|
|
IDENTIFICATION SERVEUR : 10.0.97.129 - CLIENT : 54.197.24.206 |
|
Voir le sujet précédent :: Voir le sujet suivant |
Auteur |
Message |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2949 Localisation: Le Chesnay, France
|
Posté le: Sam 21 Mai 2016, 16:21 Sujet du message: Laserforce IIgs (Britannica, 1989) |
|
|
#873 - By H. Aalbers. Someone's playing games with you... It started out as a routine space probe. But suddenly you've been swept into someone else's idea of a good time: watching you fight for your life.
Disk structure
We have a standard 3.5" disk with a bad block, block #$63F or 1599. It seems we are in front of the standard Britannica protection (see Task force for more information).
More information on the bad block
At first, I thought the block was not formatted. That is not correct, the block contains data. But the data can be read if and only if the data address markers are correctly modified. The standard values are D5AAAD for the data field. Here it is ADD5AA.
I browsed the different program files and found no evidence of checking the values of the pseudo bad block. So, if we bypass the check, that may be sufficient.
How to copy
Use ZZCopy or Photonix II to copy your original disk. Then, store it in a dry and safe place.
Boot trace
The disk boots, GS/OS arrives and launches LASER.SYS16 (the intro program) and then quits to PROG.2 (we can understand that because there is a switch between the SHR and text screen, meaning a quit to some other file)
Funny protections
Laserforce contains three protection checks, all different and not used apart from the bad block one:
- Track length: file LASER.SYS16, segment 8 (called by end of segment 1)
- Nibble check: file PROG.2, segment 9 (called by end of segment 1)
- Bad block: file PROG.2, segment A (called at $078F)
Did Britannica include the three to change the one to use overtime? We'll never know. But what we know if that Huibert, its developer, has always worked on a protection-free version, the protection was later added by Britannica.
How to crack
Launch Block.Warden and
Code: |
Prefix /LASERFORCE
Follow file PROG.2
At offset $561: 22 -> AF
Write the block back on disk
|
That's all.
Reboot and... enjoy,
LoGo
5/2016
Derničre édition par toinet le Sam 21 Mai 2016, 16:23; édité 1 fois |
|
Revenir en haut de page |
|
 |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2949 Localisation: Le Chesnay, France
|
Posté le: Sam 21 Mai 2016, 16:22 Sujet du message: |
|
|
And some code. See the usage of a jump table. A jump table is a kind of OMF segment that contains call addresses within dynamic segments (those not loaded at the time of launch)
Code: |
Jump table: a way to jump to addresses in dynamic segments
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
0B/0000: 0000000000 DS $0008
0B/0008: 0000 DW $0000
0B/000A: 0100 DW $0001
0B/000C: 0A00 DW $000A ; Segment
0B/000E: 00000000 ADRL $00000000 ; Address
0B/0012: 22000000 JSL $000000 ; Jump to protection
0B/0016: 0000 DW $0000
0B/0018: 0100 DW $0001
0B/001A: 0900 DW $0009
0B/001C: 00000000 ADRL $00000000
0B/0020: 22000000 JSL $000000 ; Just return
0B/0024: 0000 DW $0000
0B/0026: 0100 DW $0001
0B/0028: 0900 DW $0009
0B/002A: 01000000 ADRL $00000001
0B/002E: 22000000 JSL $000000 ; Just prot check again
0B/0032: 00000000 DS $0004
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
The call of the protection
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
01/0770: AF34C0E1 LDAL $E1C034
01/0774: 29F0 AND #$F0
01/0776: 8F34C0E1 STAL $E1C034
01/077A: AF2BC0E1 LDAL $E1C02B
01/077E: 2910 AND #$10
01/0780: 8DFB01 STA $01FB
01/0783: C220 REP #$20
01/0785: 22A800E1 JSL GSOS
01/0789: 0800 DW $0008 ; Volume
01/078B: F1020100 ADRL $000102F1
01/078F: 2212000B JSL $0B0012 ; Check disk!
