|
|
|
IDENTIFICATION SERVEUR : 51.77.218.153 - CLIENT : 34.226.244.70 |
|
| Voir le sujet précédent :: Voir le sujet suivant |
| Auteur |
Message |
toinet
Site Admin
Inscrit le: 15 Juin 2007
Messages: 3043
Localisation: Le Chesnay, France
|
 Posté le: Ven 19 Fév 2016, 9:57 Sujet du message: MicroFinesse (McGrawHill) |
 |
|
#726 - This is a US/CA title to create your own paper models. I want sent this title to be able to use it without the dongle it was bundled with.
As indicated in the main title:
| Code: |
MICRO-FINESSE COPYRIGHT P-E AND RH(S)L
NOT FOR SALE OUTSIDE US AND CANADA
DISTRIBUTED BY OSBORNE/MCGRAW-HILL VS2.2
|
Disk format
This is a standard 16-sec floppy, one-side, no extra tracks. In Pascal, so the interleaving (the sectors order) is different from the DOS 3.3 one.
Some sort of boot-trace
This is a Pascal program, so the disk II controller loads T0/S0 at $0800 then the loader tries to boot the System.Apple file then, once everything is in order, it loads and executes the Finesse.Code program.
When you boot your copy, even the original, with no dongle inside your computer, the message is...
| Code: |
THE FINESSE PROGRAM WILL ONLY WORK
IF A WIDGET IS IN THE GAMES SOCKET
|
OK... Understood... What to do next?
1- Scream,
2- Cry, or
3- Have the right tools handy.
Let's go with 3 and get:
- DiskFixer in Pascal mode (use /O/ptions to change the disk OS, press U to tell it to use Pascal UCSD,
- TommyGoog's Wizardry utilities. Why? Because, in 2012, he wrote a Pascal decompiler. I was sure it would help me in understanding the p-code generated by Apple's compiler. I was right 
At first, we have to locate the warning message above. We use the search option of Disk fixer. We find it in the Finesse.code program.
Then, we ask Tommy's utilities to decompile the Finesse.Code program and we find this:
| Code: |
52BB CD 00 16 CXP. CALL EXTERNAL PROCEDURE: 16 IN SEGMENT: 00
52BE 9E 00 AN UNKNOWN STANDARD PROCEDURE ?!?!
52C0 B6 01 03 LOD. PUSH ACTREC(-01).03
52C3 A6 25 20 20 20 49 46 20 41 20 57 49 44 47 45 54 20 49 53 20 49 4E 20 54 48
45 20 47 41 4D 45 53 20 53 4F 43 4B 45 54
IF A WIDGET IS IN THE GAMES SOCKET
LSA. PUSH #(PC+1) POINTER TO THE STRING
52EA D7 NOP. NOP
52EB 00 SLDC. PUSH #0000
52EC CD 00 13 CXP. CALL EXTERNAL PROCEDURE: 13 IN SEGMENT: 00
52EF 9E 00 AN UNKNOWN STANDARD PROCEDURE ?!?!
52F1 B6 01 03 LOD. PUSH ACTREC(-01).03
52F4 CD 00 16 CXP. CALL EXTERNAL PROCEDURE: 16 IN SEGMENT: 00
52F7 9E 00 AN UNKNOWN STANDARD PROCEDURE ?!?!
52F9 01 SLDC. PUSH #0001
52FA A1 02 UJP. IF NOT (TOS) THEN JUMP TO 52FE
52FC B9 (F6) UJP. JUMP TO 52F9 <= here, it infinite loops!
52FE 00 SLDC. PUSH #0000
52FF 00 SLDC. PUSH #0000
5300 CD 10 09 CXP. CALL EXTERNAL PROCEDURE: 09 IN SEGMENT: 10
5303 93 LNOT. PUSH -(TOS) (1'S COMP)
5304 A1 03 UJP. IF NOT (TOS) THEN JUMP TO 5309
5306 CD 0B 01 CXP. CALL EXTERNAL PROCEDURE: 01 IN SEGMENT: 0B
5309 A7 11 83 6E LAE. PUSH #DATASEG(11).036E
|
Where do we find the "9E 00 01 A1 02 B9 F6 00"? We find it on T13/S2/F7 (remember, all my numbers are in hex)
And now? We have to bypass the check or the loop. As I'm a beginner in p-code, I've read Apple's Pascal books, tried to understood the decompiled code thanks to Tommy's utility and I've decided to:
- patch the loop
- NOP it. The opcode for NOP in p-code is D7.
We will replace the B9 F6 code (infinite loop) with D7 D7 and see...
