rapid1337.com

Walker

2004-08-14 · [ security ] · by staff

You will need following:

<-- The Quest Of Agravain | [ Security ]

[ read in diskmag ]


Walker ? Psygnosis 1993 You will need following:

  1. Original game ? find on romshare.com

  2. An Amiga or WINUAE

  3. Action Replay or ROM image

  4. Pencil and paper

Note ! Some addresses may be different on your computer depending on memory configurations.

Yes, here we go again? Make a copy of the original game disks. You will notice an error on track 0, but only on disk 1.

Boot COPY of game. After a few seconds, track counter goes to track 0 but game continues to load. You can actually start game and every thing seems to be ok. When you have completed the first mission this picture appears:

image003.jpg

That?s strange, I still had all three lives. When you play original game, this doesn?t happen. This is probably due to the copylock routine, witch haven?t returned magic number correct. Boot ORIGINAL disk 1. Instantly when track counter goes to track 0, enter AR. Find Copylock with: ? F 48 7A ?

image005.png

Lets find end of it. Disassemble address 6040C with: ? D 6040C ?

and hold enter down until you see something like this

image007.png

Trust me, I had a lot of fun finding the end of this little piggy. It actually ends at address 60CF0. If you disassemble this address, everything looks a little more normal. Ok, who cares.. we need to find magic number. Insert a ? BRA 60CF0 ?

at address 60CF0, causing a eternity loop after magic number have been returned.

See picture below.

Exit AR, track counter will move to track 42 and hangs there.

image009.png

Enter AR and press ? R ? to see registers, see picture above.

Well, guess a number? I have tried this operation with COPY of disk 1 and all registers where the same except for D7. So, D7 must hold magic number. Lets check if its returned elsewhere. Type: ? F 75 CE 90 E2 ?

image011.png

We are interested in address B4, 7FF0C and 7FFD6. I believe we could settle witch address B4 when we make our patch.

But to be sure, we?ll also return it in address 7FF0C and 7FFD6.

Insert COPY of disk 1.

Now its time to find the copylock on disk. Perhaps you have noticed that this game uses a track loader. But this is not a ?true? NDOS game. All files are access able in DOS format.

Type ? DIR ?

image013.png

Copylock is located in the file called ? WALKER ?, read it into memory with: ? LM WALKER,30000 ?, take note of where its located in memory. Find copylock with: ? F 48 7A,30000 ?. It will return two addresses. We will insert our patch at the first address, but first we need to find end of copylock.

image015.png

Disassemble address 30486 and hold enter down until you see this:

image017.png

Remember from earlier ? Good, it ends at address 30D6A, take note of this.

Now its time to make our patch. Assemble address 30486 with: ? A 30486 ? and insert this code:

image019.jpg

Save file back to disk with: ? SM WALKER 30000 351DA ?.

Reboot game and start playing.

image021.jpg

That?s right, now you?re able to play beyond mission 1.

I have checked all other files (they are all crunched and encrypted with ProPack, each with different decryption keys) for copylock routines, but I couldn?t find any.

I have play tested quite long into the game but not to the end, just so you know?

Crack dedicated to sweeet Victoria Rob

#amiga #cracking #track-protection


<-- The Quest Of Agravain | [ Security ] | Ghouls ?N? Ghosts ? -->