;An introduction to cracking/68000 (c)1991 Hank of the Diskmap Crew.

;Please read this doc in medium resloution.
;Please read this doc in GENST2.PRG
;Start time 12:18 a.m. 6th August 1991.
;Finish time 03:08 p.m. 7th august 1991.

;A long while ago the ALIEN of the Pompey Pirates released a breif
;document about hacking particular types of protection on this
;wonderful machine, As with the ALIEN i am totally fed up with people
;asking "How do you crack oringinal sofware ?" - so here is a starters
;guide.

;Question 1:
;Do you know any 68000 assembler ?
;No ? - Buy the ATARI ST internals by abacus books œ25-00 tops.
;Read the paragraphs on the Gemdos,Bios,Xbios & the Exeption vectors
;then return to this document - Believe me it's easy !!.


;Ok you now know about the traps,exeption vectors & the status reg.

;Qestion 2:
;What vector is at address $10 ?
;Answer - Illegal intruction - Were you right ?

;Question 3:
;what is this trap function -

     clr.l      -(sp)
     move.w      #$20,-(sp)            ;function number
     trap      #1
     addq.w      #6,sp

;Answer - Supervisor mode.
;This trap is probabaly the most important out of all the traps as
;you have to enable supervisor mode to access all the hardware and
;the lower end of memory of the ATARI ST.
;Before going into supervisor mode your SR(status register) will be
;at $0300/8300 after it will be $2300/a300 if it is the later you
;are succesfully in super mode.

;Now a bit about the hardware.
;N.B. - all source code documentation in this file has been optom-
;ised with the ".w" on the end of the hardware or low end memory
;address i.e. $ffff8240.w, you may see this registor or any other
;documentated as $ff8240 or $ffff8240, dont panic it's the same reg.
;this optomisation saves 2 bytes on the later 2 examples. The later
;2 are also examples of "Lazy programing".

;The registers:

;      $ffff8240.w                  ;color 0
;      $ffff8242.w                  ;color 1
     
;      $ffff825c.w                  ;color 15
;      $ffff825e.w                  ;color 16

;These registers form the color pallette as you have probably guesed  
;the next one afer $ffff8242.w would be $ffff8244.w and so on until
;$ffff825e.w - easy ?


;      $ffff820a.w                  ;sync mode
     move.b      #$00,$ffff820a.w      ;60 Hz      (American)
     move.b      #$01,$ffff820a.w      ;70 Hz      (mono)
     move.b      #$02,$ffff820a.w      ;50 Hz      (British)

;      $ffff8260.w                  ;resolution
     move.b      #$00,$ffff8260.w      ;low res
     move.b      #$01,$ffff8260.w      ;med res
     move.b      #$02,$ffff8260.w      ;high res

;      $ffff8001.w                  ;memory config
;don't mess!!

;      $ffff8201.w                  ;high byte of the srceen addr
;      $ffff8203.w                  ;low byte of the srceen addr

     move.b      #$07,$ffff8201.w      ;screen at
     move.b      #$80,$ffff8203.w      ;$78000

;      $fffffc02.w                  ;the keyboard

     move.b      #$12,$fffffc02.w      ;kill mouse
     move.b      #$08,$fffffc02.w      ;restore mouse

;you may also see this reg. addressed as:-

     lea      $fffffc00.w,a0            ;reg. start in a0
;      move.b      #num,2(a0)            ;2+a0 = $fffffc02.w

;      $ffff8800.w                  ;the psg reg.

     move.b      #$0e,$ffff8800.w      ;init psg (disk drive mode)

;when i am looking for a protection i normally search for this addr.

;e.g.:-

     move.w      sr,-(sp)            ;save status register
     or.w      #$0700,sr            ;$2700 on the sr - kill interupts      
     move.b      #$0e,$ffff8800.w      ;init psg
     move.b      $ffff8800.w,d1            ;get drive status
     move.b      d1,d2                  ;save old drive status
     and.b      #$f8,d1                  ;mask bits
     move.b      d1,$ffff8802.w            ;gi select
     move.w      (sp)+,sr            ;restore status register
     rts                        ;return from subroutine

;alernitaly you can address the psg as:

     move.l      #$0e002500,$ffff8800.w      ;read side 0 of the disk
     move.l      #$0e002400,$ffff8800.w      ;read side 1 of the disk
     move.l      #$0e002700,$ffff8800.w      ;de-select (turn off light)

;The MFP interupt registers.