How to crack
Launch Disk.Fixer
Change the DOS type: /O/ptions then /U/ on the DOS type line
Press /D/ to display the directory
Follow file FINESSE.CODE
When you are on T13/S2/FC: B9 F6 -> D7 D7
Write the sector onto the floppy
This is the sector view:
| Code: |
-------------- DISK EDIT ---------------
TRACK $13/SECTOR $02/VOLUME $FE/BYTE $FC
----------------------------------------
$80: 01 03 CD 00 16 9E 00 B6 ..M....6
$88: 01 03 D7 A6 25 20 20 20 ..W&%
$90: 54 48 45 20 46 49 4E 45 THE FINE
$98: 53 53 45 20 50 52 4F 47 SSE PROG
$A0: 52 41 4D 20 57 49 4C 4C RAM WILL
$A8: 20 4F 4E 4C 59 20 57 4F ONLY WO
$B0: 52 4B 00 CD 00 13 9E 00 RK.M....
$B8: B6 01 03 CD 00 16 9E 00 6..M....
$C0: B6 01 03 A6 25 20 20 20 6..&%
$C8: 49 46 20 41 20 57 49 44 IF A WID
$D0: 47 45 54 20 49 53 20 49 GET IS I
$D8: 4E 20 54 48 45 20 47 41 N THE GA
$E0: 4D 45 53 20 53 4F 43 4B MES SOCK
$E8: 45 54 D7 00 CD 00 13 9E ETW.M...
$F0: 00 B6 01 03 CD 00 16 9E .6..M...
$F8: 00 01 A1 02>B9 F6<00 00 ..!.96..
----------------------------------------
BUFFER 0/SLOT 6/DRIVE 1/MASK OFF/NORMAL
PASCAL:FINESSE.CODE /$32
----------------------------------------
|
And you get this after you changed the bytes:
| Code: |
52B8 B6 01 03 LOD. PUSH ACTREC(-01).03
52BB CD 00 16 CXP. CALL EXTERNAL PROCEDURE: 16 IN SEGMENT: 00
52BE 9E 00 AN UNKNOWN STANDARD PROCEDURE ?!?!
52C0 B6 01 03 LOD. PUSH ACTREC(-01).03
52C3 A6 25 20 20 20 49 46 20 41 20 57 49 44 47 45 54 20 49 53 20 49 4E 20 54 48
45 20 47 41 4D 45 53 20 53 4F 43 4B 45 54
IF A WIDGET IS IN THE GAMES SOCKET
LSA. PUSH #(PC+1) POINTER TO THE STRING
52EA D7 NOP. NOP
52EB 00 SLDC. PUSH #0000
52EC CD 00 13 CXP. CALL EXTERNAL PROCEDURE: 13 IN SEGMENT: 00
52EF 9E 00 AN UNKNOWN STANDARD PROCEDURE ?!?!
52F1 B6 01 03 LOD. PUSH ACTREC(-01).03
52F4 CD 00 16 CXP. CALL EXTERNAL PROCEDURE: 16 IN SEGMENT: 00
52F7 9E 00 AN UNKNOWN STANDARD PROCEDURE ?!?!
52F9 01 SLDC. PUSH #0001
52FA A1 02 UJP. IF NOT (TOS) THEN JUMP TO 52FE
52FC D7 NOP. NOP <= here, no more infinite loop!
52FD D7 NOP. NOP
52FE 00 SLDC. PUSH #0000
52FF 00 SLDC. PUSH #0000
5300 CD 10 09 CXP. CALL EXTERNAL PROCEDURE: 09 IN SEGMENT: 10
5303 93 LNOT. PUSH -(TOS) (1'S COMP)
5304 A1 03 UJP. IF NOT (TOS) THEN JUMP TO 5309
|
Yeepee! I just hope there are no other checks, I have not found any but I'm open to suggestions.
The disk images are at http://www.brutaldeluxe.fr/crack/
Reboot and... enjoy,
LoGo
2/2016 |
|
| Revenir en haut de page |
|
 |
|
|
Vous ne pouvez pas poster de nouveaux sujets dans ce forum
Vous ne pouvez pas répondre aux sujets dans ce forum
Vous ne pouvez pas éditer vos messages dans ce forum
Vous ne pouvez pas supprimer vos messages dans ce forum
Vous ne pouvez pas voter dans les sondages de ce forum
|
|
FAQ 
Rechercher 
Liste des Membres 
Groupes d'utilisateurs
S'enregistrer
Profil 
Se connecter pour vérifier ses messages privés 
Connexion 
