STA ($34),Y ; and save it ?
INY
BNE L05E1
INC $35
L0604 INC $3B
LDA $3B
CMP #$98 ; until 9800 (8 pages)
BCC L05E1
LDA $3C ; compare the checksums
CMP $3E
BNE L0618
LDA $3D
CMP $3F
BEQ L0622
L0618 TXA
PHA
JSR BELL1
PLA
TAX
JMP L0486 ; retry if different!
L0622 SEC
LDA $4A
SBC $46
STA $4A
LDA $4B
SBC $47
STA $4B
LDY $4A
LDA $4B
BEQ L063F
CMP #$FF
BNE L0643
CPY #$F8
BCS L0648
BCC L0643
L063F CPY #$08
BCC L0648
L0643 LDA #$CE ; err, reboot
JMP L0455
L0648 RTS ; return if OK
*--- Step 2
L0649 LDA #$00 ; save ROM page $FF00
TAY
L064C EOR $FF00,Y
STA $0300,Y
INY
BNE L064C
PHA ; save A
LDA #$6C ; set vectors
STA USRADR
LDA #$F8
STA SOFTEV
LDA #$03
STA SOFTEV+1
EOR #$A5
STA PWREDUP
LDA #$4E
STA USRADR+1
LDA #$00
STA USRADR+2
LDA #$55 ; $4E..4F: $0455
STA $4E
LDA #$04
STA $4F
PLA ; restore A
RTS
*--- Step 3
L067E LDA ROMIN2 ; ROM is RAM
LDA ROMIN2
LDA #$00 ; r/w it
STA $3A ; goodbye wildcards I guess
LDA #$D0
STA $3B
L068C LDY #$00
L068E LDA ($3A),Y
STA ($3A),Y
INY
BNE L068E
INC $3B
BNE L068C
LDA RDROM2
JMP L0748 ; and jump
*---
L069F LDA #$03
STA $4C
LDY #$00
STY $47
L06A7 LDA $C08C,X
BPL L06A7
CMP #$FF
BEQ L06A7
L06B0 LDA $C08C,X
BPL L06B0
L06B5 LDA $C08C,X
BPL L06B5
L06BA LDA $C08C,X
BPL L06BA
L06BF LDA $C08C,X
BPL L06BF
L06C4 LDA $C08C,X
BPL L06C4
CMP #$FF
BNE L06D6
INY
BNE L06C4
INC $47
BNE L06C4
BEQ L069F
L06D6 STY $46
DEC $4C
BNE L06B0
RTS
L06DD LDA #$56
L06DF SEC
L06E0 PHA
L06E1 SBC #$01
BNE L06E1
PLA
SBC #$01
BNE L06E0
RTS
L06EB LDY #$04
L06ED LDA #$FF
JSR L06DF
DEY
BNE L06ED
RTS
*---
L06F6 DEC $33
JMP L0706
L06FB JSR L06EB ; wait
L06FE JSR L0704 ; move
JSR L06DD ; wait
L0704 INC $33 ; move
L0706 LDA $33
AND #$03
ASL
ORA $2B
TAX
LDA $C081,X
JSR L06DD ; wait
LDA $C080,X
LDX $2B
RTS
*--- Entry point
L071A LDA SETAN0
LDA TXTCLR
LDA MIXCLR
LDA TXTPAGE2
LDA HIRES
TSX ; 1st check
TXA ; the stack pointer
EOR #$B2
AND #$7F
BEQ L0736 ; must be 00
LDA #$D3
JMP L0455 ; reboot
L0736 PLA ; hum
LDA $0200 ; 99 10011001
AND #$67 ; 67 01100111
; 00000001
EOR $2B ; 60 01100000
TAY ; 61 01100001
TAX ; save 61
STY $2B ; save 61
JSR L0649 ; has a checksum in A but not used
JMP L067E ; clear ROM then calls L0748
*--- Step 4
L0748 JSR L0649 ; has a checksum in A and saves it
STA $0202
*--- We clear the RAM!!!