;      $fffffa01.w                  ;paralell port      
;      $fffffa03.w

;      $fffffa23.w
;      $fffffa25.w

;As with the color pallette regs. these regs. are addressed every
;2 bytes after each other.
;Only a byte may be poked in to each reg. as they are addressed
;on un-even boundaries.  


;Most of the other hardware registers are documented in the Internals
;book.

;Op codes
;When cracking games the program normaly has to be modified using HEX
;here are some of the important HEX equlivelents of thier source code
;counterparts.


;      NOP            $4e71            ;no operation
;      ILLEGAL            $4afc            ;illegal instruction
;      RTS            $4e75            ;return from subroutine
;      RTE            $4e73            ;return from exeption
;      MOVEQ #0,D0      $7000            ;clr.l      d0!!
;      BRA            $6000            ;branch always

;The above instructions are the ones i mostly use when cracking games
;How to modify memory is explaned later in the section on monst2.

END OF PART 1

;Protoscan II Protection

LOOP      BSR.S      PROT
     TST.B      D0            ;Original
     BNE.S      LOOP            ;No try again
     CLR.W      -(SP)            ;Function warmstart
     TRAP      #1            ;and return to desktop


PROT      LEA      $63000,A0      ;Buffer
     MOVE.L      A0,$7079E
     MOVEQ      #1,D3
L7054C      MOVE.L      D3,$707A2
     BSR      L70776
     BSR.S      L70582
     BSR.S      L705B8
     BSR.S      L705CE
     BSR      L7060E
     BSR      L7060E
     BSR.S      L705B8
     BSR      L706CA
     BSR      L7073A
     MOVE.B      $707A6,D0
     TST.B      D0
     BEQ.S      L70580
     MOVE.L      $707A2,D3
     DBF      D3,L7054C
L7057E      BRA.S      L7057E
L70580      RTS
L70582      MOVE.W      #0,D0
     ADDQ.B      #1,D0
     LSL.B      #1,D0
     ORI.W      #0,D0
     EORI.B      #7,D0
     ANDI.B      #7,D0
L70596      MOVE.B      #7,$FFFF8800.W
     MOVE.B      #$FF,$FFFF8802.W
     MOVE.B      #$E,$FFFF8800.W
     MOVE.B      $FFFF8800.W,D1
     ANDI.B      #$F8,D1
     OR.B      D0,D1
     MOVE.B      D1,$FFFF8802.W
     RTS
L705B8      MOVE.W      #$80,$FFFF8606.W
     MOVE.W      #$D0,D6
     BSR      L706E0
     MOVEQ      #$28,D7
     BSR      L706DA
     RTS
L705CE      BSR      L706FE
     MOVE.W      #$86,$FFFF8606.W
     MOVE.W      #$4F,D6
     BSR      L706E0
     MOVE.W      #$80,$FFFF8606.W
     MOVE.W      #$1B,D6
     BSR      L706E0
     MOVE.L      #$60000,D7
L705F4      SUBQ.L      #1,D7
     BEQ.S      L70602
     BTST      #5,$FFFFFA01.W
     BNE.S      L705F4
     RTS
L70602      BRA.S      L705CE
     MOVE.W      #$FFF9,$707A6
     RTS
L7060E      CLR.L      $70796
     MOVE      SR,L7078C
     MOVE.W      #$90,$FFFF8606.W
     MOVE.W      #$190,$FFFF8606.W
     MOVE.W      #$90,$FFFF8606.W
     MOVEQ      #$16,D6
     MOVE.W      #$200,D2
     MULU      D6,D2
     MOVE.W      D2,L7078E
     MOVE.L      $7079E,D3
     ADD.L      D3,D2
     MOVE.L      D2,L70792
     BSR      L706E0
     MOVE.L      $7079E,D0
     MOVE.B      D0,$FFFF860D.W
     LSR.L      #8,D0
     MOVE.B      D0,$FFFF860B.W
     LSR.L      #8,D0
     MOVE.B      D0,$FFFF8609.W
