|
|
|
IDENTIFICATION SERVEUR : 10.0.97.129 - CLIENT : 23.20.166.68 |
|
| Voir le sujet précédent :: Voir le sujet suivant |
| Auteur |
Message |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 2886
Localisation: Le Chesnay, France
|
 Posté le: Mer 04 Mai 2016, 3:36 Sujet du message: Spellicopter (Designware, 1983) |
 |
|
#859 - Another eduware. really arcade oriented. It looks like Choplifter: you can to pick up letters to create a word from a pre-built or your own lists.
Disk structure
This is a standard double-sided DOS 3.3 disk with a change of epilog markers in the data field.
| Code: |
Header: D5AA96 DEAA
Data: D5AAAD DEAA20 (std is DEAAEB)
|
Yes, 20. Weird, isn't it? In the read routine, there are some changes, you'll see below.
There are no extra tracks.
The interleaving for data loading is different from the standard DOS 3.3 one.
How to copy
Launch Advanced Demuffin 1.4
Insert the original disk in drive 1
A blank disk in drive 2
Press B to boot
Copy the disk
Normalize the disk
Launch DiskFixer
Perform the following changes:
| Code: |
Skip reading timing bits:
T0/S3/2F: BD 8C -> 18 60
The timing bits:
T0/S2/A8: 20 -> EB (the right marker for the data write routine)
T0/S5/64: A5 1E -> A9 7E (read)
The interleaving tables:
T0/S0/4D: 00 0D 0B 09 07 05 03 01 0E 0C 0A 08 06 04 02 0F
T0/S9/B8: 00 0D 0B 09 07 05 03 01 0E 0C 0A 08 06 04 02 0F
|
That's all.
Alt. crack
If you read the code below carefully, you'll see that you can have an alt. crack.The code at $800 sets a value in zero page $1F (0 or non-zero). A non-zero value will path the RWTS to put a SEC (carry set) so that, all reads will generate an error. Let's tell the routine not to patch the RWTS... We save two bytes, ahem.
| Code: |
T0/S2/A8: 20 -> EB (the right marker for the data write routine)
T0/S5/98: A5 1F -> A9 00 (do not patch the RWTS)
The interleaving tables:
T0/S0/4D: 00 0D 0B 09 07 05 03 01 0E 0C 0A 08 06 04 02 0F
T0/S9/B8: 00 0D 0B 09 07 05 03 01 0E 0C 0A 08 06 04 02 0F
|
The disk image are available at http://www.brutaldeluxe.fr/crack/
Reboot and... enjoy,
LoGo
5/2016
Dernière édition par toinet le Mer 04 Mai 2016, 4:04; édité 2 fois |
|
| Revenir en haut de page |
|
 |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 2886
Localisation: Le Chesnay, France
|
| Posté le: Mer 04 Mai 2016, 3:43 Sujet du message: |
|
|
Some code:
| Code: |
Reading a data field and the timing bits and store at $1E
0013:84 26 STY $26
0015:BC 8C C0 LDY $C08C,X
0018:10 FB BPL $0015
001A:59 00 BA EOR $BA00,Y
001D:A4 26 LDY $26
001F:99 00 BB STA $BB00,Y
0022:C8 INY
0023:D0 EE BNE $0013
0025:BC 8C C0 LDY $C08C,X
0028:10 FB BPL $0025
002A:D9 00 BA LDA $BA00,Y
002D:D0 13 BNE $0042
002F:BD 8C C0 LDA $C08C,X *
0032:10 FB BPL $002F
0034:B8 CLV
0035:BD 8C C0 LDA $C08C,X
0038:10 FB BPL $0035
003A:B8 CLV
003B:1E 8C C0 ASL $C08C,X
003E:26 1E ROL $1E *
0040:50 5C BVC $009E
0042:38 SEC
0043:60 RTS
Writing the data field and #$20 as the last epilog marker
0081:AA TAX
0082:BD 29 BA LDA $BA29,X
0085:AE 78 06 LDX $0678
0088:9D 8D C0 STA $C08D,X
008B:BD 8C C0 LDA $C08C,X
008E:B9 00 BB LDA $BB00,Y
0091:C8 INY
0092:D0 EA BNE $007E
0094:AA TAX
0095:BD 29 BA LDA $BA29,X
0098:A6 27 LDX $27
009A:20 BB B8 JSR $B8BB
009D:A9 DE LDA #$DE
009F:20 B8 B8 JSR $B8B8
00A2:A9 AA LDA #$AA
00A4:20 B8 B8 JSR $B8B8
00A7:A9 20 LDA #$20 ; *
00A9:20 B8 B8 JSR $B8B8
00AC:A9 FF LDA #$FF
00AE:20 B8 B8 JSR $B8B8
00B1:BD 8E C0 LDA $C08E,X
00B4:BD 8C C0 LDA $C08C,X
00B7:60 RTS
The routine that uses the timing bits:
0060:A0 00 LDY #$00
0062:84 02 STY $02
0064:A5 1E LDA $1E
0066:85 08 STA $08
0068:0A ASL
0069:90 01 BCC $006C
006B:C8 INY
006C:48 PHA
006D:68 PLA
006E:D0 F8 BNE $0068
0070:C0 02 CPY #$02
0072:69 FF ADC #$FF
0074:85 1F STA $1F
...
