▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ░▒▓█ rapid1337.com █▓▒░           
╓──────────────────────────────────────────╖
║                Road Rash                 ║
╟──────────────────────────────────────────╢
║ You will need following:                 ║
╟──────────────────────────────────────────╢
║      ·· security/road-rash.html ··       ║
╙──────────────────────────────────────────╜

============================================================================
Title ..: Road Rash
Author .: staff
Date ...: 2004-09-21
Section : Security
============================================================================


Road Rash ? Electronic Arts 1992 You will need following:

1. Original game ? find on emunova.net

2. An Amiga or WINUAE

3. Action Replay or ROM image

4. Pencil and paper

5. Byte Killer v1.3 ? find on amiga-stuff.com

6. 1 blank disk

Note! Addresses AND registers may differ on your computer, due to different
memory configurations.

Start by making a copy of original game disks. Every thing seems to be ok,
so this is probably a novella protection.

Boot copy of game. After some loading, a screen similar to this appears:

![1.gif](../assets/img/tutorials/road-rash/1.gif)

Where should I know from?

Enter 111 as answer and enter AR. We have entered 111 and the opcodes for
1?s is 31. Search for 111; F 31 31 31.

AR returns one address; C33276. This address holds what ever we type in.

![2.gif](../assets/img/tutorials/road-rash/2.gif)

Let?s see what else happens with address C33276; FA C33276 C00000. AR
returns six addresses. We are interested in the second one; C33214.
Disassemble this address and hit enter a few times.

Address C33220 looks interesting, since it compares A0,A1. If equal, address
C33222 continues game.

![3.gif](../assets/img/tutorials/road-rash/3.gif)

Let?s change the BEQ on address C33222 to a BRA, so game continues no matter
what we type in. See picture above.

Exit AR and hit enter at the protection screen.

![4.gif](../assets/img/tutorials/road-rash/4.gif)

The game continues!

Enter AR again. We altered address C33222 from BEQ to BRA, take note of this
+ the address.

The easy part is now over. The protection is located in a file, witch is
packed with Pack ? Ice. I can?t find this cruncher anywhere, so we have to
patch it instead.

Let?s start by finding the decrunch routine. Pack ? Ice?s crunch ID is ?
Ice! ?, opcodes are: 49 63 65 21.

Load the file ? lomain.ami ? into memory, starting at location 40000; LM
LOMAIN.AMI,40000 File is located between address 40000 46FB0.

Search for the opcodes, starting at address 40000; F 49 63 65 21,40000

![5.gif](../assets/img/tutorials/road-rash/5.gif)

AR returns one address; 450F0. Disassemble this address, hold enter down
until bottom of screen is reached. Use curser up to scroll back up with,
until this appears:

![6.gif](../assets/img/tutorials/road-rash/6.gif)

It seems like the decrunch routine starts at address 450EA. Let?s see, what
calls this address: FA 450EA 40000 AR returns two addresses, disassemble the
second one and hit enter a few times.

![7.gif](../assets/img/tutorials/road-rash/7.gif)

When the game jumps into (A1) at address 44570, the protection have been
decrunched.

Let?s take over this jump, so it jumps to address C0, where we will insert a
patch. We have to insert the JMP C0 at address 4456A, since JMP C0 is four
bytes longer than JMP (A1).

Take note of address 4456A & 44570 and change address 4456A to JMP C0.

![8.gif](../assets/img/tutorials/road-rash/8.gif)

Save file back to disk: SM LOMAIN.AMI,40000 46FB0.

Boot copy of game. Enter AR when the title screen appears. Assemble address
C0 and insert following code: C0; MOVEA.L 4C98,A1; original game code C6;
BRA C6; loop routine.

This will cause the game to loop, after protection has been decrunched,
instead of executing it.

![9.gif](../assets/img/tutorials/road-rash/9.gif)

Exit AR and start game. Game loads for a while, and you?ll see a little man
on a motorbike driving out of your screen.

You should now have a black screen with no music. Enter AR and press D then
enter then Esc.

You should be standing at the loop routine:

![10.gif](../assets/img/tutorials/road-rash/10.gif)

Press R to see register. The game jumped into whatever A1 pointed to and A1
points to address C00000.

This means that I have slow memory and game doesn?t decrunch to absolute
memory.

Hmmm this makes it a bit more tricky, since A1 changes along with different
memory configurations.

Remember the BEQ in the protection was located at address C33222 ? A1 points
to address C00000.

If we add #33222 to (A1), A1 would point to BEQ. We can then change the BEQ
to BRA and then subtract #33222 from (A1).

In this way, the patch will work on all memory configurations.

Assemble address C0 and insert following code: C0; MOVEA.L 4C98,A1; original
game code C6; ADDA.L #33222,A1; add #33222 to A1 CC; MOVE.W #60F6,(A1);
insert opcodes for BRA (60F6) to what ever A1 points to D0; SUBA.L
#33222,A1; subtract #33222 from A1, restoring it to original value D6; JMP
(A1); original game code, jump to game D8; RTS; jump address for Byte Killer

![11.gif](../assets/img/tutorials/road-rash/11.gif)

Insert disk with Byte Killer on and save memory to disk as a file called cr;
SM CR,C0 DA.

We need our patch to get loaded to address C0. For this purpose, we?ll use
Byte Killer. With Byte Killer, we can locate our patch at address C0 and
make it executable, so we can start it from Startup-Sequence Boot disk With
BK on and execute it.

Insert parameters marked with RED, followed by enter:

![12.gif](../assets/img/tutorials/road-rash/12.gif)

Copy file crack to your copy of game and enter AR.

We have to modify startup-sequence, so it first loads our patch and then the
game loader. Type M 30000 + enter And insert following opcodes:

![13.gif](../assets/img/tutorials/road-rash/13.gif)

Save memory to disk, as a file called startup-sequence, in drawer S: SM
S/STARTUP-SEQUENCE,30000 30012.

When our patch is executed from startup-sequence, BK unpacks it and locates
it at address C0. BK then jumps to address D8 witch is a RTS, hint; nothing
happens, game continues to load. When game have decrunched, we have altered
it, so it jumps to our patch at address C0 instead of the protection. Our
patch modifies protection and jumps into it.

![14.gif](../assets/img/tutorials/road-rash/14.gif)

![image029.jpg](../assets/img/tutorials/road-rash/image029.jpg)

I have tested it on following configs: A500 2 MB Chip A500 512K Chip + 512K
slow A500 512K Chip + 512K fast A1200 2MB Chip A1200 2MB Chip + 4MB fast
Dedicated to sweet sweet Victoria Rob


----------------------------------------------------------------------------
-- rapid1337.com -- The dumping ground for all things tech // knowledge is the weapon --