D-Bug & Automation Forum | |
D-Bug & Automation Forum >> Coding >> Introduction to ST Hacking By Hank/Automation PT 1
http://d-bug.mooo.com/dbugforums/cgi-bin/yabb2/YaBB.pl?num=1172673889 Message started by Shw on 28.02.07 at 14:44:48 |
Title: Introduction to ST Hacking By Hank/Automation PT 2 Post by Shw on 28.02.07 at 14:46:32
;Copy Protections:- (Disk)
;There are three main types of protections at the moment and they are ;all crap! ;Gremlin Graphics Protection BSR.S GREM CLR.W -(SP) ;fucnction warmstart TRAP #1 GREM LEA $FFFF8604.W,A5 BSR LBD66 MOVEQ #5,D1 BSR LBD76 MOVEQ #0,D0 BSR LBD3C BSR.S LBCCC BSR LBD28 MOVE.L D0,-(A7) BSR LBD66 MOVEQ #$4F,D0 ;$4f = track 79 BSR LBD3C BSR.S LBCCC BSR LBD28 SUB.L D0,(A7) BSR LBD66 CMPI.L #$3C,(A7)+ BGT LBDAE ;BRA HERE TO KILL PROTECTION!! LBCBE MOVEQ #-1,D0 LBCC0 MOVE.W D0,$FFFF8240.W DBF D0,LBCC0 BRA.S LBCBE LBCCC BSR.S LBD06 BSR LBD9A MOVE.W #$90,2(A5) MOVE.W #$190,2(A5) MOVE.W #$90,2(A5) BSR.S LBD20 MOVE.W #$1F,(A5) BSR.S LBD20 MOVE.W #$80,2(A5) BSR.S LBD20 MOVE.W #$E4,(A5) BSR.S LBD20 LBCFA BTST #5,$FFFFFA01.W BNE.S LBCFA RTS LBD06 MOVE.W #$1F40,D1 LBD0A DBF D1,LBD0A RTS LBD10 MOVE.W #$80,2(A5) BSR.S LBD20 MOVE.W (A5),D1 BRA.S LBD20 LBD1C BSR.S LBD20 MOVE.W D0,(A5) LBD20 MOVEQ #$24,D4 LBD22 DBF D4,LBD22 RTS LBD28 MOVEQ #0,D0 MOVE.B 5(A5),D0 SWAP D0 MOVE.B 7(A5),D0 LSL.W #8,D0 MOVE.B 9(A5),D0 RTS LBD3C BSR.S LBD06 MOVE.W #$86,2(A5) BSR.S LBD1C MOVEQ #$10,D0 MOVE.W #$80,2(A5) BSR.S LBD1C MOVE.L #$60000,D3 LBD56 SUBQ.L #1,D3 BEQ LBCBE BTST #5,$FFFFFA01.W BNE.S LBD56 LBD66 MOVE.W #$64,D0 LBD6A BSR.S LBD06 DBF D0,LBD6A BSR LBD10 RTS LBD76 MOVE SR,-(A7) ORI.W #$700,SR MOVE.B #$E,$FFFF8800.W MOVE.B $FFFF8800.W,D0 ANDI.B #$F8,D0 OR.B D1,D0 MOVE.B D0,$FFFF8802.W MOVE.W (A7)+,SR RTS LBD9A MOVE.B #0,9(A5) MOVE.B #$80,7(A5) MOVE.B #7,5(A5) RTS LBDAE MOVEQ #7,D1 BSR LBD76 RTS ;The above protection can removed several ways. ;e.g. 1 - find the following line in the source code ;CMP.L #$3C,(A7)+, now the next line should be BGT ;the opcode for this instruction is $6E00 (BGT) replace ;the $6E00 with $6000 (BRA) - it's now cracked. ;e.g. 2 - Simply put an RTS ($4E75) on the first line of ;the protection (LEA $FFFF8604.W,A5) doing this is better ;as the protection is never run. ;N.B. before using this methord make sure that the protection ;is actually in a sub-routine (JSR) or (BSR) if not only use ;example 1 ;e.g. 3 - Relplace the BSR.S PROT with NOP NOP ($4E71$4E71) ;it has the same effects as above but check the rest of the ;code as a protection can be called from more than one place. ;The above source listing was taken from impossamole - try it. |
D-Bug & Automation Forum » Powered by YaBB 2.6.0! YaBB Forum Software © 2000-2023. All Rights Reserved. |