▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ░▒▓█ rapid1337.com █▓▒░           
╓──────────────────────────────────────────╖
║                 Baby jo                  ║
╟──────────────────────────────────────────╢
║ ?You will need following:                ║
╟──────────────────────────────────────────╢
║       ·· security/baby-jo.html ··        ║
╙──────────────────────────────────────────╜

============================================================================
Title ..: Baby jo
Author .: staff
Date ...: 2005-02-26
Section : Security
============================================================================


Baby Jo ? Going Home ? Loricil 1991 ?You will need following:

1. Original game

? get it from your local supplier 🙂

2. An Amiga or WINUAE

3. Action Replay

or ROM image

4. Pencil and paper

Start by making a copy of original game disk. This is to determine type of
protection.

You?ll notice an error on track 79. This is some type of a disk based
protection, where you can?t duplicate a specially written track, probably a
long track When you boot copy of game, the protection runs short after
screen turns black. Game continues to load and everything seems fine. When
you press fire at the title screen to start game, nothing happens. Title
screen just re-appears.

This must be the protection, that have ? done something ? to the game. Hmm?

Boot original game and enter AR when screen starts to turn black. Type ? D ?
and hold enter down, until bottom of screen has reached. Scroll back up and
stop when this appears:

![image001.png](../assets/img/tutorials/baby-jo/image001.png)

Protection routine starts at address 7610. I found it, by doing some
breakpointing.

Address 7636 calls the disk accessing part and 763A moves the result from
this, into address 78DC.

Let?s stick a breakpoint to this address and exit AR. AR will then activate,
when address 763A are reached and we see the result in D0.

Set breakpoint: BS 763A

![image003.png](../assets/img/tutorials/baby-jo/image003.png)

When AR pops up, press R to see registers. Protection returns ? 19B1 ? in D0
+ D6. See the opcodes from address 7610 with: M 7610.

We do this, so we can find the routine on disk, and patch it permanently.
Protection is located somewhere between track 0 ? 4, read them into memory,
starting at address 30000: RT 0 A 30000.

![image005.png](../assets/img/tutorials/baby-jo/image005.png)

?

Search for the opcodes from address 7610, see picture above. AR returns
address 39010. Disassemble this address, and stop when the disk accessing
part of the routine appears.

Assemble address 3907A and insert following code: 3907A; MOVEQ #0,D0; clear
D0 3907C; MOVEQ #0,D6; clear D6 3907E; MOVE.L #19B1,D6; move ? magic number
? into D6 39084; BRA 3908E; branch to part, that moves ? magic number ? into
D0 and returns

![image007.png](../assets/img/tutorials/baby-jo/image007.png)

?

Insert copy of game and write tracks back: WT 0 A 30000.

![image009.png](../assets/img/tutorials/baby-jo/image009.png)

Go test your new crack!

Perhaps it would be a little easier to play test, if we added a micro
trainer, that gives us 255 lives?

Assuming you still have all three lives, enter AR and start the trainer
with: TS 3.

![image011.png](../assets/img/tutorials/baby-jo/image011.png)

Exit AR and loose one life. Enter AR again and continue trainer: T 2. AR
returns Address 12C7D.

This address holds the number of lives.

Try typing M 12C7D. First HEX is 02. It would normally start with 03, three
lives?.

Let?s determine, at which point this address is set to 03, so we can patch
it.

Reboot game an enter AR when the title screen appears. Check address 12C7D:
M 12C7D The address seems to be set at this time.

![image013.png](../assets/img/tutorials/baby-jo/image013.png)

?

Press D and hold enter down, until this appears:

![image015.png](../assets/img/tutorials/baby-jo/image015.png)

Stick a break point to address DB0, exit AR and start game. AR appears when
you press fire. This might be a good address to take over, and make it jump
to a little trainer patch instead. DB0 makes a JSR EE5E, take note.

![image017.png](../assets/img/tutorials/baby-jo/image017.png)

Let?s find start of the main file. It?s usually loaded into low chip, see
memory with N 0 and hold enter down. Release it when you reach around
address 800. The data seems to start at address 400.

Reboot game and enter AR, when game begins to load. Search for jumps to
address 400: FA 400.

AR returns address 40A42. Stick a break point to address 40A42 and exit AR.

![image019.png](../assets/img/tutorials/baby-jo/image019.png)

When AR pops up, check if number of lives should be set at this stage: M
12C7D. Seems not?.