LDA RDROM2
LDX #$00
L0753 LDA L0765+2 ; on entry 08
CMP #$40
BCC L0762 ; so go at 762
CMP #$60
BCS L0762
LDA #$00
BEQ L0765
L0762 LDA $E007,X
L0765 STA $0800,X
INX
BNE L0753 ; loop here
INC L0762+2
BNE L0775
LDA #$E1 ; replay at $E100
STA L0762+2
L0775 INC L0765+2
LDA L0765+2 ; loop from $0800
CMP #$C0 ; until $BFFF
BCC L0753
DEX ; X is 0 here, it becomes FF
TXS ; the new stack pointer
LDA #$04 ; move 4 phases please
STA $33
L0785 JSR L06F6 ; move
LDA $33
BNE L0785 ; loop in the phases
LDA #$12 ; they seem unused
STA $31
LDA #$5D
STA $3E
JSR L06FB ; move 2 phases
JSR L069F ; read header
JSR L0404 ; read nibbles, reboot on err
JSR L06FE ; move 2 phases, less wait
JSR L06FB ; move 2 phases
L07A3 JSR L07AB ; read data
BEQ L07A3 ; loop on err
JMP L07B5 ; jump to next step
L07AB JSR L06FE ; move again
JSR L0486 ; read data!
LDA $0201
RTS
*--- Step 6
L07B5 LDX $2B ; stop the disk
LDA $C088,X
LDA #$FF
STA $32
TXA
LSR
LSR
ROL $2B
LSR
LSR
TAX
LDA $0202 ; the checksum from ROM
PHA ; is here!
LDY #$00
L07CC STA L0404,Y
STA L0504,Y
STA L0604,Y
INY
BNE L07CC
LDA #$FF
STA L04FA+1 ; change to a BEQ *-1
STA CLR80VID
STA CLRALTCHAR
STA KBD
LDA $33
STY $33
JMP ($0200) ; next step pppllleeeaaassseee
ASC " (C) 1982 -- SENSIB"
|
|
|
Revenir en haut de page |
|
 |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2928 Localisation: Le Chesnay, France
|
Posté le: Jeu 28 Déc 2017, 21:25 Sujet du message: |
|
|
And my modified code, still at $400:
Code: |
*
* Bookends v1.0
* (c) 1983, Sensible Software
*
*----------------------------
mx %11
org $400
lst off
*----------------------------
SOFTEV EQU $03F2
PWREDUP EQU $03F4
USRADR EQU $03F8
KBD EQU $C000
CLR80VID EQU $C00C
CLRALTCHAR EQU $C00E
TXTCLR EQU $C050
TXTSET EQU $C051
MIXCLR EQU $C052
TXTPAGE2 EQU $C055
HIRES EQU $C057
SETAN0 EQU $C058
ROMIN2 EQU $C081
RDROM2 EQU $C082
BELL1 EQU $FBDD
*----------------------------
L0400 JMP L071A
L0403 DB $03
L0404 LDA $C08C,X
BPL L0404
EOR #$FF
BNE L0404
LDY #$00
STY $40
LDA #$19
STA $3B
LDY #$60
L0417 LDA $C08C,X
BPL L0417
EOR #$FF
BEQ L043C
INC $40
BEQ L0446
L0424 LDA $C08C,X
BPL L0424
L0429 LDA $C08C,X
BPL L0429
L042E LDA $C08C,X
BPL L042E
L0433 LDA $C08C,X
BPL L0433
EOR #$FF
BNE L0446
L043C DEY
BNE L0417
DEC $3B
BPL L0417
JMP L044A
L0446 LDA #$FF
STA $40
L044A LDA $40
CMP L0403
BEQ L0454
JMP L0455
L0454 RTS
*--- Reboot
L0455 PHA
LDA #$00
