▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ░▒▓█ rapid1337.com █▓▒░           
╓──────────────────────────────────────────╖
║                Chuck Rock                ║
╟──────────────────────────────────────────╢
║ 1. Original game ? find on emunova.net   ║
╟──────────────────────────────────────────╢
║      ·· security/chuck-rock.html ··      ║
╙──────────────────────────────────────────╜

============================================================================
Title ..: Chuck Rock
Author .: staff
Date ...: 2004-11-28
Section : Security
============================================================================


Chuck Rock ? Core Design

1. Original game ? find on emunova.net

2. An Amiga or WINUAE

3. Action Replay or ROM image

4. Pencil and paper

5. One blank disk – find it in your local Amiga store

6. Copylock Decoder ? find on codetapper.com

7. Scientific calculator (build into windows)

Start by making a copy of original game disks. This is to determine type of
protection.

You?ll notice an error on track 0, on both disks. This is probably a
copylock protection.

Copy of game crashes short after boot, due to the copylock is failing.

Boot game again and enter AR when the Core logo appears. Copylocks often
starts with a ? PEA $$$$(PC) ?, search for the opcodes: F 48 7A. AR returns
four addresses, this is because copylock is moved from one memory location
to another. Take note of address 6E5C, copylock starts here.

![1.gif](../assets/img/tutorials/chuck-rock/1.gif)

Disassemble address 6E5C and hold enter down, until you reach around address
778A.

Copylock ends around address 777E and we have a compare of magic number with
D0 in address 7780. Perhaps you should take note of this ?

Insert a blank disk and save out copylock: SM COPYLOCK,6E5C 7786 Start
copylock decoder and load in saved copylock:

![2.gif](../assets/img/tutorials/chuck-rock/2.gif)

CD will ask for the sync, choose $89?? ? We have original keydisk. Insert
disk 1 and press ok.

![3.gif](../assets/img/tutorials/chuck-rock/3.gif)

It then asks for D3 register, choose $0000.

![4.gif](../assets/img/tutorials/chuck-rock/4.gif)

After a few secs, decoded copylock is ready to be saved. Insert disk with
saved copylock and press ok.

![5.gif](../assets/img/tutorials/chuck-rock/5.gif)

Fire up AR and load decrypted copylock into memory so we can have a look at
it: LM COPYLOCK.DEC,40000

![6.gif](../assets/img/tutorials/chuck-rock/6.gif)

Address 403E6 is the one we are interested in. This code will appear in most
copylocks and it?s here we?ll wire magic number. When we have done that,
there is no need for disk access part to be executed, so we can branch past
that part.

You can see the code is getting a little ? weird ? around address 40226, try
to disassemble address 40428 and hit enter

```
a few times. You?ll notice a BRA at address 40430, this BRA also appears in
```

most copylocks, and this is the address we?ll branch to.

![7.gif](../assets/img/tutorials/chuck-rock/7.gif)

Assemble address 403E6 and insert the code you see in the picture above. We
only do this, so we can see the opcodes for our patch, because we?ll need
them to calculate the encrypted opcodes.

You can see the opcodes in the picture above, marked with red.

To calculate the new encrypted opcodes, we?ll need the encrypted opcodes for
the previous long word instruction to our changes.

The instruction before our changes started at address 403E2.

Load encrypted copylock into memory, starting at address 40000: LM
COPYLOCK,40000.

![8.gif](../assets/img/tutorials/chuck-rock/8.gif)

See opcodes with M 403E2.

We now have everything need to make the calcs.

xor the encrypted opcodes with the non ? encrypted opcodes and you?ll get
the new encrypted opcodes ENCRYPTED NEW UNENCRYPTED NEW ENCRYPTED A47BF875
with 203C9B50 = 84476325 Last 2 Bytes ?

?

ENCRYPTED NEW UNENCRYPTED NEW ENCRYPTED A47B with CBE8 = 6F93 ?

?

?

Take the previous encrypted long word and xor: ENCRYPTED NEW UNENCRYPTED NEW
ENCRYPTED 63256F93 with 60000042 = 03256FD1 ?

?

?

Then new encrypted opcodes for copylock looks like this: 84 47 63 25 6F 93
03 25 6F D1.

We simply replace these new opcodes with the original opcodes in the
copylock and it?s cracked.

Copylock is located on track 41. Insert copy of disk 1and read track 57 into
memory starting at address 30000;

```
RT 72 2 30000.
```

We have the opcodes for the previous long word instruction to our changes.

Search for it, starting at address 30000: F A4 7B F8 75,30000.

AR returns address 31E56, see opcodes with M 31E56.

![9.gif](../assets/img/tutorials/chuck-rock/9.gif)

Previous long word instruction is marked with red. The opcodes we need to
change, came right after and they are marked with white. Insert the new
opcodes you calculated, marked with green. Don?t forget to press enter when
done.

