|
|
|
IDENTIFICATION SERVEUR : 10.14.20.216 - CLIENT : 18.234.255.5 |
|
| Voir le sujet précédent :: Voir le sujet suivant |
| Auteur |
Message |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 3060
Localisation: Le Chesnay, France
|
 Posté le: Mer 31 Juil 2019, 17:17 Sujet du message: Return of Herakles (Quality Software, 1983) |
 |
|
#1018 - A game by Stuart Smith, later published by Electronic Arts. Disk image by Dan Chisarick (thank you, Dan, you know why). WOZ image by 4am.
Disk structure
It looks like a protected 16-sec disk.
Protection type
A change of epilog markers in the header field
D5AA96/DEABEB
D5AAAD/DEAAEB
How to copy
Boot my copy disk
Launch Advanced Demuffin 1.4
Enter the monitor
B99B:AB
Press ctrl-Y
Copy the disk
Let's play the game
It reboots!
How to shunt the dormant protection check
Boot my copy disk
Launch Disk Fixer
T1A/SA/B8:9D -> BD
T1A/S9/01:00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01
The disk image is available at http://www.brutaldeluxe.fr/crack/
Reboot and... enjoy,
LoGo
7/2019 |
|
| Revenir en haut de page |
|
 |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 3060
Localisation: Le Chesnay, France
|
| Posté le: Mer 31 Juil 2019, 17:18 Sujet du message: |
|
|
This is the nibble check code at $89F0 or T18/SA/F0
| Code: |
00F0:AD 4D BF LDA $BF4D ; init the slot*16
00F3:18 CLC
00F4:69 88 ADC #$88
00F6:8D 4A 8A STA $8A4A
00F9:8D A1 8A STA $8AA1
00FC:18 CLC
00FD:69 01 ADC #$01
00FF:8D 2E 8A STA $8A2E
0102:18 CLC
0103:69 03 ADC #$03
0105:8D 54 8A STA $8A54
0108:8D 63 8A STA $8A63
010B:8D 6B 8A STA $8A6B
010E:8D 74 8A STA $8A74
0111:8D 7D 8A STA $8A7D
0114:8D 84 8A STA $8A84
0117:8D 8E 8A STA $8A8E
011A:8D 94 8A STA $8A94
011D:18 CLC
011E:69 01 ADC #$01
0120:8D 8B 8A STA $8A8B
0123:A9 0F LDA #$0F ; nb of nibbles to grab
0125:8D AB 8A STA $8AAB
0128:A9 80 LDA #$80
012A:8D AD 8A STA $8AAD
012D:AD E9 C0 LDA $C0E9
0130:CE AC 8A DEC $8AAC ; our retry counters
0133:D0 FB BNE $0130
0135:CE AD 8A DEC $8AAD
0138:D0 F6 BNE $0130
013A:A9 40 LDA #$40 ; retry counters again
013C:8D AD 8A STA $8AAD
013F:CE AC 8A DEC $8AAC
0142:D0 0D BNE $0151
0144:CE AD 8A DEC $8AAD
0147:D0 08 BNE $0151
0149:AD E8 C0 LDA $C0E8 ; probably never called
014C:A0 C3 LDY #$C3
014E:4C 31 8C JMP $8C31
0151:A2 02 LDX #$02 ; read D5AA96
0153:AD EC C0 LDA $C0EC
0156:10 FB BPL $0153
0158:DD A8 8A CMP $8AA8,X
015B:D0 E2 BNE $013F
015D:CA DEX
015E:10 F3 BPL $0153
0160:A2 03 LDX #$03 ; skip 4
0162:AD EC C0 LDA $C0EC
0165:10 FB BPL $0162
0167:CA DEX
0168:10 F8 BPL $0162
016A:AD EC C0 LDA $C0EC ; read 4*4
016D:10 FB BPL $016A
016F:2A ROL
0170:8D AE 8A STA $8AAE
0173:AD EC C0 LDA $C0EC
0176:10 FB BPL $0173
0178:2D AE 8A AND $8AAE ; make it a byte
017B:A8 TAY ; becomes our index
017C:AD EC C0 LDA $C0EC ; skip
017F:10 FB BPL $017C
0181:EA NOP ; lose time
0182:EA NOP
0183:AD EC C0 LDA $C0EC ; skip
0186:10 FB BPL $0183
0188:EA NOP ; lose time
0189:EA NOP
018A:AD ED C0 LDA $C0ED ; latch me
018D:AD EC C0 LDA $C0EC ; skip
0190:10 FB BPL $018D
0192:EA NOP
0193:AD EC C0 LDA $C0EC ; we have our hidden nibble
0196:10 FB BPL $0193
0198:99 20 00 STA $0020,Y ; store the nibble in zero page
019B:CE AB 8A DEC $8AAB ; next nibble