STA $3A
LDA #$05
STA $3B
PLA
L045F STA ($3A),Y
INY
BNE L045F
INC $3B
LDX $3B
CPX #$0C
BCC L045F
LDA #$00
CPX #$C0
BCC L045F
LDA RDROM2
LDA TXTSET
LDA $2B
LSR
LSR
LSR
LSR
ORA #$C0
STA L0483+2
L0483 JMP $C600
*--- This is where the data is loaded from disk
L0486 LDX $2B
LDA #$00
STA $38
LDA #$90
STA $39
L0490 LDA $C08C,X
BPL L0490
LDA #$14
STA $40
L0499 LDA $C08C,X
BPL L0499
SEC
ROL
STA $42
L04A2 LDA $C08C,X
BPL L04A2
AND $42
STA $37
L04AB LDA $C08C,X
BPL L04AB
SEC
ROL
STA $42
L04B4 LDA $C08C,X
BPL L04B4
AND $42
BEQ L04C1
CMP $37
BCS L0490
L04C1 STA $37
DEC $40
BPL L04AB
L04C7 LDA $C08C,X
BPL L04C7
SEC
ROL
STA $42
L04D0 LDA $C08C,X
BPL L04D0
AND $42
BEQ L04DF
CMP $37
BEQ L0490
BCS L04E4
L04DF STA $37
JMP L04C7
L04E4 LDY #$07
L04E6 LDA $C08C,X
BPL L04E6
SEC
ROL
STA $42
L04EF LDA $C08C,X
BPL L04EF
AND $42
CMP $37
BCC L0490
L04FA BEQ L0490 ; change to *-1, infinite loop
STA $37
DEY
BNE L04E6
L0501 LDA $C08C,X
L0504 BPL L0501
SEC
ROL
STA $42
L050A LDA $C08C,X
BPL L050A
AND $42
CMP $37
BCC L0518
JMP L0490
L0518 STA $36
L051A LDA $C08C,X
BPL L051A
SEC
ROL
STA $42
L0523 LDA $C08C,X
BPL L0523
AND $42
STA $34 ; destination address
LDA #$08 ; load 8 pages
STA $40
L0530 LDA $C08C,X
BPL L0530
SEC
ROL
STA $42
L0539 LDA $C08C,X
BPL L0539
AND $42
STA $35 ; destination address + 1
L0542 LDA $C08C,X
BPL L0542
SEC
ROL
STA $42
L054B LDA $C08C,X
BPL L054B
AND $42
STA $4A
L0554 LDA $C08C,X
BPL L0554
SEC
ROL
STA $42
L055D LDA $C08C,X
BPL L055D
AND $42
STA $4B
LDY #$00
L0568 LDA $C08C,X
BPL L0568
SEC
ROL
STA $42
L0571 LDA $C08C,X
BPL L0571
AND $42
L0578 STA ($38),Y ; save at $9000
INY
BNE L0568
INC $39
L057F LDA $C08C,X
BPL L057F
SEC
ROL
STA $42
L0588 LDA $C08C,X
BPL L0588
AND $42
DEC $40
BNE L0578
STA $0200 ; an address
L0596 LDA $C08C,X
BPL L0596
SEC
ROL
STA $42
L059F LDA $C08C,X
BPL L059F
AND $42
STA $0201 ; another one
L05A9 LDA $C08C,X
BPL L05A9
SEC
ROL
STA $42
L05B2 LDA $C08C,X
BPL L05B2
AND $42
STA $3F
L05BB LDA $C08C,X
BPL L05BB
SEC
ROL
STA $42
L05C4 LDA $C08C,X
BPL L05C4
AND $42 ; and now ensure
EOR $34 ; that all values read
EOR $35 ; were read correctly
EOR $0200
EOR $0201
STA $3E
STY $3C ; Y is 0
STY $3D
STY $3A
LDA #$90 ; decode the data read
STA $3B ; at $9000..$97FF
L05E1 LDA ($3A),Y
PHA
EOR $3D
STA $3D
PLA
EOR $36
LDX #$03
L05ED LSR
PHP
ROL
PLP
ROR
DEX
BNE L05ED
EOR $36
PHA
EOR $3C
STA $3C
PLA
STA ($34),Y ; and save it ?
