▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ░▒▓█ rapid1337.com █▓▒░           
╓──────────────────────────────────────────╖
║                  MERCS                   ║
╟──────────────────────────────────────────╢
║ 1. Original game – find on emunova.net   ║
╟──────────────────────────────────────────╢
║        ·· security/mercs.html ··         ║
╙──────────────────────────────────────────╜

============================================================================
Title ..: MERCS
Author .: staff
Date ...: 2009-03-28
Section : Security
============================================================================


MERCS © CAPCOM/USGOLD 1991

1. Original game – find on emunova.net

2. An Amiga or WINUAE

3. Action Replay or ROM image

4. Pencil and paper

5.  X-copy to create a copy from which we will work

An easy crack to do….. just have 2 minutes for you and it’s ok 😀 Start with
making a copy of the original game disk. You’ll notice an error on track 79.

Plus when looking on track 0 the bootblock, you’ll see that the game use an
allocation file table. This means the game files are coded on the disk, a
bit in the same vein as Black tiger From the same Publisher.

Ok, reset your Amiga, and boot the game :

When you’re on this screen, check when the loader counter stop on track 5,
and activate action replay III I have found the copy protection routine. It
uses a sync of $4124 and the length to get to pass the track is $1900.

Right below the beginning of the prtection routine : 3BC : The registers are
saved on the stack 3C0 : Branch sub routine at 636 3C4 : Test that WORD in
D04 is equal to 0 3CA: Be not equal then branch to 452 This is where we
strike right away, we will change the instruction 3CA by replacing the BNE
by a BEQ.

The game check first that word in address D04 is equal to 0 or it launch the
protected track check Right away. So we need to make it know that
everything’s fine 😀 Ok now we get the string in order to replace the thing
:

```
M 3C0
```

You’ll get this : 61 00 02 74 4A 79 00 00 0D 04 66 Once modified : 61 00 02
74 4A 79 00 00 0D 04 67 Now, let read the bootblock :

```
RT 0 1 70000
```

Now search for the previous string :

```
F 61 00 02 74 4A, 70000
```

It should return you the address 706C0.

The address to modify on disk is 706CA :

```
A 706CA
```

706CA BEQ 70752 There’s no need to recalculate the checksum, So write back
on disk :

```
WT 0 1 70000
```

Reboot your amiga or Winuae and run the fucking game : It works like a charm
!!!

DLFRSILVER in march 2009 Cheers to Musashi9, Stingray, WayneKerr, Galahad,
Codetapper, and ROB!

Played to the end so it’s 100 % Have fun with this slow game and straight
ATARI ST code port !


----------------------------------------------------------------------------
-- rapid1337.com -- The dumping ground for all things tech // knowledge is the weapon --