|
|
|
IDENTIFICATION SERVEUR : 10.14.20.76 - CLIENT : 3.221.159.255 |
|
| Voir le sujet précédent :: Voir le sujet suivant |
| Auteur |
Message |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France
|
 Posté le: Jeu 16 Avr 2020, 23:24 Sujet du message: Fishies (1984, Harper and Row Electronic) |
 |
|
#1033 - Frank wanted it, Paul has it away from him, Brian had it and provided an Applesauce. So, here is a weird software: feed your fishes. A mix between a screensaver and a... software.
Disk structure
The disk cannot be copied. Locksmith Fast Disk Backup shows no copiable sectors.
Protection type
An analysis with Copy II plus and Disk Fixer and boot tracing show interesting things:
- A change of markers:
Address field: D5AA96 DExx where xx is delayed
Data field: D5AAB5 DExx where xx is delayed
- A change in the denibblize table: AA is 00 instead of AA
- A non standard T3 with 4*4 encoded nibbles. The code to read T3 is located at $BC56.
- Catalog is moved to T12
How to copy
Follow the instructions to normalize the disk
| Code: |
Boot my copy disk
Launch Advanced Demuffin 1.4
Insert Fishies disk in D1
Insert a disk in D2
Press B to boot
Format target disk in D2
Copy T0/SA to T2/SF
Copy T4/S0 to T22/SF
...then...
Boot my copy disk
Launch Advanced Demuffin 1.4
Insert Fishies disk in D1
Press P to bypass boot
Enter the monitor
B930:18 60 EA
B98B:18 60 EA
Press ctrl-Y to return to the program
Copy T0/S0 to T0/S9
|
You now have a normalized yet unbootable copy.
How to crack
Follow the instructions to make it bootable
| Code: |
Boot my copy disk
Launch Disk Fixer
At T0/S2/FD:B5 -> AD For a std 16-sec disk
At T0/S3/38:48 68-> 18 60
At T0/S3/94:48 68 -> 18 60
At T0/S4/AA:00 -> AA For the denibblize table
At T0/S5/22:03 -> 00 For the remove write protect tab
At T0/S8/15:A5 -> 24 For the volume number check
At T0/S8/25:E1 -> 00
|
One file is loaded at $300 and loads T/S and then passes control to $BC56 where it loads and decyphers the 4*4 nibbles from T3.
| Code: |
Boot my copy disk
Launch Disk Fixer
At T0/S6/56, enter the following code:
BC56:A9 01 LDA #$01
BC58:8D F4 B7 STA $B7F4
BC5B:A9 01 LDA #$01
BC5D:8D 4F 03 STA $034F
BC60:A9 02 LDA #$02
BC62:8D 50 03 STA $0350
BC65:A9 03 LDA #$03
BC67:8D EC B7 STA $B7EC
BC6A:A9 00 LDA #$00
BC6C:8D ED B7 STA $B7ED
BC6F:8D F0 B7 STA $B7F0
BC72:A9 08 LDA #$08
BC74:8D F1 B7 STA $B7F1
BC77:A9 B7 LDA #$B7
BC79:A0 E8 LDY #$E8
BC7B:20 B5 B7 JSR $B7B5
BC7E:90 01 BCC $BC81
BC80:00 BRK
BC81:EE F1 B7 INC $B7F1
BC84:AD F1 B7 LDA $B7F1
BC87:C9 14 CMP #$14
BC89:D0 03 BNE $BC8E
BC8B:4C 15 0B JMP $0B15
BC8E:EE ED B7 INC $B7ED
BC91:4C 77 BC JMP $BC77
|
Note that the ROTATED WRITER PACKAGE is the code that writes nibbles on T3. That's fun to get the original code.
Note also that I was unable to read/write the same data on an emulator, so I cheated by grabbing the RAM contents of the Hot Rod crack (from $0800..$13FF) and wrote it down on T3. The above code reads such data and code.
Last note: the original T0/S6 is available at T0/SA
The pseudo disk image is available at http://www.brutaldeluxe.fr/crack/
Reboot and... enjoy,
LoGo
4/2020
Dernière édition par toinet le Sam 18 Avr 2020, 2:36; édité 1 fois |
|
| Revenir en haut de page |
|
 |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France
|
| Posté le: Sam 18 Avr 2020, 2:35 Sujet du message: |
|
|
That is the code that reads T3 and decyphers it from $0800 to $13FF.