INY
BNE L05E1
INC $35
L0604 INC $3B
LDA $3B
CMP #$98 ; until 9800 (8 pages)
BCC L05E1
LDA $3C ; compare the checksums
CMP $3E
BNE L0618
LDA $3D
CMP $3F
BEQ L0622
L0618 TXA
PHA
JSR BELL1
PLA
TAX
JMP L0486 ; retry if different!
L0622 SEC
LDA $4A
SBC $46
STA $4A
LDA $4B
SBC $47
STA $4B
LDY $4A
LDA $4B
BEQ L063F
CMP #$FF
BNE L0643
CPY #$F8
BCS L0648
BCC L0643
L063F CPY #$08
BCC L0648
L0643 LDA #$CE ; err, reboot
JMP L0455
L0648 RTS ; return if OK
*--- Step 2
L0649 LDA #$00 ; save ROM page $FF00
TAY
L064C EOR $FF00,Y
STA $0300,Y
INY
BNE L064C
PHA ; save A
LDA #$6C ; set vectors
STA USRADR
LDA #$F8
STA SOFTEV
LDA #$03
STA SOFTEV+1
EOR #$A5
STA PWREDUP
LDA #$4E
STA USRADR+1
LDA #$00
STA USRADR+2
LDA #$55 ; $4E..4F: $0455
STA $4E
LDA #$04
STA $4F
PLA ; restore A
RTS
*--- Step 3
L067E LDA ROMIN2 ; ROM is RAM
LDA ROMIN2
LDA #$00 ; r/w it
STA $3A ; goodbye wildcards I guess
LDA #$D0
STA $3B
L068C LDY #$00
L068E LDA ($3A),Y
STA ($3A),Y
INY
BNE L068E
INC $3B
BNE L068C
LDA RDROM2
JMP L0748 ; and jump
*---
L069F LDA #$03
STA $4C
LDY #$00
STY $47
L06A7 LDA $C08C,X
BPL L06A7
CMP #$FF
BEQ L06A7
L06B0 LDA $C08C,X
BPL L06B0
L06B5 LDA $C08C,X
BPL L06B5
L06BA LDA $C08C,X
BPL L06BA
L06BF LDA $C08C,X
BPL L06BF
L06C4 LDA $C08C,X
BPL L06C4
CMP #$FF
BNE L06D6
INY
BNE L06C4
INC $47
BNE L06C4
BEQ L069F
L06D6 STY $46
DEC $4C
BNE L06B0
RTS
L06DD LDA #$56
L06DF SEC
L06E0 PHA
L06E1 SBC #$01
BNE L06E1
PLA
SBC #$01
BNE L06E0
RTS
L06EB LDY #$04
L06ED LDA #$FF
JSR L06DF
DEY
BNE L06ED
RTS
*---
L06F6 DEC $33
JMP L0706
L06FB JSR L06EB ; wait
L06FE JSR L0704 ; move
JSR L06DD ; wait
L0704 INC $33 ; move
L0706 LDA $33
AND #$03
ASL
ORA $2B
TAX
LDA $C081,X
JSR L06DD ; wait
LDA $C080,X
LDX $2B
RTS
*--- Entry point
L071A LDA SETAN0
LDA TXTCLR
LDA MIXCLR
LDA TXTPAGE2
LDA HIRES
TSX ; 1st check
TXA ; the stack pointer
EOR #$B2
AND #$7F
BEQ L0736 ; must be 00
LDA #$D3
* JMP L0455 ; reboot
bit L0455 ; reboot
*L0736 PLA ; hum
L0736 nop ; hum
LDA $0200 ; 99 10011001
AND #$67 ; 67 01100111
; 00000001
* EOR $2B ; 60 01100000
lda #$60 ; 60 01100000
TAY ; 61 01100001
TAX ; save 61
STY $2B ; save 61
JSR L0649 ; has a checksum in A but not used
JMP L067E ; clear ROM then calls L0748
*--- Step 4
L0748 JSR L0649 ; has a checksum in A and saves it
STA $0202
*--- We clear the RAM!!!
