▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ░▒▓█ rapid1337.com █▓▒░ ╓──────────────────────────────────────────╖ ║ Wonderboy in Monsterland ║ ╟──────────────────────────────────────────╢ ║ SUPER WONDERBOY IN MONSTER LAND (1989 ║ ║ ACTIVISION) ║ ╟──────────────────────────────────────────╢ ║·· security/wonderboy-in-monsterland.html ║ ╙──────────────────────────────────────────╜ ============================================================================ Title ..: Wonderboy in Monsterland Author .: staff Date ...: 2004-05-15 Section : Security ============================================================================ SUPER WONDERBOY IN MONSTER LAND (1989 ACTIVISION) ————————————————————————- Crack plus Trainer our first task is to see what type of protection this game has, so boot the orignal up and play for a while ,notice anythign pop up saying goto manual page XX line Xx ect….? no? ok cool then i presume the protection is disc based, so boot up your copy of X-COPY (what u mean u dont have it ,dont lie everyone had a copy of this) and lets make a backup of the original disc ,now what this does is well make ``` a backup for us to use (if its possible) and also tells us what type of ``` disc protection is on the game ,so you start to make a copy and oh no,the first track upper side has an error :O but thats ok the rest of the tracks are clean ![wb1.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb1.jpg) so what this tells us is that this game is not MFM protected which is a bitch to crack because every track apart from the boot sector,is protected so we only have 1 track protected thats cool it probibly means its just a copylock protection and what this means is the error track cant be duplicated with a standard amiga you need a special machine,so when the game kicks and a copylock routine executes to check this track and make sure its the original track and since it cant be duplicated it checks and is unable to find that track and thus cause the game to crash so load up the backup disk you just made after a while you will notice the nothing is happening .. just a black screen there is someloading happening but still nothing happens, so reboot and hit your action replay button when the screen turns black and lets search for that copylock routine ,alot of copylocks start with 487a hex so lets search for that type ``` F 48 7A ;then hit return ``` ![wb2.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb2.jpg) after a while you will have some values 6 to be exact lets take a look at the first one at address D118, but lets start from the nearest 0 so type ``` D D100 ;press enter a few times to scroll down, ah this is interesting ``` it looks liek the start of the copylock notice the PEA and ILLEGAL ect… ok take note of this address D100, so lets scroll down some more, hmm all we see is alot of encrypted code but dont let it put you off carry on scrolling down eventualy you will come across some recognisable code ![wb3.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb3.jpg) this must be the end of the copylock look at line 00D644, ``` CMP.L #8488FFC4,D0 ;what this is telling the computer to do is check D0 ``` for value 8488FFC4, ``` BEQ 0000D65C : and if it is equal then continue to load the game,so it ``` jumps to address D65C ``` JSR 0000D01C ; if not then lock the game in a loop ``` …… so address D65C is the point we want so take note ,lets go back to the start of the copylock at D100 type ``` A D100 ;assemble code ``` then type ``` BRA D65C ;press enter twice ``` ![wb4.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb4.jpg) so we tell the game to skip the copylock routine and just BRANCH straight to the END (the part of the code that continues to load the game, ok now exit with X ;then enter wait a few moments and you should see this ![wb5.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb5.jpg) ok so lets put this change on disk, reboot hit action reply on the back screen then type this ``` M D100 ;hit return then ESC then type ``` ``` M D65C ;hit return then ESC, and you will end up with this ``` ![wb6.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb6.jpg) these digits will help us find the code on the disk, now lets read the disk into memory ``` type RT 50 28 010000 ``` after a while the job will be done so lets search for some of these digits, ``` type F 2F 0E 4D FA ``` you will end up with 2 points d100 and 2F900 its not D100 cos that the memory location we used so must be 2F900, ok write this down now lets search for the second type, F 20 5F 4e 75 00 00, we end up with 2 more and once again only interested in the last one 2FE5C ![wb7.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb7.jpg) right so armed with all these address points lets start shooting ,boom bang bang boom ..oopps got carried away there sorry ,so lets change these points type ``` A 2f900 ;then hit return, then type ``` ``` BRA 2FE5C ;then hit return twice, thats it code changed ,lets put it back ``` on disk , type, WT 50 28 10000 once done reboot and try it out ![wb8.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb8.jpg) right now this is cracked lets add a small trainer ,so based on CybFrog’s Tutorial in the forum lets add his code, so open action replay and type this ``` RT 0 01 40000, this wil read first track into memory location 40000, ``` scan dow nthe bootblock by typing D 4000C, scroll down till you see ``` JMP 000000400 ``` notice the address this is at 40086, so lets edit this, type ``` A 40086 ;then enter then type ``` ``` btst #6,bfe001 ;left mouse button ``` ``` beq 40100 ;if the left mouse button is pressed continue to address 40100, ``` ``` jmp 400 ;if its not pressed jump to address 400 to load the game, ok ``` once this is done lets add cybfrog’s code type, A 40100 ;the address we jump too if left button is pressed, then type ``` MOVE.W #4a78,A14 ``` ``` MOVE.W #4a79,13A0 ``` ``` MOVE.W #4a79,13AA ``` ``` MOVE.W #4a79,13D4 ``` ``` MOVE.W #4a79,64FC ``` ``` MOVE.W #4a79,6506 ``` ``` MOVE.W #4a79,A1B0 ``` ``` MOVE.W #4a79,A17A ``` ok once this is done type this small code to show the trainer is activated, ``` MOVE.W #F,DFF180 ;put colour red on screen ``` ``` MOVE.W #FF,DFF180 ,put another colour also on screen to make the screen ``` flash ``` BTST #A,DFF016 ;wait for right mouse button to be pressed ``` ``` BNE 40138 ;if its not pressed loop colour flasher ``` ``` JMP 400 ;if pressed continue to load the game ``` so it should look like this ![wb9.jpg](../assets/img/tutorials/wonderboy-in-monsterland/wb9.jpg) once this is done fix the bootchecksum by typing this, bootchk 40000 then write it back to disk, WT 0 01 040000 reboot and if you hold down the left mouse button while it boots untill the black screen appears then the screen should flash to tell you trainer activated press right mouse button to continue to load the game ,if you dont press either button the game will load with no trainer as normal Enjoy Musashi 9 / Cybfrog ---------------------------------------------------------------------------- -- rapid1337.com -- The dumping ground for all things tech // knowledge is the weapon --