     MOVE.W      #$80,$FFFF8606.W
     MOVE.W      #$E8,D6
     BSR.S      L706E0
     MOVE.L      #$50000,D7
     MOVEA.L      L70792(PC),A5
     MOVE.W      #$200,D0
L70678      DBF      D0,L70678
L7067C      BTST      #5,$FFFFFA01.W
     BEQ.S      L706A6
     SUBQ.L      #1,D7
     BEQ.S      L706C4
     MOVE.B      $FFFF8609.W,L70797
     MOVE.B      $FFFF860B.W,L70798
     MOVE.B      $FFFF860D.W,L70799
     CMPA.L      L70796,A5
     BGT.S      L7067C
L706A6      MOVE.W      #$90,$FFFF8606.W
     MOVE.W      $FFFF8606.W,D5
     MOVE.W      D5,L70790
     BTST      #0,D5
     BEQ.S      L706C4
     MOVE.W      #$80,$FFFF8606.W
     BSR.S      L7072C
L706C4      MOVE.W      L7078C(PC),SR
     RTS
L706CA      MOVE.W      #$80,$FFFF8606.W
     MOVE.B      #7,D0
     BSR      L70596
     RTS
L706DA      DBF      D7,L706DA
     RTS
L706E0      BSR.S      L706EE
     MOVE.W      D6,$FFFF8604.W
     BSR.S      L706EE
     RTS
     MOVE.W      $FFFF8604.W,D3
L706EE      MOVE      SR,-(A7)
     MOVE.W      D7,-(A7)
     MOVEQ      #$28,D7
L706F4      DBF      D7,L706F4
     MOVE.W      (A7)+,D7
     MOVE.W      (A7)+,SR
     RTS
L706FE      MOVE.W      L7079A,D6
     ANDI.W      #3,D6
     MOVE.L      #$50000,D7
     MOVE.W      #$80,$FFFF8606.W
     BSR.S      L706E0
L70714      SUBQ.L      #1,D7
     BEQ.S      L70722
     BTST      #5,$FFFFFA01.W
     BNE.S      L70714
     RTS
L70722      MOVE.B      #$F9,$707A6
     RTS
L7072C      BSR.S      L706EE
     MOVE.W      $FFFF8604.W,$7079C
     BSR.S      L706EE
     RTS
L7073A      MOVE.L      $7079E,D1
     ADDI.L      #$2EE0,D1
     MOVEA.L      D1,A0
     MOVE.L      #$DAC,D3
     MOVEQ      #0,D2
     MOVE.W      -(A0),D5
L70750      MOVE.W      -(A0),D0
     CMP.W      D0,D5
     BNE.S      L7075E
     ADDQ.L      #2,D2
     DBF      D3,L70750
     BRA.S      L7076E
L7075E      SUBI.L      #$170C,D2
     BMI.S      L7076E
     CLR.B      $707A6
     RTS
L7076E      ST      $707A6
     RTS
L70776      MOVE.L      #$176F,D2
     MOVEA.L      $7079E,A0
     MOVE.L      $4BA.W,D3
L70784      MOVE.W      D3,(A0)+
     DBF      D2,L70784
     RTS
L7078C      DC.L      0
L7078E      DC.L      0
L70790      DC.L      0
L70792      DC.L      0
L70796      DC.L      0
L70797      DC.L      0
L70798      ORI.B      #3,D0
L70799      DC.L      0
L7079A      DC.L      0



;To remove a Protoscan protection all you have to do is type MOVEQ #0,D0
;RTS ($70004E75) you need the moveq so that D0 is equil (0) when it returns
;from the protection as most of them do a TST.B D0 see above example.


;Here is a brief list of games you will find this protection in:

;The Untouchables
;Postman Pat
;Ninja Warriors
;Continental Curcus
;Where Time Stood Still

;Novela Protection(manual)

;Not so many games use this one but there are the odd ones like
;Carrier Command,Fighter Bomber, Midwinter.

;To crack these you must be more involved with 68000 programing.

;Again leave these ones alone.



;Disk Types:-

;There are 2 types of format in which games appear

;1- the Auto folder booter/Double click booter(desktop)
;2- boot disks - the types with no files visible on the desktop
;i.e. Operation Wolf, Swichblade II(original version).