LDA RDROM2
LDX #$00
L0753 LDA L0765+2 ; on entry 08
CMP #$40
BCC L0762 ; so go at 762
CMP #$60
BCS L0762
LDA #$00
BEQ L0765
L0762 LDA $E007,X
*L0765 STA $0800,X
L0765 lda $0800,X
INX
BNE L0753 ; loop here
INC L0762+2
BNE L0775
LDA #$E1 ; replay at $E100
STA L0762+2
L0775 INC L0765+2
LDA L0765+2 ; loop from $0800
CMP #$C0 ; until $BFFF
BCC L0753
DEX ; X is 0 here, it becomes FF
TXS ; the new stack pointer
LDA #$04 ; move 4 phases please
STA $33
L0785 JSR L06F6 ; move
LDA $33
BNE L0785 ; loop in the phases
LDA #$12 ; they seem unused
STA $31
LDA #$5D
STA $3E
JSR L06FB ; move 2 phases
JSR L069F ; read header
JSR L0404 ; read nibbles, reboot on err
JSR L06FE ; move 2 phases, less wait
JSR L06FB ; move 2 phases
L07A3 JSR L07AB ; read data
BEQ L07A3 ; loop on err
JMP L07B5 ; jump to next step
L07AB JSR L06FE ; move again
JSR L0486 ; read data!
LDA $0201
RTS
*--- Step 6
L07B5 LDX $2B ; stop the disk
LDA $C088,X
*--- The results are...
lda $33 ; 1C
sta $fb
lda $35 ; 10
sta $fc
lda $200 ; 8C
sta $fd
lda $201 ; 08
sta $fe
lda $202 ; DD
sta $ff
jmp $ff59
ds \
|
|
|
Revenir en haut de page |
|
 |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2928 Localisation: Le Chesnay, France
|
Posté le: Ven 29 Déc 2017, 9:00 Sujet du message: |
|
|
The original and modified code at $0300.
The one that reads nibbles from T0 at $7800..$7FFF
Code: |
*---------------------------------------------------------*
* Disassembled with The Flaming Bird Disassembler *
* (c) Phoenix corp. 1992,93 - All rights reserved *
*---------------------------------------------------------*
TXTPAGE1 EQU $C054
TYP BIN
ORG $000300
MX %11
L0300 DB $99
AND #$00
STA $3A
TXS
PHP
LDA $26
STA $4E
INC $2B
LDA TXTPAGE1
STY $0200 ; save key
LDY #$3F ; use 3F as a start index
INC $27 ; 03 -> 04
BPL L0321 ; jump
DB $FF
DB $00
DB $00
DB $FF
DB $FF
DB $00
LDY #$3F
L0321 LDA L0300,Y
EOR #$00
EOR #$99 ; WAS EOR $0200
NOP
STA L0300,Y
INY
BNE L0321
RTS ; I've put a RTS here
* The code that reads the nibbles
NOP
LDA #$F8
AND $2B
TAX
LDA #$E1
EOR $0200
STA $3B
STA $4F
LDA $C08C,X
BPL $033F
CMP #$DB
BNE $033F
LDA $C08C,X
BPL $0348
CMP #$B7
BNE $0344
LDA $C08C,X
BPL $0351
STA ($3A),Y
INY
BNE $0351
INC $3B
BPL $0351
* The code to decode the nibbles
DEC $3B
DEC $3B
TYA
TAX
INY
LDA ($4E),Y
DEY
SEC
ROL
AND ($3A),Y
EOR $0200
STA ($26,X)
ASL
STA ($3A),Y
INY
ASL
STA ($4E),Y
INY
BNE $0390
INC $4F
BMI $039A
INC $3B
LDA $3B
AND #$01
BNE $0390
DEC $3B
DEC $3B
DEC $3B
DEC $3B
INC $26
BNE $0396
INC $27
LDA $27
BPL $0365
LDA $27 ; now jump to $0400
EOR #$03
INC $26
STA $27
JMP ($0026)
HEX 39315A30392820212B393434394A5C57
HEX 4A505B555C394A565F4D4E584B5C3931
HEX 5A30392820212B393434394A5C574A50
HEX 5B555C394A565F4D4E584B5C39315A30
HEX 392820212B393434394A5C574A505B55