|
|
|
| Revenir en haut de page |
|
|
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 2886
Localisation: Le Chesnay, France
|
| Posté le: Mer 04 Mai 2016, 3:57 Sujet du message: |
|
|
The boot trace is simple : controller reads T0/S0 that reads the RWTS that jumps to $BB00 where a routine is generated at $800. At $800 the code reads the remaining track 0 sectors, works with the epilog marker bits and then control is granted to load the rest of the program.
We must know that value that is collected from the disk. We know the system writes a #$20 as the third epilog marker of the data field. You'll have the original routine and the one I modified to get the value:
| Code: |
We are at $BB00. This is the original routine
0000:86 1B STX $1B
0002:BA TSX
0003:BD 02 01 LDA $0102,X
0006:85 03 STA $03
0008:18 CLC
0009:69 04 ADC #$04
000B:85 05 STA $05
000D:A0 00 LDY #$00
000F:84 02 STY $02
0011:A0 40 LDY #$40
0013:84 04 STY $04
0015:A0 39 LDY #$39
0017:A9 93 LDA #$93
0019:91 02 STA ($02),Y
001B:C8 INY
001C:A5 03 LDA $03
001E:91 02 STA ($02),Y
0020:A0 7F LDY #$7F
0022:B1 04 LDA ($04),Y
0024:99 00 08 STA $0800,Y
0027:88 DEY
0028:10 F8 BPL $0022
002A:A6 1B LDX $1B ; Our routine is moved
002C:4C 00 08 JMP $0800 ; Execute it
002F:00 BRK
0030:00 BRK
0031:00 BRK
0032:00 BRK
0033:00 BRK
0034:00 BRK
0035:00 BRK
0036:00 BRK
0037:00 BRK
0038:00 BRK
0039:00 BRK
003A:00 BRK
003B:00 BRK
003C:00 BRK
003D:00 BRK
003E:00 BRK
003F:00 BRK
0040:A9 00 LDA #$00 ; This is $800
0042:A0 EC LDY #$EC ; track
0044:91 02 STA ($02),Y
0046:C8 INY
0047:91 02 STA ($02),Y
0049:A9 09 LDA #$09 ; address
004B:A0 F1 LDY #$F1
004D:91 02 STA ($02),Y
004F:A9 08 LDA #$08 ; for later
0051:A0 E1 LDY #$E1
0053:91 02 STA ($02),Y
0055:A9 4C LDA #$4C ; where to read
0057:85 01 STA $01
0059:A9 93 LDA #$93
005B:85 02 STA $02
005D:20 01 00 JSR $0001
0060:A0 00 LDY #$00
0062:84 02 STY $02
0064:A5 1E LDA $1E ; get the bits
0066:85 08 STA $08
0068:0A ASL
0069:90 01 BCC $006C
006B:C8 INY
006C:48 PHA
006D:68 PLA
006E:D0 F8 BNE $0068
0070:C0 02 CPY #$02 ; carry yes or no
0072:69 FF ADC #$FF ; and adds
0074:85 1F STA $1F ; isn't that subtle?
