Prince of Persia (1990) usa version
————————————————-
This has to be the USA version as the other 2 versions (uk / german) all load at different memory locations what you will need
——————————
- original game (find
here)
an amiga or an amiga emulator (winuae)
an action replay cartridge or ar3 rom image for use with winuae
1 megabyte of memory
Defjam Packer
once u have all these set up we shall begin This has to be my all time favourite game of all time ,i fell in love with it the first time i played it on my cousins birthday ,his dad got a disk from work with 4 – 5 games on it and one of them was prince of persia 🙂 it took us 3 days to do the first level 😛 anyhoo back to the cracking , this game has 2 protections 1 is MFM,a disk based protection and the other is Password (i.e manual protection) so lets fire up XCOPY and try to make a copy of this disk as you can see from the picture below the disk is full of errors when we try and make a copy ,only the bootblock is error free so this disk can not be copied but fear not we shall get past this 🙂 i had a lot of fun with this game
ok lets have a look for more protection so boot up the game as normal first you will see the Blue loading screen
then the title screen
so press fire to start the game at level one
you can either play the first level to get to level 2 or use the inbuilt cheat lets use the cheat 😛 press and hold LEFT SHIT key then press L key to skip to the next level but level 2 doesn’t appear instead we are at the Password protection screen
i hope you have your manual ready 😛 hehehehe first enter action replay and press R then return
lets pay attention to this address highlighted in red
type M 63A6 and scroll down about 12 lines
hmm just text so lets start a little earlier type M 6300 and scroll down about 12 lines
hmm interesting 🙂 lets go back to the game ok so if you have your manual ready drink the potion required once done you will be moved on to level 2 now hit you action replay button and scroll up to when we type m 6300 and hit return on that again ,go down 12 lines
hmm somethig has changed notice the 8 F’s highlighted in red interesting 🙂 press and hold CTRL key then press R to restart the game and go back to title press fire to start level one then skip to password screen with left shift and L key hmm hang on we are taken to level 2 not the password screen
ah this game has a built in option so if you have already entered a correct potion you wont need to enter it any more no matter how many times you restart the game so it puts FF FF FF FF at address 6378 if you picked the correct potion and each time you leave level one it checks this address and if FF FF FF FF is there it wont load the password level and will continue to level 2 i feel a easy crack coming on hehehe in other words no need to crack this part we just put FF FF FF FF at address 6378 so prince of persia wont ever load the protection screen 🙂 because we fooled it into thinking we already have 🙂 Devious and lazy i know but hey it works 😛 ok so write that down FF FF FF FF needs to be put at address 3738 moving on 😀 because we have 1 meg the game data is loaded into memory in one go ,which makes it better to crack ,(if you only have half a meg it will load each level as you complete it, hence the reason you must have 1 meg to crack this game) ok so that is the password cracked but what about the MFM tracks how do we crack this one ,well like most early games they loaded in one go ,this game does but only if you have 1meg of ram that is why when you first boot a blue screen appears saying loading 1meg game ,if you only had 512k of ram it would say loading 512k version….. ok so lets load the game then rip off the data into 1 big file ok so lets begin first thing is reboot with the original disk and once the blue screen appears saying loading 1meg game hit action replay and type R ok so lets take a look at what is loading ,to do this we read the bootblock into memory then disassemble it so type
RT 0 01 50000
this will read track 0 to address 50000 now disassemble the bootblock by typing
D 5000c
we start at 5000c because this is where the boot-code always starts and not 50000 because the first few bytes spell the word DOS ok so scroll down and search fora JMP keep searching until you find one at around about 50200 + you should find 2 JMPs but only 1 is jumping to a specific location that is 50226 is jumping to address 7E988
hmm ok right this down ,if we go to this address we see some code ,type
D 7E988
scroll down some more until you see this
another jump,this look like a jmp into the main game ,but there is a lot of data being executed before it gets to this jump ,i suspect its the loader because if we leave action replay and come back in and press D to find out what code is running we will be around this area plus above this jump do you see LEA 00001000.S,A1 this is where the data starts to load into so this is the loader ok so lets stick a freeze loop at the jump address so it wont jump into the game it will just stick at the loop going round and round type
A 7EA30
BRA 7EA30
and exit action replay and let the game load after a while there is no activity lets check the game is finished loading by going back into action replay and press D and enter and we should have this
its stuck at our loop ok so lets rip off all the data shall we hmm but before we do lets make some changes to the game ,the first thing we want to do is stop that pesky password screen from appearing ,we do this by putting FF FF FF FF at address 6378 ,remember?
