▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ░▒▓█ rapid1337.com █▓▒░           
╓──────────────────────────────────────────╖
║                PipeMania                 ║
╟──────────────────────────────────────────╢
║ Right I’m gonna quickly show you how     ║
║ to bypass the novella protection for     ║
╟──────────────────────────────────────────╢
║      ·· security/pipemania.html ··       ║
╙──────────────────────────────────────────╜

============================================================================
Title ..: PipeMania
Author .: staff
Date ...: 2005-02-06
Section : Security
============================================================================


Right I’m gonna quickly show you how to bypass the novella protection for
Pipemania 🙂 Your probably thinking.. yeah, yeah another novella… well go
boot the game and enter 3 wrong passwords!!

What the game is working.. strange go play for a bit and before long you
will be staring at this screen

![Screenshot1.png](../assets/img/tutorials/pipemania/Screenshot1.png)

Right lets find out whats going on eh! 🙂 Press your cartridge button and
press D to dissassemble 🙂 You should come in at about memory location 4B94
which is simply looping!

![Screenshot2.png](../assets/img/tutorials/pipemania/Screenshot2.png)

Right if you go to the bottom of the screen and then back up soon you’ll see
at address 4B6A a BEQ 4B96 .. this is interesting because if this isn’t
executed it’s pretty obvious that the code to kick you outta the game is
executed 🙁

![Screenshot3.png](../assets/img/tutorials/pipemania/Screenshot3.png)

Lets reboot and when we get to the protection screen

![Screenshot4.png](../assets/img/tutorials/pipemania/Screenshot4.png)

lets change address 4B6A to a BRA 4B96 instead of BEQ, this way it’ll branch
everytime and hopefully not execute the code to kick us out the game!

![Screenshot5.png](../assets/img/tutorials/pipemania/Screenshot5.png)

Right if you now play the game, you wont get kicked out 🙂 Splendid 🙂
wasn’t that simple 😀 Right now we need to make it permanent so we have 2
options.. edit the memory with the replay and save the file to disk or load
the file into a hex editor (as it’s an AmigaDos disk) and edit it that way
🙂 The replay option would work and is explained here in other tutorials in
enough detail for you to simply copy, but you will need other files off the
disk so I’ll do it the hex editor/amigados way 🙂 Right firstly we need to
know what we are looking for and what we are going to change.

Reboot your machine and go back in with the replay at the password screen.

do an M 4B6A and make a note of the first 8 numbers 67 2A 41 F9 Now
reassemble the address to the BRA and again do the M 4B6A. You should now
get: 60 2A 41 F9

![Screenshot6.png](../assets/img/tutorials/pipemania/Screenshot6.png)

– Again make a note of this and now boot into your hexeditor I use ZAP on
the Amiga.. Right load the file PIPEMANIA into your hex editor and do a
binary search for $67 $2A $41 $F9

![Screenshot7.png](../assets/img/tutorials/pipemania/Screenshot7.png)

You will only find the 1 occurance so lets change the $67 to $60 and save
the file back to disk

![Screenshot8.png](../assets/img/tutorials/pipemania/Screenshot8.png)

(make a backup first!!) 🙂 Right boot up and test it 🙂


----------------------------------------------------------------------------
-- rapid1337.com -- The dumping ground for all things tech // knowledge is the weapon --