0076:A9 00 LDA #$00 ; update the IOB table
0078:A0 EC LDY #$EC
007A:91 02 STA ($02),Y
007C:A0 E2 LDY #$E2
007E:B1 02 LDA ($02),Y
0080:A0 ED LDY #$ED
0082:91 02 STA ($02),Y
0084:A0 E3 LDY #$E3
0086:B1 02 LDA ($02),Y
0088:A0 F1 LDY #$F1
008A:91 02 STA ($02),Y
008C:A0 E0 LDY #$E0
008E:B1 02 LDA ($02),Y
0090:A0 E1 LDY #$E1
0092:91 02 STA ($02),Y
0094:A0 93 LDY #$93
0096:84 02 STY $02
0098:A5 1F LDA $1F ; did we have 0?
009A:F0 05 BEQ $00A1
009C:A9 38 LDA #$38 ; patch the read OK/KO with SEC
009E:8D 9E B9 STA $B99E ; flag of the RWTS (dft is CLC)
00A1:A0 60 LDY #$60
00A3:A9 00 LDA #$00
00A5:99 00 08 STA $0800,Y
00A8:88 DEY
00A9:D0 FA BNE $00A5
00AB:4C 01 00 JMP $0001
|
And now the patched version to get the third marker value at $1E. You boot with the modified disk. After five seconds, you remove the disk, put the original one and press a key. At $FE, you'll have the value of $1E and at $FF, you'll have the value of Y.
| Code: |
----------- DISASSEMBLY MODE -----------
0000:86 1B STX $1B
0002:BA TSX
0003:BD 02 01 LDA $0102,X
0006:85 03 STA $03
0008:18 CLC
0009:69 04 ADC #$04
000B:85 05 STA $05
000D:A0 00 LDY #$00
000F:84 02 STY $02
0011:A0 40 LDY #$40
0013:84 04 STY $04
0015:A0 39 LDY #$39
0017:A9 93 LDA #$93
0019:91 02 STA ($02),Y
001B:C8 INY
001C:A5 03 LDA $03
001E:91 02 STA ($02),Y
0020:A0 7F LDY #$7F
0022:B1 04 LDA ($04),Y
0024:99 00 08 STA $0800,Y
0027:88 DEY
0028:10 F8 BPL $0022
002A:A6 1B LDX $1B
002C:AD 00 C0 LDA $C000 ; Wait for a key
002F:10 FB BPL $002C
0031:2C 10 C0 BIT $C010
0034:4C 00 08 JMP $0800 ; execute code...
0037:00 BRK
0038:00 BRK
0039:00 BRK
003A:00 BRK
003B:00 BRK
003C:00 BRK
003D:00 BRK
003E:00 BRK
003F:00 BRK
0040:A9 00 LDA #$00
0042:A0 EC LDY #$EC
0044:91 02 STA ($02),Y
0046:C8 INY
0047:91 02 STA ($02),Y
0049:A9 09 LDA #$09
004B:A0 F1 LDY #$F1
004D:91 02 STA ($02),Y
004F:A9 08 LDA #$08
0051:A0 E1 LDY #$E1
0053:91 02 STA ($02),Y
0055:A9 4C LDA #$4C
0057:85 01 STA $01
0059:A9 93 LDA #$93
005B:85 02 STA $02
005D:20 01 00 JSR $0001
0060:A0 00 LDY #$00
0062:84 02 STY $02
0064:A5 1E LDA $1E
0066:85 08 STA $08
0068:0A ASL
0069:90 01 BCC $006C
006B:C8 INY
006C:48 PHA
006D:68 PLA
006E:D0 F8 BNE $0068
0070:98 TYA ; save Y
0071:85 FF STA $FF
0073:A5 1E LDA $1E ; save $1E
0075:85 FE STA $FE
0077:4C 59 FF JMP $FF59
007A:91 02 STA ($02),Y
007C:A0 E2 LDY #$E2
...
|
|
|
| Revenir en haut de page |
|
|
|
|
Vous ne pouvez pas poster de nouveaux sujets dans ce forum
Vous ne pouvez pas répondre aux sujets dans ce forum
Vous ne pouvez pas éditer vos messages dans ce forum
Vous ne pouvez pas supprimer vos messages dans ce forum
Vous ne pouvez pas voter dans les sondages de ce forum
|
|
FAQ 
Rechercher 
Liste des Membres 
Groupes d'utilisateurs
S'enregistrer
Profil 
Se connecter pour vérifier ses messages privés 
Connexion 