;Auto folders + Desktop booters can be directly loaded in to monst2
;as executable files.
;you must first load & run the freemem.prg file, then load your
;executable file. (all loading explaned in the monst2 section)

;Boot Disks - These are slightly more tricky as they run from the
;boot sector, To access these you must read in the boot sector
;using the bootfile.prg there is no need to load the freemem.prg
;first you must then "Trace"* through the bootsector, The bootdisk.prg
;file looks something like this:-

*Refer to monst2 section    

     clr.l      -(sp)
     move.w      #$20,-(sp)      ;function supervisor mode
     trap      #1
     addq.w      #6,sp

     move.w      #1,-(sp)      ;read 1 sector
     clr.w      -(sp)            ;side 0
     clr.w      -(sp)            ;track 0
     move.w      #1,-(sp)      ;sector 1
     clr.w      -(sp)            ;dive 0
     clr.l      -(sp)            ;unused long word
     pea      $30000            ;buffer address
     move.w      #8,-(sp)      ;function read sectors
     trap      #14            ;trap xbios
     lea      20(sp),sp      ;correct stack
     jmp      $30000            ;jump to the boot sector

;I will not go into much detail with these as it can become
;quite complicated.

;Once you have read in the bootsector you have accessed the games
;loader.

;For instance if you can get hold of Count Duckula (original)
;then it is a good one to practice on as it loads at a sensible
;address and is not protected in any way.

;1 load the bootdisk.prg.
;2 Insert Count duckula.
;3 fill memory from 10000,80000 with $ee*
;4 trace through the bootdisk.prg until it has jumped to $30000*
;5 trace the Duckula loader until you hit a DBF then do a breakpoint*
;6 your pc should now be on the line JMP (A2)*
;7 trace this line!*
;8 continue tracing until your pc is on the BCC.S line just before
;the JMP (A5) and do another breakpoint.*
;the disk should now be loading into memeory.
;9 when it has finished loading set window M2 to $10000 - ok?
;now do a string search on your fill pattern $ee.
;you may find the odd one in count duckula - just press N until
;you hit a large block of them.
;10 press TAB so you are on window M3 - memory and press the left
;cursor ones.
;11 press TAB twice so you are now on M2 - disassembly and set
;the window to $10000, so now M3 points to the end and M2 points
;to the start!!.
;12 insert a blank formatted disk and save Duckula out as a file.
;to save press S save binary,filename  type DUCK.RAW <return>
;start address,end   - type M2(start),M3(end) <return> it should
;now save out Duckula.  

;N.B. Count Duckula Must allways be run from $10000

;There is a piece of code called "COPY.S" use this to
;relocate Duckula to $10000

;i.e. dest equ      $10000
;incbin      duck.raw

;Full documentation is in this file.


;modifing an executable file.

;As with all executable files(.prg,.tos,.acc,.app,.ttp)
;they have relocation data on the end of the file so if
;you want to crack an executable file you cannot save an
;executable file out if you loaded it into the monitor
;as executable.
;1 you must file memory as with duckula $10000,$80000,$ee
;2 load your program in as binary - press B  Gremlin.prg,$10000
;3 the gremlin.prg will have now loaded at $10000 providing it is
;on the disk!!.
;4 modify the relevent parts.
;5 seach for $ee
;6 point M3 to the end byte by pressing the left cursor as in duckula
;and then set M2 to $10000 and save it out as a binary file as with
;duckula - i hope that is not too complicated.
;N.B. this file will still be executable.

;Monst2 - the best 68000 monitor

;N.B. if you have a spare œ59-99 then buy it!!

;When you press (y) to load the monitor it will prompt you to
;enter an executable file to load.

;1- If you wish to load an exec file type freemem.prg <return twice>
;then press R (run) followed by G (go). Now press ctrl L (load exec file)
;followed by the program you wish to load's name.


;2- A boot disk just type bootdisk.prg <return twice>

;3- A binary file i.e. duckula.raw - press escape
;then B (load Binary file) DUCKULA.RAW,$10000 - easy!
---------------------------------------------------------------

Well it is good to see that a document that I wrote almost 21 years ago is still alive and well on the internet!

As you can see, I certainly put the spell checker in GenST2 to good use, well, actually it did not have one, but that’s what you get for leaving school without any qualifications!

I’m surprised that there is still any interest in the scene, those days were probably one of the best times of my life!

Yes, I don't mind helping out, although, I no longer have any ST disks other than my 'tools' disk, which should still be at my parents house back in Leeds.

Drop me a PM with your contact info, and we'll exchange details so to speak.

Thanks, Col.