Let?s find the ?

```
JMP 400 ? on disk, make it jump to address 100, where we?ll put a little
trainer
```

patch.

But first, press ? R ? to see registers. A0 points to address 400. Change
this to 0 with: ? R A0 0 ?. If we don?t do this, we?ll get a lot of false
references.

![image021.png](../assets/img/tutorials/baby-jo/image021.png)

?

The ? JMP 400 ? is probably also located somewhere between track 0 ? 4, so
read them into memory, starting at address 30000: RT 0 A 30000. Find the ?
JMP 400 ?, starting at address 30000: FA 400 30000.

AR returns address 31A42. Assemble this address and change it to ? JMP 100 ?
instead. See picture below:?

![image023.png](../assets/img/tutorials/baby-jo/image023.png)

Write tracks back:

```
WT 0 A 30000. Time to code the patch. But first, check the boot block for
spare
```

bytes. Read it into memory, starting at address 70000: RT 0 1 70000. See
memory with N 70000 + enter a few times.

![image025.png](../assets/img/tutorials/baby-jo/image025.png)

Plenty of space here to put a little trainer. Assemble 70200 and insert
following code: 70200; MOVEM.L D0-D7,-(A7); save registers, as we?re going
to mess with D0 70204; MOVE.L #FFFFFFFF,D0; fill D0 with F 7020A; MOVE.W
D0,DFF180;

```
move D0 into colour register DFF180
```

70210; SUBI.W #1,D0; subtract 1 from D0 70214; CMPI.W #1,D0; compare #1 with
D0 70218; BEQ 70226; if equal, branch to 70226 and start game without
trainer 7021A; BTST #6,BFE001; test for left mouse pressed 70222; BEQ 7022E;
if pressed, branch to 7022E 70224; BRA 7020A; loop flash, until D0 = 0
70226; MOVEM.L (A7)+,D0-D7; restore registers 7022A; JMP 400.S; start game
7022E; MOVEM.L (A7)+,D0-D7; restore registers 70232; MOVE.L #4EB90000,DB0;
change address DB0 to JSR 148 7023C; MOVE.W #148,DB4; change address DB0 to
JSR 100 70244; JMP 400.S; start game 70248; MOVE.B #FF,12C7D; this will
appear at address 148, move #FF to 12C7D and gives you 255 lives 70250; JMP
EE5E; jmp to address EE5E, we took over this, from DB0. The sub routine at
EE5E will return to DB6

![image027.png](../assets/img/tutorials/baby-jo/image027.png)

When you boot game, it loads in main file and jumps to address 100. The
screen will flash for a few secs. If nothing is done here, game will start
as normal. If you press left mouse bottom, address DB0 will be altered to ?
JSR 148 ?

and patch the lives, so you have 255.

Let?s find a way, to move patch into address 100. Disassemble start of boot
code and hit enter a few times: D 7000C.

Take note of the first line of code, and change it to ? BSR 70100 ?, this
will call 70100. Assemble address 70100 and code a small track loader:
70100; MOVEA.L 4.S,A6; EXEC 70104; MOVE.W #2,1C(A1); cmd read 7010A; MOVE.L
#100,28(A1); destination address for data 70112; MOVE.L #200,24(A1); amount
of data to read 7011A; MOVE.L #200,2C(A1); offset on disk to read from
70122; JSR ?1C8(A6); I/O 70126; LEA 70036(PC),A0; restore code, we removed
in start of boot block.

7012A; RTS; return to original loader

![image029.png](../assets/img/tutorials/baby-jo/image029.png)

As usual, why should it change, you can?t assemble address 70122 with AR.
Insert the opcodes instead, see picture above.

Correct boot block check sum: BOOTCHK 70000, if you want game to be able to
boot 🙂

![image031.png](../assets/img/tutorials/baby-jo/image031.png)

And write boot block back: WT 0 1 70000.

When you boot game, press left mouse bottom at the flashing screen, and
you?ll get 255 life?s. If you do nothing, game continues normally, after a
few secs. ??

![image033.png](../assets/img/tutorials/baby-jo/image033.png)

Original supplied by the fastest: DLFRSILVER Rob


----------------------------------------------------------------------------
-- rapid1337.com -- The dumping ground for all things tech // knowledge is the weapon --