Write track back: WT 72 2 30000.

And now? you are not finished L There is also a copylock track on disk 2 and
it?s executed, when game request for disk 2. The copylock routine is located
on disk 1, in a ProPacked data file. Let?s try to find a way to patch the
decrunched copylock before its executed.

Copylock 2 is easy to crack, since the opcodes from copylock 1 can be used.

Boot your newly cracked disk 1 and enter AR, when prompted to insert disk 2.
Search for copylock: F 48 7A.

AR returns address 15AEC & 15AFC. This means that copylock 2 starts at
address 15AEC, take note of this.

NDOS games often load data into either low or high chip memory. See memory
with N 0 and stop when you reach around address 1580:

![10.gif](../assets/img/tutorials/chuck-rock/10.gif)

Data on address 1000 seems to be start of something. Check if anything jumps
to this address with FA 1000.

AR returns two addresses, where one of them is a JMP 1000.

![11.gif](../assets/img/tutorials/chuck-rock/11.gif)

Reboot game and enter AR when the Core logo appears. Check if this jumps
appears at this early state of game boot:

```
D 613A0. The jump surely appears, and it?s probably not even crunched . Then
```

it would be really great if the copylock was decrunched when the game
performs the jump, but not executed yet.

![12.gif](../assets/img/tutorials/chuck-rock/12.gif)

Stick a breakpoint to address 613A0: BS 613A0 and continue game. After a
while AR pops up. Copylock started at address 15AEC, disassemble this
address and hit enter a few times. You?ll notice that the copylock is
decrunched and and game haven?t executed it yet, since it hasn?t requested
for disk two.

Let?s take over this jump and change it to JMP C0, where we?ll put a little
patch, that inserts the cracked opcodes into the copylock.

The jump is located on track 41 (find by trial and error), read it into
memory starting at address 30000: RT 52 2 30000.

Search for the jump, starting at address 30000: FA 1000 30000.

AR returns address 319A0.

![13.gif](../assets/img/tutorials/chuck-rock/13.gif)

Assemble address 319A0 and change the JMP 1000 to JMP C0 and write track
back, see picture above.

We now have to determine where in copylock, to insert new opcodes. This
copylock is equal to copylock 1, so we can reuse the opcodes. Search for the
opcodes for the previous long word instruction, to our changes: F A4 7B F8
75.

AR returns address 15ECE, see opcodes with M 15ECE.

![14.gif](../assets/img/tutorials/chuck-rock/14.gif)

The instruction we searched for is marked with red. The opcodes we wanted to
change came right after. They are marked with white. The new opcodes are
marked with grey. Since we have to insert the opcodes with the MOVE command,
the easiest thing is to divide them into two long words and one word.

Long word 1 starts at address 15ED2 and it?s marked with yellow. Long word 2
starts at address 15ED6 and it?s marked with green. The last word starts at
address 15EDA and it?s marked with orange.

Next step is coding the patch and add a track loader that moves it into
address C0.

Read out track 0: RT 0 2 70000.

We now have track 0 in memory, starting at address 70000. Let?s move
original boot block to another location on disk.

Make a new boot block that moves our patch and original boot block into
memory, and then executes original boot block.

If you check address 71A00 with N71A00, you?ll notice that this offset from
disk is not used.

Move original boot block to offset 1A00; TRANS 70000 70400 71A00.

![15.gif](../assets/img/tutorials/chuck-rock/15.gif)

Assemble address 70200 (offset $200 of new boot block) and insert following
code: 70200; MOVE.L #84476325,15ED2; move first long word of crack into
copylock 7020A; MOVE.L #6F930325,15ED6; move second long word of crack into
copylock 70214; MOVE.W #6FD1,15EDA; move last word of crack into copylock
7021C; JMP 1000.S; jump we took over, jump back to game.

This little patch will move the new encrypted opcodes into copylock.

Assemble address 7000C and make the two track loaders:

![16.gif](../assets/img/tutorials/chuck-rock/16.gif)

The code from address 7000C ? 70054 will first move patch into memory,
starting at address C0 from offset $200 on disk. It will then move original
boot block from offset $1A00 into memory, staring at address 60000. It will
then be executed by the jump to address 6000C.

Address 7002A & 70050 can?t be assembled with AR, insert the opcodes
instead.

Correct boot block checksum with BOOTCHK 70000 and write track back: WT 0 2
70000.

![17.gif](../assets/img/tutorials/chuck-rock/17.gif)

Dedicated to sweet sweet Victoria?.

Rob ?

?

?

?

?


----------------------------------------------------------------------------
-- rapid1337.com -- The dumping ground for all things tech // knowledge is the weapon --