Flash Back (IPF 1736) 1992 Delphine Software It’s a dos game no disk based protection. Start the game…it’s a password protection.
not really easy, because of many ways to find keyboard routines. If you stop the game with AR and disassemble, you reach each time graphics routine… but we have the location of the program in memory. (with 512K slow fast, the program is at $C0xxxx. address could change).
AR break : We can see on the screen the text “protection”. perhaps we could find the text in memory ? or the code is 6 chars long. Why not searching a cmpi.b #6 ($c390006) (or cmpi.w #6, cmp.b…)
f 0c 39 00 06,c00000 ; CMPI.B #6
Good results; combined with the search of letters, we can see “P” “R” “O”… near the “cmp”. n c0f300
Each address test the same variable at C19252. In this case there are 2 test routines : one near C0F3D8 and another near C19168. (I skipped the C168B0 because it’s not the same address tested) Here is the routine 1:
Exit AR and type some letters. break, take a look at C38330 : here is the chars. we have found the routine! it’s a loop for testing the 6 chars. at C0F3EA it’s the end, go to test code (C0F466). We can break the loop of 6 chars : put 2 NOP (4e71 4e71) at C0F3E0. Another cmpi.b #6 exists at C0F420 : 2x nop at C0F428. Exit AR, press Return. That doesn’t work.
Need to patch more. Second test routine:
at C19170, put 2 Nop.
That works. But the code is still checked.
The 2 testcode routs are at C0F466 and C191FE. NOP the cmp result at lines C0F49A and C1922C. loop 6 chars but never check them 😉 EDIT: the second protection at C191FE is the second password test near the end of the game, when you use the Teleporter.
Exit AR, press Return. OK!
At the protection screen, press Return without having to type 6 chars.
Now let’s go with disassembler for having the whole program and patch it. load file “flashback” as binary (186 kb). search for cmp/protection, find routines, and change bytes. offsets are (from French version) : – 3BE0 first routine – 3C28 – 3C9A second password test near the end – D970 second routine – DA2C save patched file and reboot. hmm…screen stay black. take a look at startup-sequence: “endrun flashback” flashback is launched with “endrun” (endrun load flashback by using LoadSeg). if program is patched, he stop !?! strange…all cracked version use endrun not modified…(I don’t know why. If someone have an explanation, feel free) so, don’t use endrun, change the startup-sequence : “flashback” that works fine now.
How to verify if an other protection is hidden somewhere? play the whole game 😉 you can use already known levels codes : (french version) mode Easy: back, loop, cine, good, spiz, bios, hall mode normal : play, toit, zapp, linx, scsi, gary, pont mode hard : clop, cara, cale, font, hash, fibo, tips (english version) mode Easy: wind, spin, kava, hiro, test, gold, wall mode normal: fire, burn, eggs, gurt, chip, tree, bold mode hard : mine, your, nest, line, lisa, mary, mice Or search if the program check itself if he was modified (hmm…this kind of check should be done each time) : search the lines nopped if they are tested somewhere : C0F3E0 (off 3BE0), C0F49A (off 3C9A), C19170 (off D970), C1922C (off DA2C) no results in French versions. some others versions exist: no more in English version. but positive match for the German version : the program compare the line C1922C (not this one in the original file. based on tuto version) cmpi.l #$66000008,xxxx"beq xxxx ; ok... $66000008 = it’s the “bne xxxx” we have nopped in the test code 2 ! replace the BEQ by a (wonder) BRA = $60 Test the full game. It seems ok now.
ADDON: you can find all the calls to protection routines. the first protection screen (the second one in the tuto) start at offset D6C4 and is called only 1 time : nop at offset 8E8 (jsr $D694). try…no more password at start! other advantage : with the third protection (on German version), if you don’t change anything in the second routine and only skip the call, the instruction check always success. no need to find and patch it.
the “Teleport” protection (the first one in the tuto) is called 19x! what is the good one? if you nop them…the teleport doesn’t work anymore. But it’s not really a problem : no need to press any key.