Silpheed IIgs (Sierra, 1988)

[toinet]

#721 - A great arcade game from Game Arts, the Japanese studio/partner of Sierra.

Protection type
This is a password protection, called off-disk protection. You have to enter the name of an enemy and if you provide the right answer (which is in the manual), then you can play. Otherwise, you quit the game, alas.

Some sort of reverse-engineering
The game loads, shows its great introduction and then a black screen appears. "Super dogfighter flight..." then "Type in the name of the enemy shown below"
That string is located in file GAMEPLAY, in segment 2 at $60BA. Called by segment $2B (named "protchec") called by segment 1 at offset $E6.
A variable at $022E30 is the flag of the protection result: 0 means bad answer ("copy") and <>0 (1 to be precise) means right answer ("original")

How to crack
Launch Block.Warden
Prefix /SILPHEED1
Follow file GAMEPLAY
At offset $126: 22 (JSL) -> AF (LDAL)
At offset $12A: AD (LDA) -> 8D (STA)

What do we do here? Instead of calling the protection check, we will store a non-zero value in the flag. So, we replace a call and load with a load and store. That's all and that works fine.

The disk image is at http://www.brutaldeluxe.fr/crack/

Reboot and... enjoy,

LoGo
2/2016

[toinet]

Some parts of the code and data of file GAMEPLAY