▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ░▒▓█ rapid1337.com █▓▒░           
╓──────────────────────────────────────────╖
║              Fighter Bomber              ║
╟──────────────────────────────────────────╢
║ You will need following:                 ║
╟──────────────────────────────────────────╢
║    ·· security/fighter-bomber.html ··    ║
╙──────────────────────────────────────────╜

============================================================================
Title ..: Fighter Bomber
Author .: staff
Date ...: 2004-08-26
Section : Security
============================================================================


Fighter Bomber ? Vektor Grafix You will need following:

1. Original game ? find on emunova.net

2. An Amiga or WINUAE

3. Action Replay or ROM image

4. Pencil and paper

This crack covers both the copylock + novella protection.

Note! Some addresses may differ on your computer, due to different memory
configurations.

Start by making a copy of original game disks. You?ll notice a error on
track 0 on disk 1, this is probably a copylock routine.

Boot COPY of game, after the intro- animation, track counter goes to 0, and
after a while to track 36. The game keeps doing this over and over again.
This is the copylock kicking in. Enter AR and search for copylock with: ? F
48 7A ?.

AR returns six addresses, the copylock starts at address 7E322.

![image003.png](../assets/img/tutorials/fighter-bomber/image003.png)

Disassemble address 7E322 with; ? D 7E322 ? and hold enter down until you
see something like the picture above.

Address 7E84E checks magic number with D0 and address 7E854 branches on, if
they are equal. Change the ? BEQ 7E86C ?

to ? BRA 7E86C ? and exit AR. This will force the game to continue, whatever
magic number is correct or not.

![image005.png](../assets/img/tutorials/fighter-bomber/image005.png)

After a few secs, game continues to load. So, lets load copylock from disk
into memory and make a patch witch will return magic number in D0 and then
return to where it was called. Copylock is located on track 0, read this
track into memory, starting at location 30000; ? RT 0 2 30000 ?.

![image007.png](../assets/img/tutorials/fighter-bomber/image007.png)

Search for copylock with: ? F 48 7A ,30000 ?. The copylock starts at address
30322, this is where we will insert our patch. Assemble address 30322 ( A
30322) and insert a patch like this:

![image009.png](../assets/img/tutorials/fighter-bomber/image009.png)

Part of the copylock routine is located on the bootblock, bootblock
stretches from 30000 30400. Our changes will cause the bootblock chksum to
get corrupt, and game won?t boot. Correct this with: ? BOOTCHK 30000 ?.

Write track back with: ? WT 0 2 30000 ?. Reboot machine and see what
happens. After you have inserted disk 2 and chosen language, this screen
appears:

![image011.png](../assets/img/tutorials/fighter-bomber/image011.png)

Well, since I lost my manual, we probably have to find a way to bypass this
novella.

Enter AR and press D to disassemble actual memory. When you reach bottom of
screen, use curser up to scroll back up with until you see this:

![image013.png](../assets/img/tutorials/fighter-bomber/image013.png)

The novella starts at address 37726 (find out by trial and error). Let?s
find this on disk and insert a ? RTS ? on the first address of protection,
causing it to return to its entry point. The Novella is stored on disk 1, on
track 55.

We need some opcode to search for, before we read track into memory. Let?s
use opcode from address 37726.

Type; ? M 37726 ?, hit enter + Esc. Write down the first 12 numbers (23 FC
00 03 7A AA)

![image015.png](../assets/img/tutorials/fighter-bomber/image015.png)

Insert COPY of disk one. Read track 55 into memory with: ? RT 6E 2 20000 ?.

Search for the opcode, starting at address 20000; ? F 23 FC 00 03 7A
AA,20000 ?. We are interested in address

20226. Try to disassemble this

address and hit enter a few times. Looks familiar ? Good, because this is
start of the protection.

![image017.png](../assets/img/tutorials/fighter-bomber/image017.png)

Assemble address 20226 and insert a ? RTS ?, see picture above. Write track
back with: ? WT 6E 2 20000 ?, and reboot game.

![image019.jpg](../assets/img/tutorials/fighter-bomber/image019.jpg)

Notice that the game skips the whole novella, after you have selected
language.

Dedicated to sweet sweet Victoria.

Rob


----------------------------------------------------------------------------
-- rapid1337.com -- The dumping ground for all things tech // knowledge is the weapon --