| Code: |
BC56: A9 00 LDA #$00
BC58: 8D F4 B7 STA $B7F4
BC5B: A9 01 LDA #$01
BC5D: 8D 4F 03 STA $034F
BC60: A9 02 LDA #$02
BC62: 8D 50 03 STA $0350
BC65: A9 03 LDA #$03
BC67: 8D EC B7 STA $B7EC
BC6A: 20 F2 BC JSR $BCF2
BC6D: 20 B5 B7 JSR $B7B5
BC70: AE E9 B7 LDX $B7E9
BC73: BD 89 C0 LDA $C089,X
BC76: A9 00 LDA #$00
BC78: 85 04 STA $04
BC7A: A9 08 LDA #$08
BC7C: 85 05 STA $05
BC7E: A0 00 LDY #$00
BC80: BD 8C C0 LDA $C08C,X
BC83: 10 FB BPL $BC80
BC85: C9 ED CMP #$ED
BC87: D0 F7 BNE $BC80
BC89: EA NOP
BC8A: BD 8C C0 LDA $C08C,X
BC8D: 10 FB BPL $BC8A
BC8F: EA NOP
BC90: EA NOP
BC91: 9D 8D C0 STA $C08D,X
BC94: EA NOP
BC95: E6 4F INC $4F
BC97: BD 8C C0 LDA $C08C,X
BC9A: 10 FB BPL $BC97
BC9C: EA NOP
BC9D: EA NOP
BC9E: BD 8C C0 LDA $C08C,X
BCA1: 10 FB BPL $BC9E
BCA3: C9 B5 CMP #$B5
BCA5: F0 19 BEQ $BCC0
BCA7: 38 SEC
BCA8: 85 4E STA $4E
BCAA: 26 4E ROL $4E
BCAC: BD 8C C0 LDA $C08C,X
BCAF: 10 FB BPL $BCAC
BCB1: 25 4E AND $4E
BCB3: 91 04 STA ($04),Y
BCB5: C8 INY
BCB6: D0 E6 BNE $BC9E
BCB8: E6 05 INC $05
BCBA: A5 05 LDA $05
BCBC: C9 14 CMP #$14
BCBE: D0 DE BNE $BC9E
BCC0: BD 88 C0 LDA $C088,X
BCC3: A9 00 LDA #$00
BCC5: A0 00 LDY #$00
BCC7: 85 04 STA $04
BCC9: A9 08 LDA #$08
BCCB: 85 05 STA $05
BCCD: 51 04 EOR ($04),Y
BCCF: C8 INY
BCD0: D0 FB BNE $BCCD
BCD2: E6 05 INC $05
BCD4: 85 4E STA $4E
BCD6: A5 05 LDA $05
BCD8: C9 14 CMP #$14
BCDA: D0 F1 BNE $BCCD
BCDC: A5 4E LDA $4E
BCDE: C9 9A CMP #$9A
BCE0: F0 03 BEQ $BCE5
BCE2: 4C 73 BC JMP $BC73
BCE5: A0 56 LDY #$56
BCE7: 99 00 BC STA $BC00,Y
BCEA: C8 INY
BCEB: C0 E7 CPY #$E7
BCED: D0 F8 BNE $BCE7
BCEF: 4C 15 0B JMP $0B15
BCF2: A9 B7 LDA #$B7
BCF4: A0 E8 LDY #$E8
BCF6: 60 RTS
|
|
|
| Revenir en haut de page |
|
|
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 3062
Localisation: Le Chesnay, France
|
| Posté le: Sam 18 Avr 2020, 2:37 Sujet du message: |
|
|
The code of the T3 writing (kindly provided by the publisher as a deleted entry in the catalog)
| Code: |
00/08EE: A9 03 LDA #03
00/08F0: 8D EC B7 STA B7EC
00/08F3: A9 00 LDA #00
00/08F5: 8D F4 B7 STA B7F4
00/08F8: 20 E3 03 JSR 03E3
00/08FB: 20 D9 03 JSR 03D9
00/08FE: A2 60 LDX #60
00/0900: A9 00 LDA #00
00/0902: 85 00 STA 00
00/0904: 85 02 STA 02
00/0906: A9 75 LDA #75
00/0908: 85 01 STA 01
00/090A: A9 0A LDA #0A
00/090C: 85 03 STA 03
00/090E: A9 20 LDA #20
00/0910: 85 04 STA 04
00/0912: BD 89 C0 LDA C089,X
00/0915: A0 05 LDY #05
00/0917: A9 FF LDA #FF
00/0919: 20 A8 FC JSR FCA8
00/091C: 88 DEY
00/091D: D0 F8 BNE 0917 ;-08=
00/091F: A0 EF LDY #EF
00/0921: 4C 26 09 JMP 0926
00/0924: D0 0C BNE 0932 ;+0C=
00/0926: BD 8D C0 LDA C08D,X
00/0929: BD 8E C0 LDA C08E,X
00/092C: 9D 8F C0 STA C08F,X
00/092F: 1D 8C C0 ORA C08C,X
00/0932: D1 00 CMP (00),Y ; $7500
00/0934: D1 00 CMP (00),Y ; $7500
00/0936: B1 02 LDA (02),Y ; source is at $0A00+$EF
00/0938: 9D 8D C0 STA C08D,X
00/093B: DD 8C C0 CMP C08C,X
00/093E: C8 INY
00/093F: D0 E3 BNE 0924 ;-1D=