ok so type M 6378 then replace the first 8 spaces with FF FF FF FF and press enter then ESC ok that’s that taken care of oopps almost forgot replace the BRA loop we made with the original jump ,type
A 7EA30
JMP 1F636
once that has been done you should get some reg information, type R, then type INFO to get some other information and it should look like this
now we have a problem if we load all this data in one go and run it then it will run the MFM track loader too and we don’t want that . We know this starts at address 7E988 so lets remove the track loading routines dissasemble address 7E988 type D 7E988 scroll down some we have a lot of MOVE.L d0,…. ect… ignore those scroll down some more until we come to our first BSR right this is the loading routine right down to the jump into the main game so we bypass this with a simple BRA to the jump ,so scroll and find that first BSR at address 7E9BE and we know the jump is at address 7EA30 but we want to bra to the code just above the jump at address 7ea2c otherwise the game wont load so we found our first BSR ar address 7E9BE so this is where we skip the mfm track loader
type A 7E9BE
BRa 7ea2c
,right that’s it for now lets finally save our data put in a blank disk and type SM 1,1000 bA000 we know it starts from address 1000 and if we do a NQ 70000 we know the last bit of data in memory ends at address ba000 phew ,once this is done lets pack our data into 1 big executable for this we need DEFJAM packer so completely reset and load up defjam packer once loaded you are asked if you want to do a mega crunch ,no we don’t so say N for no then we are asked for low memory so we put in our start address which is 1000 then we are asked for high memory so we say ba000 it will clear that amount of memory and then it asks for scan range this is saying how much do you want to pack the file ,the higher the range the longer it takes to pack but the smaller the file size will be ,but this aint to important right now just put a safe number like 24
next it asks load type ,put O for plain then for file-name we insert our disk with the saved data on and type df0:1 and load into address 1000 it will then load the data so wait a while then once that is done hit return to start packing ,the screen will go funky and then black with some digits so dont panic after a while it should say finished ,you hit enter once more then it asks for a jump address ,here we type 7e988 because this is our jump address then it asks for flash register we want a good old fashion green and black flash so choose 00 now it asks do you want a pro de-cruncher ,yes we do the reason for this is our game uses up memory that DOS normally users so if we try load in dos it will crash but with a pro de-cruncher this isnt a problem so choose yes then it asks for (sheesh it asks for a lot doesn’t it) DMACON : right so now lets go back to our first image we saved ,remember we pressed R then typed INFO well all that information we need right now so go get it just to remind you here it is
ok so for DMACON: we see on the image it is 0380 so type that next is INTENA and from our picture we see it is 4000 so type that next is ADKCON and we have it as 2100 so put that next is status reg which is 2708 so use that next is locate de-cruncher ,lets put it in a safe place at address 100 next is stack ,put 1000 ok now save it to a blank disk and save it as persia it will ask do you want to save again ,choose no ,then it asks do you want to run it now ,choose yes ,and after a while the screen starts to flash then hey presto the game loads
and you have a 1 filed fully cracked version of prince of persia so far there are 2 other versions out there both are the same version PAL EURO and both cracked and trained by angels ,although the fusion trainer says its +3 but its not they just ripped off angels hard work , the game has infinite lives anyway so that isn’t a trainer option so anyhoo this is the USA version and I have 3 trainer options for it 1 is time one is energy and the other is a fully working proper level skip ,the inbuilt level skip only lets you go to level 4 but mine by passes that so trainer makers out there msg me and we can make a cool trainer for this too