01/0793: 9C8700 STZ $0087
01/0796: 9C9B02 STZ $029B
01/0799: A90100 LDA #$0001
01/079C: 8D9902 STA $0299
01/079F: 203E85 JSR $853E
01/07A2: 207398 JSR $9873
01/07A5: 20A797 JSR $97A7
01/07A8: 20A590 JSR $90A5
01/07AB: 20B991 JSR $91B9
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
Now looking for hidden nibbles
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
09/0000: 6B RTL ; Just return
09/0001: 4B PHK ; Just prot check
09/0002: AB PLB
09/0003: E230 SEP #$30
09/0005: A004 LDY #$04
09/0007: B1E0 LDA ($E0),Y
09/0009: 8DCA01 STA $01CA
09/000C: AA TAX
09/000D: C8 INY
09/000E: B1E0 LDA ($E0),Y
09/0010: 8DCB01 STA $01CB
09/0013: 203801 JSR $0138
09/0016: 8DCC01 STA $01CC
09/0019: 9C3200 STZ $0032
09/001C: A207 LDX #$07
09/001E: 86EA STX $EA
09/0020: 203300 JSR $0033
09/0023: 900C BCC $0031
09/0025: A6EA LDX $EA
09/0027: CA DEX
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
The hidden nibble protection check (not active)
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
01/FE9C: 08 PHP ; Another check
01/FE9D: 0B PHD ; at the end of
01/FE9E: 8B PHB ; the game code
01/FE9F: 4B PHK ; NOT called, so inactive...
01/FEA0: AB PLB
01/FEA1: C230 REP #$30
01/FEA3: A308 LDA $08,S
01/FEA5: 8D25FF STA $FF25
01/FEA8: 20BFFE JSR $FEBF ; Get memory
01/FEAB: B008 BCS $FEB5
01/FEAD: 2220000B JSL $0B0020 ; Check nibbles (just RTL)
01/FEB1: A90000 LDA #$0000 ; We're good
01/FEB4: 18 CLC
01/FEB5: AB PLB
01/FEB6: 2B PLD
01/FEB7: 2E23FF ROL $FF23
01/FEBA: 28 PLP
01/FEBB: 6E23FF ROR $FF23
01/FEBE: 6B RTL
01/FEBF: F40000 PEA $0000
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
|
|
|
Revenir en haut de page |
|
 |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2949 Localisation: Le Chesnay, France
|
Posté le: Sam 21 Mai 2016, 16:22 Sujet du message: |
|
|
And the Block.Warden views
Code: |
Block: $038B (907) Volume name: LASERFORCE Friday 21-May-16 5:05
Prefix: /LASERFORCE/
Following: PROG.2, Type S16, Rel block 3, Byte $000400
1142: AF 34 C0 E1 LDAL $E1C034 /4@a 1180: 20 BC 92 JSR $92BC <.
1146: 29 F0 AND #$F0 )p 1183: 20 61 8D JSR $8D61 a.
1148: 8F 34 C0 E1 STAL $E1C034 .4@a 1186: F4 00 00 PEA $0000 t..
114C: AF 2B C0 E1 LDAL $E1C02B /+@a 1189: F4 1F 00 PEA $001F t..
1150: 29 10 AND #$10 ). 118C: A2 03 LDX #$03 ".
1152: 8D FB 01 STA $01FB .{. 118E: 0C 22 00 TSB $0022 .".
1155: C2 20 REP %00100000 B 1191: 00 BRK .
1157: 22 A8 00 E1 JSL $E100A8 "(.a 1192: E1 68 SBC ($68,X) ah
115B: 08 00 (online) .. 1194: 8D DB 02 STA $02DB .[.
115D: F1 02 00 00 q... 1197: 18 CLC .
1161: 22 00 00 00 JSL $000000 "... 1198: 60 RTS `
1165: 9C 87 00 STZ $0087 ... 1199: 22 67 99 00 JSL $009967 "g..
1168: 9C 9B 02 STZ $029B ... 119D: 22 CC 66 00 JSL $0066CC "Lf.