019E:10 B1 BPL $0151
01A0:AD E8 C0 LDA $C0E8 ; exit
01A3:A0 C3 LDY #$C3
01A5:4C 31 8C JMP $8C31
01A8:96 AA D5 HEX 96AAD5 ; want D5 AA 96
01AA:A0 HEX A0
01AB:D3 HEX D3 ; counter
01AC:A0 HEX A0 ; retry counter
|
Very interesting routine at $A988 at T1A/SA/88
That procedure checks the nibbles stored in the zero page
| Code: |
0088:A2 0F LDX #$0F ; check our nibbles
008A:A0 03 LDY #$03
008C:B5 20 LDA $20,X
008E:D9 CA A9 LDA $A9CA,Y
0091:F0 23 BEQ $00B6
0093:88 DEY
0094:10 F8 BPL $008E
0096:A0 03 LDY #$03
0098:D9 CE A9 LDA $A9CE,Y
009B:F0 15 BEQ $00B2
009D:88 DEY
009E:10 F8 BPL $0098
00A0:A0 03 LDY #$03
00A2:D9 D2 A9 LDA $A9D2,Y
00A5:F0 07 BEQ $00AE
00A7:88 DEY
00A8:10 F8 BPL $00A2
00AA:A9 03 LDA #$03 ; bad
00AC:D0 0A BNE $00B8
00AE:A9 02 LDA #$02 ; bad
00B0:D0 06 BNE $00B8
00B2:A9 01 LDA #$01 ; good
00B4:D0 02 BNE $00B8
00B6:A9 00 LDA #$00 ; good
00B8:9D 01 AA STA $AA01,X
00BB:CA DEX
00BC:10 CC BPL $008A
00BE:A9 00 LDA #$00 ; init the prot counter
00C0:85 E0 STA $E0
00C2:20 DA A9 JSR $A9DA ; check now
00C5:A0 8C LDY #$8C
00C7:4C 31 8C JMP $8C31
00CA:F5 EA D5 00 HEX F5EAD500
00CE:F2 E5 CA A5 HEX F2E5CAA5
00D2:AA AB F9 00 HEX AAABF900
00D6:55 55 A0 A0 HEX 5555A0A0 ; the indexes
|
And now the routine that sets the $E0 flag based on the values at $AA01
| Code: |
00DA:A2 0F LDX #$0F ; check the values
00DC:AD D6 A9 LDA $A9D6
00DF:8D D8 A9 STA $A9D8
00E2:AD D7 A9 LDA $A9D7
00E5:8D D9 A9 STA $A9D9
00E8:4E D8 A9 LSR $A9D8
00EB:6E D9 A9 ROR $A9D9
00EE:B0 04 BCS $00F4
00F0:A9 00 LDA #$00
00F2:F0 02 BEQ $00F6
00F4:A9 01 LDA #$01
00F6:DD 01 AA CMP $AA01,X
00F9:D0 02 BNE $00FD
00FB:E6 E0 INC $E0 ; a match, we're good
00FD:CA DEX
00FE:10 E8 BPL $00E8
0100:60 RTS
0101: HEX A0A0A0A0B1A0A0A0
HEX A0A0A0A0A0A0A0A0
|
|
|
| Revenir en haut de page |
|
|
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 3060
Localisation: Le Chesnay, France
|
| Posté le: Mer 31 Juil 2019, 17:23 Sujet du message: |
|
|
But how to get the real values?
| Code: |
From a copy of the normalized disk, with Disk Fixer
T18/S9/A0:AD E8 C0 -> 4C 59 FF
Reboot and start playing.
When the game crashes into the monitor, grab the values from the zero page:
$20..$2F: F5 E5 F5 E5 EA E5 EA F2 EA E5 F5 F2 EA F2 F5 E5
On a "normal" copy, you'll get:
$20..$2F: 00 28 00 18 14 17 AA AA D0 07 D0 07 00 00 00 00
|
And how to get the verified values of table $AA01
| Code: |
From a copy of the normalized disk, with Disk Fixer
T1A/SA/C2:20 DA A9 -> 4C 59 FF
Reboot and start playing.
When the game crashes into the monitor, grab the values from $AA01:
$AA01: 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01
On a "normal" copy, you'll get:
$AA01: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
|
Gotcha! |
|
| Revenir en haut de page |
|
|
|
|
Vous ne pouvez pas poster de nouveaux sujets dans ce forum
Vous ne pouvez pas répondre aux sujets dans ce forum
Vous ne pouvez pas éditer vos messages dans ce forum
Vous ne pouvez pas supprimer vos messages dans ce forum
Vous ne pouvez pas voter dans les sondages de ce forum
|
|
FAQ 
Rechercher 
Liste des Membres 
Groupes d'utilisateurs
S'enregistrer
Profil 
Se connecter pour vérifier ses messages privés 
Connexion 