HEX 5C394A565F4D4E584B5C8D
|
Code: |
*---------------------------------------------------------*
* Disassembled with The Flaming Bird Disassembler *
* (c) Phoenix corp. 1992,93 - All rights reserved *
*---------------------------------------------------------*
TYP BIN
ORG $000300
MX %11
* My modified code to read the nibbles
* at $7800..$7FFF
L0300 LDY #$00 ; index 0
LDX #$60 ; slot*16
LDA #$00 ; A is zero
STA $3A
STA $4E
LDA #$78 ; load at $7800
STA $3B
STA $4F
L0310 LDA $C08C,X
BPL L0310
L0315 CMP #$DB
BNE L0310
L0319 LDA $C08C,X
BPL L0319
CMP #$B7
BNE L0315
L0322 LDA $C08C,X
BPL L0322
STA ($3A),Y
INY
BNE L0322
INC $3B
BPL L0322
RTS
|
|
|
Revenir en haut de page |
|
 |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2928 Localisation: Le Chesnay, France
|
Posté le: Ven 29 Déc 2017, 9:01 Sujet du message: |
|
|
And my modified code to decypher the nibbles from $7800..$7FFF and put the data at $400..$7FF
Code: |
*---------------------------------------------------------*
* Disassembled with The Flaming Bird Disassembler *
* (c) Phoenix corp. 1992,93 - All rights reserved *
*---------------------------------------------------------*
TYP BIN
ORG $000300
MX %11
* Set the right addresses in zero page
LDA #$00 ; dest at $0400
STA $26
LDA #$04
STA $27
LDA #$00 ; source 1 at $8000
STA $3A
LDA #$80
STA $3B
LDA #$00 ; source 2 at $7800
STA $4E
LDA #$78
STA $4F
LDA #$00 ; now decode please
LDX #$00
LDY #$00
JMP L035F
L0321 LDA $0300,Y
EOR #$00
EOR #$99
NOP
STA $0300,Y
INY
BNE L0321
RTS
NOP
LDA #$F8
AND $2B
TAX
LDA #$E1
EOR $0200
STA $3B
STA $4F
L033F LDA $C08C,X
BPL L033F
L0344 CMP #$DB
BNE L033F
L0348 LDA $C08C,X
BPL L0348
CMP #$B7
BNE L0344
L0351 LDA $C08C,X
BPL L0351
STA ($3A),Y
INY
BNE L0351
INC $3B
BPL L0351
* The code that decodes the nibbles
L035F DEC $3B
DEC $3B
TYA
TAX
L0365 INY
LDA ($4E),Y
DEY
SEC
ROL
AND ($3A),Y
EOR #$99
NOP
STA ($26,X)
ASL
STA ($3A),Y
INY
ASL
STA ($4E),Y
INY
BNE L0390
INC $4F
BMI L039A
INC $3B
LDA $3B
AND #$01
BNE L0390
DEC $3B
DEC $3B
DEC $3B
DEC $3B
L0390 INC $26
BNE L0396
INC $27
L0396 LDA $27
BPL L0365
* Move the decyphered code in bank 10
* of our beloved IIgs
L039A CLC
XCE
REP #$30
LDX #$0000
L03A1 LDA $0400,X
STAL $100400,X
INX
INX
BPL L03A1
SEC
XCE
SEP #$30
RTS
HEX 242526272800FF00FF00292A2B002C2D
HEX 2E2F30313200FF33343536373800394C
HEX 00BE4C00BE00FF00FF00FF00FF00FF00
HEX FF00FF00FF00FF00FF00FF00FF00FF59
HEX FA00BE1B4C03BE4C00BE004000EBBF
|
|
|
Revenir en haut de page |
|
 |
|
|
Vous ne pouvez pas poster de nouveaux sujets dans ce forum Vous ne pouvez pas répondre aux sujets dans ce forum Vous ne pouvez pas éditer vos messages dans ce forum Vous ne pouvez pas supprimer vos messages dans ce forum Vous ne pouvez pas voter dans les sondages de ce forum
|
|