00/0941: E6 03 INC 03
00/0943: A5 03 LDA 03 ; until $2000
00/0945: C5 04 CMP 04
00/0947: D0 ED BNE 0936 ;-13=
00/0949: A0 00 LDY #00
00/094B: B9 F0 09 LDA 09F0,Y
00/094E: 9D 8D C0 STA C08D,X
00/0951: DD 8C C0 CMP C08C,X
00/0954: C8 INY
00/0955: D1 00 CMP (00),Y
00/0957: D1 00 CMP (00),Y
00/0959: D1 00 CMP (00),Y
00/095B: B9 F0 09 LDA 09F0,Y
00/095E: F0 12 BEQ 0972 ;+12=
00/0960: 9D 8D C0 STA C08D,X
00/0963: DD 8C C0 CMP C08C,X
00/0966: C8 INY
00/0967: B9 F0 09 LDA 09F0,Y
00/096A: F0 06 BEQ 0972 ;+06=
00/096C: 20 E6 09 JSR 09E6
00/096F: 4C 60 09 JMP 0960
00/0972: A8 TAY
00/0973: B1 00 LDA (00),Y
00/0975: 48 PHA
00/0976: 4A LSR
00/0977: 09 AA ORA #AA
00/0979: 9D 8D C0 STA C08D,X
00/097C: DD 8C C0 CMP C08C,X
00/097F: 20 E6 09 JSR 09E6
00/0982: E6 04 INC 04
00/0984: 68 PLA
00/0985: 09 AA ORA #AA
00/0987: 9D 8D C0 STA C08D,X
00/098A: DD 8C C0 CMP C08C,X
00/098D: C8 INY
00/098E: D0 25 BNE 09B5 ;+25=
00/0990: E6 01 INC 01
00/0992: 30 27 BMI 09BB ;+27=
00/0994: B1 00 LDA (00),Y
00/0996: 48 PHA
00/0997: 4A LSR
00/0998: 09 AA ORA #AA
00/099A: 9D 8D C0 STA C08D,X
00/099D: DD 8C C0 CMP C08C,X
00/09A0: 20 E6 09 JSR 09E6
00/09A3: E6 04 INC 04
00/09A5: 68 PLA
00/09A6: 09 AA ORA #AA
00/09A8: 9D 8D C0 STA C08D,X
00/09AB: DD 8C C0 CMP C08C,X
00/09AE: C8 INY
00/09AF: EA NOP
00/09B0: EA NOP
00/09B1: EA NOP
00/09B2: 4C 73 09 JMP 0973
00/09B5: 4C B8 09 JMP 09B8
00/09B8: 4C 73 09 JMP 0973
00/09BB: A9 B5 LDA #B5
00/09BD: 48 PHA
00/09BE: 68 PLA
00/09BF: EA NOP
00/09C0: 9D 8D C0 STA C08D,X
00/09C3: DD 8C C0 CMP C08C,X
00/09C6: A9 FF LDA #FF
00/09C8: 20 E6 09 JSR 09E6
00/09CB: 48 PHA
00/09CC: 68 PLA
00/09CD: EA NOP
00/09CE: 9D 8D C0 STA C08D,X
00/09D1: DD 8C C0 CMP C08C,X
00/09D4: 48 PHA
00/09D5: 68 PLA
00/09D6: EA NOP
00/09D7: EA NOP
00/09D8: 20 E6 09 JSR 09E6
00/09DB: BD 8E C0 LDA C08E,X
00/09DE: BD 8C C0 LDA C08C,X
00/09E1: BD 88 C0 LDA C088,X
00/09E4: EA NOP
00/09E5: EA NOP
00/09E6: 60 RTS
00/09E7: 00 00 BRK 00
00/09E9: 00 00 BRK 00
00/09EB: 00 00 BRK 00
00/09ED: 00 00 BRK 00
00/09EF: 00 FF BRK FF
00/09F1: 3B TSC
00/09F2: CF D3 AC FF CMP FFACD3
00/09F6: AA TAX
00/09F7: EE AB EA INC EAAB
00/09FA: AA TAX
00/09FB: AD ED 18 LDA 18ED
00/09FE: DA PHX
00/09FF: 00 FE BRK FE
00/0A01: AA TAX
00/0A02: AB PLB
00/0A03: EE FB FF INC FFFB
00/0A06: FA PLX
00/0A07: AB PLB
00/0A08: AE FA EF LDX EFFA
00/0A0B: FE AA AB INC ABAA,X
00/0A0E: EE EE EA INC EAEE
00/0A11: AB PLB
00/0A12: BA TSX
|
|
|
| Revenir en haut de page |
|
|
|
|
Vous ne pouvez pas poster de nouveaux sujets dans ce forum
Vous ne pouvez pas répondre aux sujets dans ce forum
Vous ne pouvez pas éditer vos messages dans ce forum
Vous ne pouvez pas supprimer vos messages dans ce forum
Vous ne pouvez pas voter dans les sondages de ce forum
|
|
FAQ 
Rechercher 
Liste des Membres 
Groupes d'utilisateurs
S'enregistrer
Profil 
Se connecter pour vérifier ses messages privés 
Connexion 
