D-Bug & Automation Forum
D-Bug & Automation Forum >> Coding >> Introduction to ST Hacking By Hank/Automation PT 1
http://d-bug.mooo.com/dbugforums/cgi-bin/yabb2/YaBB.pl?num=1172673889

Message started by Shw on 28.02.07 at 14:44:48

Title: Introduction to ST Hacking By Hank/Automation PT 2
Post by Shw on 28.02.07 at 14:46:32
;Copy Protections:- (Disk)
;There are three main types of protections at the moment and they are
;all crap!

;Gremlin Graphics Protection

     BSR.S      GREM
     CLR.W      -(SP)            ;fucnction warmstart
     TRAP      #1


GREM      LEA      $FFFF8604.W,A5
     BSR      LBD66
     MOVEQ      #5,D1
     BSR      LBD76
     MOVEQ      #0,D0
     BSR      LBD3C
     BSR.S      LBCCC
     BSR      LBD28
     MOVE.L      D0,-(A7)
     BSR      LBD66
     MOVEQ      #$4F,D0            ;$4f = track 79
     BSR      LBD3C
     BSR.S      LBCCC
     BSR      LBD28
     SUB.L      D0,(A7)
     BSR      LBD66
     CMPI.L      #$3C,(A7)+
     BGT      LBDAE            ;BRA HERE TO KILL PROTECTION!!
LBCBE      MOVEQ      #-1,D0
LBCC0      MOVE.W      D0,$FFFF8240.W
     DBF      D0,LBCC0
     BRA.S      LBCBE
LBCCC      BSR.S      LBD06
     BSR      LBD9A
     MOVE.W      #$90,2(A5)
     MOVE.W      #$190,2(A5)
     MOVE.W      #$90,2(A5)
     BSR.S      LBD20
     MOVE.W      #$1F,(A5)
     BSR.S      LBD20
     MOVE.W      #$80,2(A5)
     BSR.S      LBD20
     MOVE.W      #$E4,(A5)
     BSR.S      LBD20
LBCFA      BTST      #5,$FFFFFA01.W
     BNE.S      LBCFA
     RTS
LBD06      MOVE.W      #$1F40,D1
LBD0A      DBF      D1,LBD0A
     RTS
LBD10      MOVE.W      #$80,2(A5)
     BSR.S      LBD20
     MOVE.W      (A5),D1
     BRA.S      LBD20
LBD1C      BSR.S      LBD20
     MOVE.W      D0,(A5)
LBD20      MOVEQ      #$24,D4
LBD22      DBF      D4,LBD22
     RTS
LBD28      MOVEQ      #0,D0
     MOVE.B      5(A5),D0
     SWAP      D0
     MOVE.B      7(A5),D0
     LSL.W      #8,D0
     MOVE.B      9(A5),D0
     RTS
LBD3C      BSR.S      LBD06
     MOVE.W      #$86,2(A5)
     BSR.S      LBD1C
     MOVEQ      #$10,D0
     MOVE.W      #$80,2(A5)
     BSR.S      LBD1C
     MOVE.L      #$60000,D3
LBD56      SUBQ.L      #1,D3
     BEQ      LBCBE
     BTST      #5,$FFFFFA01.W
     BNE.S      LBD56
LBD66      MOVE.W      #$64,D0
LBD6A      BSR.S      LBD06
     DBF      D0,LBD6A
     BSR      LBD10
     RTS
LBD76      MOVE      SR,-(A7)
     ORI.W      #$700,SR
     MOVE.B      #$E,$FFFF8800.W
     MOVE.B      $FFFF8800.W,D0
     ANDI.B      #$F8,D0
     OR.B      D1,D0
     MOVE.B      D0,$FFFF8802.W
     MOVE.W      (A7)+,SR
     RTS
LBD9A      MOVE.B      #0,9(A5)
     MOVE.B      #$80,7(A5)
     MOVE.B      #7,5(A5)
     RTS
LBDAE      MOVEQ      #7,D1
     BSR      LBD76
     RTS


;The above protection can removed several ways.
;e.g. 1 - find the following line in the source code
;CMP.L      #$3C,(A7)+, now the next line should be BGT
;the opcode for this instruction is $6E00 (BGT) replace
;the $6E00 with $6000 (BRA) - it's now cracked.

;e.g. 2 - Simply put an RTS ($4E75) on the first line of
;the protection (LEA $FFFF8604.W,A5) doing this is better
;as the protection is never run.
;N.B. before using this methord make sure that the protection
;is actually in a sub-routine (JSR) or (BSR) if not only use
;example 1

;e.g. 3 - Relplace the BSR.S PROT with NOP NOP ($4E71$4E71)
;it has the same effects as above but check the rest of the
;code as a protection can be called from more than one place.

;The above source listing was taken from impossamole - try it.

D-Bug & Automation Forum » Powered by YaBB 2.6.0!
YaBB Forum Software © 2000-2024. All Rights Reserved.