116B: A9 01 00 LDA #$0001 ).. 11A1: 20 9F 7E JSR $7E9F .~
116E: 8D 99 02 STA $0299 ... 11A4: AD 87 00 LDA $0087 -..
1171: 20 3E 85 JSR $853E >. 11A7: F0 01 BEQ $11AA p.
1174: 20 73 98 JSR $9873 s. 11A9: 60 RTS `
1177: 20 A7 97 JSR $97A7 '. 11AA: AD 3F 01 LDA $013F -?.
117A: 20 A5 90 JSR $90A5 %. 11AD: 8D 3D 01 STA $013D .=.
117D: 20 B9 91 JSR $91B9 9. 11B0: 20 5D 98 JSR $985D ].
Block: $038B (907) Volume name: LASERFORCE Friday 21-May-16 5:05
Prefix: /LASERFORCE/
Following: PROG.2, Type S16, Rel block 3, Byte $000561
(c) Q 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F Edit mode
1988ZSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
Z 100: 72 61 70 68 69 63 20 62 75 66 66 65 72 20 45 72 raphic buffer Er
b Z 110: 72 6F 72 20 77 61 73 20 24 00 00 00 00 0D 0A 00 ror was $.......
B y Z 120: 68 8D 79 00 68 8D 7B 00 F4 00 00 F4 00 00 F4 0A h.y.h.{.t..t..t.
L Z 130: 00 A2 03 11 22 00 00 E1 68 8D 91 01 68 8D 93 01 .".."..ah...h...
O G Z 140: E2 20 AF 34 C0 E1 29 F0 8F 34 C0 E1 AF 2B C0 E1 b /4@a)p.4@a/+@a
C l Z 150: 29 10 8D FB 01 C2 20 22 A8 00 E1 08 00 F1 02 00 )..{.B "(.a..q..
K e Z 160: 00>22<00 00 00 9C 87 00 9C 9B 02 A9 01 00 8D 99 .".........)....
n Z 170: 02 20 3E 85 20 73 98 20 A7 97 20 A5 90 20 B9 91 . >. s. '. %. 9.
W Z 180: 20 BC 92 20 61 8D F4 00 00 F4 1F 00 A2 03 0C 22 <. a.t..t..".."
A B Z 190: 00 00 E1 68 8D DB 02 18 60 22 67 99 00 22 CC 66 ..ah.[..`"g.."Lf
R r Z 1A0: 00 20 9F 7E AD 87 00 F0 01 60 AD 3F 01 8D 3D 01 . .~-..p.`-?..=.
D e Z 1B0: 20 5D 98 22 00 26 00 22 94 94 00 20 09 72 20 28 ].".&."... .r (
E d Z 1C0: 83 20 06 94 22 18 25 00 20 19 94 AD DF 02 D0 11 . ..".%. ..-_.P.
N o Z 1D0: A9 03 00 8D F5 01 8D F7 01 20 A9 26 20 D2 26 80 )...u..w. )& R&.
n Z 1E0: 0F A9 50 00 8D F5 01 8D F7 01 20 A9 26 20 D2 26 .)P..u..w. )& R&
Z 1F0: 20 0E 7E 9C 35 01 9C 37 01 9C 39 01 9C 3B 01 9C .~.5..7..9..;..
|
|
|
Revenir en haut de page |
|
 |
toinet Site Admin
Inscrit le: 15 Juin 2007 Messages: 2949 Localisation: Le Chesnay, France
|
Posté le: Sam 21 Mai 2016, 16:22 Sujet du message: |
|
|
Sorry Huibert! |
|
Revenir en haut de page |
|
 |
|
|
Vous ne pouvez pas poster de nouveaux sujets dans ce forum Vous ne pouvez pas répondre aux sujets dans ce forum Vous ne pouvez pas éditer vos messages dans ce forum Vous ne pouvez pas supprimer vos messages dans ce forum Vous ne pouvez pas voter dans les sondages de ce forum
|
|